数据仓库运维技能

• Outcome: Pass
• Latest audit: Jun 23, 2026 · 5:01 AM UTC
• Version: 1.0.0

Overview

This is a coherent data-warehouse operations skill, but users should review generated SQL and reports before using them with real warehouse data.

Install only if you are comfortable giving the agent warehouse-related files such as SQL, DDL, query logs, billing exports, and pipeline histories. Treat those as sensitive, prefer redacted samples, and review generated SQL, Airflow DAGs, and dbt models in a non-production environment before execution, especially statements that overwrite, merge, truncate, or drop tables. Open generated HTML reports only if you are comfortable with their CDN-loaded JavaScript dependencies.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill instructs the agent to read multiple reference/config/data files and generate outputs such as DDL, YAML, SQL, and HTML reports, which clearly implies file read/write capability. Because those capabilities are not explicitly declared or constrained, downstream systems may grant broader access than users expect, increasing the risk of unauthorized access to local data or unintended file creation/overwrite.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The page loads executable JavaScript from a third-party CDN at runtime, which creates a supply-chain and integrity risk: if the CDN, dependency, or network path is compromised, attacker-controlled code will run in the page. In this skill, the file is a local visualization page and does not require remote code execution to function, so pulling code from jsDelivr expands trust unnecessarily.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger list is very broad and includes common technical terms such as ETL, data quality, and data lineage. This can cause the skill to activate during ordinary conversation and begin reading files, proposing pipeline actions, or generating artifacts in contexts where the user did not intend to invoke an operational skill.

Vague Triggers

Medium

• Confidence: 75% confidence
• Finding: The workflow says to act whenever a user raises a warehouse-related need, but it does not clearly distinguish between informational discussion and permissioned operational work. In practice, this ambiguity can lead the skill to overreach by loading references, invoking scripts, or preparing outputs without a sufficiently explicit user request.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill processes potentially sensitive operational datasets such as query logs, billing records, DDL, SQL files, and pipeline run histories, yet it provides no privacy handling guidance, minimization rules, or masking requirements. These inputs often contain table names, business logic, identifiers, cost data, and sometimes embedded secrets or personal data, so silent ingestion can expose confidential information.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The generator emits executable ETL templates that include destructive write operations such as TRUNCATE, MERGE/UPDATE, and staging-table overwrite behavior, but the tool only presents generic success output and no explicit warning that the generated pipeline can delete or replace data. In a data-warehouse operations skill, users are likely to run generated code in privileged environments, so lack of clear safety signaling increases the chance of accidental production data loss or corruption.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The custom SQL template generates CREATE OR REPLACE TABLE and DROP TABLE IF EXISTS statements against staging objects, which are inherently destructive because they overwrite existing tables and remove data. Even if intended for ETL staging, emitting this SQL without a clear warning, environment guardrails, or safer defaults can lead to accidental execution against shared or production datasets.

Static analysis

No suspicious patterns detected.