MySQL 数据库管理技能。通过自然语言查询、管理 MySQL 数据库,支持 SELECT/INSERT/UPDATE/DELETE、表管理、备份恢复等操作。当用户提到 MySQL、数据库查询、建表、数据备份时使用此技能。
Security Analysis
medium confidenceSkill appears to do what it says (generate and run MySQL commands), but there are packaging/metadata inconsistencies and credential-handling recommendations you should verify before use.
The skill's name, description, and SKILL.md all describe MySQL management and the instructions and examples are coherent with that purpose. However, the registry metadata at the top states 'Required binaries: none' while the included package.json declares runtime requirements for the mysql and mysqldump clients and provides install commands — this mismatch is a packaging/metadata inconsistency that should be resolved.
SKILL.md stays within the stated purpose: it describes installing a MySQL client, configuring connection via ~/.my.cnf or environment variables, generating SQL, running mysql/mysqldump for backup/restore, and gives troubleshooting and safety advice. It does not instruct reading unrelated files or sending data to external endpoints.
There is no aggressive install (no remote arbitrary downloads). package.json includes an 'openclaw.install' section that recommends installing the MySQL client via apt/brew — a low-risk, standard system package install. But the registry summary said 'No install spec' while package.json includes install instructions; this inconsistency should be resolved.
SKILL.md suggests using MYSQL_HOST, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DATABASE or a ~/.my.cnf file — these are exactly the credentials needed for MySQL access and are proportionate to the skill's function. Note: storing plaintext passwords in ~/.my.cnf or environment vars is convenient but has security implications; the SKILL.md itself notes using env vars and least-privilege accounts, which is appropriate.
Skill is not always-enabled and does not request elevated persistent privileges. It suggests creating a per-user ~/.my.cnf (a normal, limited-scope config file). It does not attempt to modify other skills or system-wide settings beyond typical client installation guidance.
Guidance
This skill is generally coherent with its stated purpose (generating and running MySQL commands), but check a few things before installing: 1) Resolve the packaging/metadata mismatch — the registry summary claims no required binaries while package.json lists mysql/mysqldump and provides install commands; confirm you are comfortable with the client installation. 2) Never put sensitive production credentials into tools without review — prefer a least-privilege DB user, avoid using a root/admin account, and protect ~/.my.cnf (file permissions) if you create it. 3) Understand that the agent can generate and run SQL: require explicit confirmation for destructive write operations or use read-only credentials for routine queries. 4) Verify the source (package.json lists a GitHub repo and homepage); if the origin is unknown/untrusted, inspect the repository or avoid installing. If you need higher assurance, ask the maintainer for clarification or request a signed/official release before use.
Latest Release
v1.0.0
🎉 首发版本! 主要功能: • 🔍 智能查询 - 自然语言描述,自动生成 SQL • 📊 数据分析 - 快速统计、聚合、分组查询 • 🛠️ 表管理 - 建表、修改表结构、索引管理 • 💾 备份恢复 - 数据库/表级备份和恢复 • 🔧 优化建议 - 慢查询分析、索引优化建议 适合人群:开发者、数据分析师
Popular Skills
Published by @ryanlee-gemini on ClawHub