Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local YDB/Docker operations guide with powerful but clearly disclosed maintenance actions and repeated confirmation safeguards.
Install this only if you want an agent to help administer local-ydb stacks. Review any plan that touches Docker containers, volumes, auth files, passwords, public monitoring, or schema changes, and keep it limited to disposable or intended local-ydb hosts unless you have backups and a rollback path.
Referenced artifact was not completely inspected
- Read `references/mcp-tool-scenarios.md` when testing MCP tools, exercising the managed SQL safety matrix, planning structured schema generation/apply flows, o
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Do not mix static and dynamic image tags inside one profile.
- For stable GHCR tests, use the exact patch tag `ghcr.io/ydb-platform/local-ydb:26.1.1.6`.
<!-- BEGIN DECLARATIVE TOPOLOGY CONTRACT -->
## Declarative Topology Contract
- `dynamicNodeCount` is the total configured tenant-node count, including primary, and defaults to `1`.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
8. Confirm destroy, then bootstrap again. Inventory must contain exactly the three configured dynamic containers and no `-4`.
9. In `finally`, destroy the disposable stack and independently remove any leftover disposable containers, network, and volume.
<!-- BEGIN MANAGED SQL SCENARIOS -->
## Managed SQL Scenario: Query Service Safety Matrix
Goal: exercise `local_ydb_sql` against the selected configured local-ydb profile. Use the official `ydb-mcp` server instead when the target is an arbitrary YDB endpoint rather than a toolkit-managed local-ydb profile.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
umask 077
credentials_dir=$(mktemp -d)
cleanup() {
rm -f -- "$credentials_dir/root.password"
rmdir -- "$credentials_dir"
}
trap cleanup EXIT
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
umask 077
credentials_dir=$(mktemp -d)
cleanup() {
rm -f -- "$credentials_dir/root.password"
rmdir -- "$credentials_dir"
}
trap cleanup EXIT
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
umask 077
credentials_dir=$(mktemp -d)
cleanup() {
rm -f -- "$credentials_dir/root.password"
rmdir -- "$credentials_dir"
}
trap cleanup EXIT
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
umask 077
credentials_dir=$(mktemp -d)
cleanup() {
rm -f -- "$credentials_dir/root.password"
rmdir -- "$credentials_dir"
}
trap cleanup EXIT
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Unauthenticated local-dev examples:
curl -sSL 'http://127.0.0.1:8765/viewer/json/tenants?database=/local'
curl -sSL 'http://127.0.0.1:8765/viewer/json/nodelist?database=%2Flocal%2Fexample&enums=true&type=any' \
| python3 -m json.tool
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
whoami reachability checks:
curl -sS -o /tmp/local-whoami.out -w '%{http_code}\n' \
'http://127.0.0.1:8765/viewer/json/whoami'
curl -k -sS -o /tmp/public-whoami.out -w '%{http_code}\n' \
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
| jq -r '.[0].Id') NOW=$(date +%s) FROM=$((NOW - 600)) curl -fsS "http://127.0.0.1:8765/node/${GRAPH_NODE_ID}/viewer/json/graph?database=%2Flocal%2Fexample&target=resources.memory.used_bytes&from=${FROM}&until=${NOW}&maxDataPoints=1000"
The root `/viewer/json/graph` endpoint can return `GraphShard is not enabled on the database` even when `GraphShardExists=true` for `/local/<tenant>`.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- treating the profile's main `dynamicContainer` as removable through this tool
- assuming default removal can select configured suffixes
- using `nodeIds` for the base dynamic node; only IDs that resolve to suffix containers are removable
- removing multiple extra nodes at once on a live stack without checking `nodelist` after each removal
## Scenario 13: Add Storage Groups
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- treating the profile's main `dynamicContainer` as removable through this tool
- assuming default removal can select configured suffixes
- using `nodeIds` for the base dynamic node; only IDs that resolve to suffix containers are removable
- removing multiple extra nodes at once on a live stack without checking `nodelist` after each removal
## Scenario 13: Add Storage Groups
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
trap cleanup_input EXIT
trap "exit 130" INT
trap "exit 143" TERM
sudo cat /path/to/root.password >"$password_input"
test -s "$password_input"
docker exec -i ydb-local bash -lc '
set -euo pipefail
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
trap cleanup_input EXIT
trap "exit 130" INT
trap "exit 143" TERM
sudo cat /path/to/root.password >"$password_input"
test -s "$password_input"
docker exec -i ydb-local bash -lc '
set -euo pipefail
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
trap cleanup_input EXIT
trap "exit 130" INT
trap "exit 143" TERM
sudo cat /path/to/root.password >"$password_input"
test -s "$password_input"
docker exec -i ydb-local bash -lc '
set -euo pipefail
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
trap cleanup_input EXIT
trap "exit 130" INT
trap "exit 143" TERM
sudo cat /path/to/root.password >"$password_input"
test -s "$password_input"
docker exec -i ydb-local bash -lc '
set -euo pipefail
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
trap cleanup_input EXIT
trap "exit 130" INT
trap "exit 143" TERM
sudo cat /path/to/root.password >"$password_input"
test -s "$password_input"
docker exec -i ydb-local bash -lc '
set -euo pipefail
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
This rebuild procedure explicitly starts a fresh database with anonymous access enabled and TLS disabled. Even though the text warns it is temporary, this weakens authentication and transport protections and can expose the database to unauthorized local or network access if bindings, Docker networking, or host isolation are broader than assumed.
docker rm -f ydb-local ydb-dyn-example 2>/dev/null || true
sudo install -d -o root -g root -m 0755 /path/to/ydb-data
docker run -d --name ydb-local \
--no-healthcheck \
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
whoami reachability checks:
curl -sS -o /tmp/local-whoami.out -w '%{http_code}\n' \
'http://127.0.0.1:8765/viewer/json/whoami'
curl -k -sS -o /tmp/public-whoami.out -w '%{http_code}\n' \
The documentation includes a state-changing GraphShard backend switch followed immediately by a container restart, but it does not clearly warn that this mutates runtime configuration and can cause service interruption. In an ops skill, omission of impact/rollback guidance can lead an agent or operator to execute the sequence during verification when they intended to perform a read-only check.
Detected: suspicious.exposed_secret_literal