docs(skills): add MCP/DB read-only guard bypass skill

[gulmezeren2-byte]

Adds strix/skills/vulnerabilities/mcp_sql_guard_bypass.md.

Closes #845.

A distinct class from sql_injection.md: apps that intend to run caller-supplied SELECTs — database MCP servers (query tools), text-to-SQL, admin/BI consoles — but enforce "read-only" with a shape-based check (startswith-SELECT, keyword blocklist, or an escapable read-only transaction). Well-formed SELECTs still read files (pg_read_file), open sockets (dblink), run shell (xp_cmdshell), or escape the transaction (COMMIT; DROP …). This is the class behind the archived reference PostgreSQL MCP server and the Supabase "lethal trifecta," and it's increasingly relevant as agents get DB-access tools.

The skill mirrors the existing vulnerability-skill shape: attack surface → techniques by engine (Postgres/MSSQL/MySQL/SQLite) → confirmation methods (OOB, file-read echo, time-based, second-order) → false-positive avoidance (how to tell a bypassable shape check from a hardened function-level guard, so the agent reports real findings, not passes). Single markdown file, no code changes.

[greptile-apps]

Greptile Summary

This PR adds a skill for testing read-only SQL guard bypasses. The main changes are:

• Engine-specific payloads for PostgreSQL, MSSQL, MySQL/MariaDB, and SQLite.
• Confirmation methods for outbound access, file reads, delays, and second-order effects.
• Guidance for distinguishing shape-based checks from hardened controls.

Confidence Score: 4/5

The payload-to-guard classification needs correction before merging.

• The skill metadata matches the repository's loading conventions.
• Several listed commands cannot pass the SELECT-prefix guard used to frame the section.
• This can produce incorrect security-test conclusions.

strix/skills/vulnerabilities/mcp_sql_guard_bypass.md

Security Review

The skill covers an important security boundary, but it groups SELECT-prefix bypasses with commands that only target other guard designs. The payloads should be categorized by the guard they can pass so security testing produces accurate results.

Important Files Changed

Filename	Overview
strix/skills/vulnerabilities/mcp_sql_guard_bypass.md	Adds a correctly discoverable vulnerability skill, but its payload framing conflates SELECT-prefix, blocklist, and transaction-escape bypasses.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
strix/skills/vulnerabilities/mcp_sql_guard_bypass.md:19
**Payloads Target Different Guards**

This says every example passes a shape check, but `COPY`, `EXEC`, `ATTACH`, and the stacked `COMMIT; DROP` payload do not pass the described `startswith("SELECT")` guard. An agent testing that guard can draw the wrong conclusion from rejected payloads and miss a real SELECT-shaped bypass; separate the techniques by the exact guard they bypass.

_{Reviews (1): Last reviewed commit: "docs(skills): add MCP/DB read-only guard..." | Re-trigger Greptile}

[greptile-apps]

Payloads Target Different Guards

This says every example passes a shape check, but COPY, EXEC, ATTACH, and the stacked COMMIT; DROP payload do not pass the described startswith("SELECT") guard. An agent testing that guard can draw the wrong conclusion from rejected payloads and miss a real SELECT-shaped bypass; separate the techniques by the exact guard they bypass.

Prompt To Fix With AI

This is a comment left during a code review.
Path: strix/skills/vulnerabilities/mcp_sql_guard_bypass.md
Line: 19

Comment:
**Payloads Target Different Guards**

This says every example passes a shape check, but `COPY`, `EXEC`, `ATTACH`, and the stacked `COMMIT; DROP` payload do not pass the described `startswith("SELECT")` guard. An agent testing that guard can draw the wrong conclusion from rejected payloads and miss a real SELECT-shaped bypass; separate the techniques by the exact guard they bypass.

How can I resolve this? If you propose a fix, please make it concise.