huawei-cloud-dws-sql-check

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:50 AM UTC
• Version: 1.0.0

Overview

This skill is a local DWS SQL linting/checking helper with some documentation overclaims but no hidden network, credential, persistence, or destructive behavior found.

Install only if you want a local Huawei Cloud DWS SQL checker and are comfortable with Chinese-language reports. Treat it as a heuristic linting aid, not a complete DWS compliance authority, and only pass SQL text or intended SQL files to the CLI.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied code clearly aligns with part of the declared purpose: it parses DWS SQL, detects statement types, constructs AST-like structures, and returns syntax/tokenization errors. It also includes some lightweight checks/metadata extraction such as SELECT * detection, presence of primary key text, and missing WHERE flags for UPDATE/DELETE.

However, the description claims two major modes: syntax check and specification check. This code chunk only implements parsing and limited syntax-oriented extraction. There is no implementation of specification-rule enforcement such as naming conventions, object design standards, or data operation standards based on a DWS development specification. There is also no evidence here of clause order validation via grammar definitions, despite imports suggesting grammar/rule modules may exist; in this chunk, those rules are largely not used for actual validation. The parser is also not obviously 'comprehensive' in the claimed sense of checking clause completeness and compatibility across 160+ statement types; many statement types fall back to a generic parser that merely captures raw text.

So the code is related to the declared domain, but the declared description materially overstates the implemented behavior in this chunk, especially around specification auditing and comprehensive syntax/spec compliance checking.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 275)May include surrounding context.

md

| [Specification Rules](rules/spec_rules.yaml) | 40 specification check rule definitions |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

md

| [Keywords](rules/keywords.py) | 594 DWS SQL keyword definitions |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

md

| [Grammar Rules](rules/grammar_rules.py) | 160+ statement type grammar definitions |

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/dws_sql_parser.py (reported line 558)May include surrounding context.

python

return node

    # ============================================================
    # DELETE Statement Parser
    # ============================================================

    def _parse_delete(self):

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/dws_sql_parser.py (reported line 562)May include surrounding context.

python

# ============================================================

    def _parse_delete(self):
        """Parse DELETE statement"""
        node = ASTNode("DeleteStmt")
        start_token = self._current()

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/dws_sql_parser.py (reported line 860)May include surrounding context.

python

action_tokens.append(self._advance())
        node.children["actions"] = self._tokens_to_text(action_tokens).strip()

        node.tokens = [start_token]
        node.raw_text = self._get_raw_text(start_token)
        return node

    # ============================================================
    # DROP Parser
    # ============================================================

    def _parse_drop(self):
        """Parse DROP statement"""
        node = ASTNode("DropStmt")
        start_token = self._current()

        self._advance()  # skip DROP

        # Object type
        obj_types = ["TABLE", "INDEX", "VIEW", "SEQUENCE", "SCHEMA", "DATABASE",
                    "FUNCTION", "PROCEDURE", "TRIGGER", "TYPE", "DOMAIN", "ROLE",
                    "USER", "GROUP", "TABLESPACE", "EXTENSION", "FOREIGN",
                    "SYNONYM", "MATERIALIZED", "NODE", "OUTLINE", "DIRECTORY",
                    "PUBLICATION", "SUBSCRIPTION", "RESOURCE", "WORKLOAD"]
        obj_type = None

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases include broad terms like 'SQL优化' and 'SQL review', which can cause the skill to activate for generic SQL requests outside the intended DWS-specific context. Over-broad activation can route unrelated user input into this skill, leading to incorrect advice, unintended processing of sensitive SQL text, or overshadowing safer/more appropriate skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code emits natural-language rule names and categories in Chinese, and later generates a human-readable Markdown report entirely in Chinese. Because the file provides no user opt-in or locale selection, it enforces a specific language in user-facing output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The report generator hard-codes all headings and summary labels in Chinese, which is a natural-language locale constraint visible to users. The file does not present this as an explicit regional limitation or give users a choice of output language.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The Step 6 section says the check engine generates a Markdown report via dws_sql_checker.py, implying that command produces Markdown output. Later, the Quick Check Command section states that invoking dws_sql_checker.py directly outputs JSON and that Markdown requires calling a Python function instead, which is an active documentation contradiction about the same tool's behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This YAML manifest contains user-facing natural-language fields such as comments, names, descriptions, and fix suggestions entirely in Chinese. The file does not indicate that the skill is region-specific or provide any user opt-in or language selection, which can violate a language/locale policy requiring choice or explicit justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This YAML file's natural-language titles, descriptions, and suggestions are written entirely in Chinese, starting from the header comments. For a general-purpose skill file, this can constitute a locale/language policy issue because it imposes a specific language without offering user choice or documenting that the skill is intended only for a Chinese-language or region-specific context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest describes a SQL checking/tokenization skill for validating SQL text, which is satisfied by parsing provided SQL input. The CLI additionally interprets the argument as a filesystem path and reads file contents, introducing local file access that is not part of the stated SQL review capability.

Content

No source excerpt is available for this finding.