ClawHub
Back to skill

Security audit

odps-sql

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for ODPS data work, but it can run unrestricted SQL with cloud credentials and may default to plaintext HTTP connections.

Review before installing. Use only a dedicated read-only ODPS/RAM identity with minimal project and table access, set the script's actual ALIYUN_ACCESS_KEY_ID, ALIYUN_ACCESS_KEY_SECRET, ALIYUN_ODPS_PROJECT, and ALIYUN_ODPS_ENDPOINT variables explicitly, require an HTTPS endpoint, and avoid running it from directories containing unrelated .env files.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/odps_helper.py:69
Finding

ODPS Connections Default to Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/odps_helper.py:130
Finding

Unrestricted SQL Execution Using the Configured ODPS Principal

Content
View full analysis
= limit: break ``` ```python group.add_argument("--query", metavar="SQL", help="执行 SQL 查询") parser.add_argument("--pattern", metavar="PATTERN", help="表名过滤关键词（配合 --list-tables）") parser.add_argument("--limit", type=int, default=100, help="查询结果行数限制，默认 100") args = parser.parse_args() odps = get_odps_client() if args.list_tables: cmd_list_tables(odps, pattern=args.pattern) elif args.describe: cmd_describe(odps, args.describe) elif args.query: cmd_query(odps, args.query, limit=args.limit) ``` ```bash python $SCRIPT --query "" [--limit ] ``` ### Technical Analysis The helper passes the supplied SQL directly to `odps.execute_sql` without checking that it is a single read-only query. There is no allowlist of acceptable statement types and no rejection of DDL, DML, administrative commands, or multiple statements where the service permits them. The `--limit` argument is not a server-side SQL limit. It only stops iterating through returned records after execution has already begun. It therefore does not prevent destructive statements, expensive full-table scans, large joins, or other resource-intensive operations. This is particularly significant for an AI Agent Skill because task text may influence the generated command. Malicious or misleading instructions embedded in user-controlled content could cause the agent to invoke the helper with a destructive statement. The resulting authority is b ...[truncated 1120 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:22
Finding

Unpinned PyODPS Dependency Installation

Content
View full analysis
# venv users: source .venv/bin/activate pip install pyodps ``` ### Technical Analysis The setup instructions install `pyodps` without a version constraint, lockfile, or package hash. Installation therefore resolves whatever package version and transitive dependency set the package index serves at that time. No malicious dependency is present in the reviewed project, and the package name shown is not an evident typo. The risk arises from non-reproducible dependency resolution: a future compromised, malicious, or unexpectedly incompatible release could be installed without a source change in this Skill. Python packages and their installation mechanisms can execute code during installation or later when imported by `odps_helper.py`. ### Attack Path 1. A user follows the documented setup instructions. 2. `pip` queries the configured package index for the latest acceptable `pyodps` release and its transitive dependencies. 3. If the index, package release, maintainer account, or a transitive dependency has been compromised, `pip` downloads the affected artifact. 4. Malicious code executes during installation or when the helper imports `from odps import ODPS`. 5. The code runs with the operating-system privileges of the user launching the installation or helper. ### Impact Assessment A compromised dependency could access files, environment variables, and network resources available to the current user. In this project, that scope may include the Alibaba Cloud access key and secret loaded into the process environment, enabling compromise of ODPS resources available to those credentials. Operating-system impact remains bounded by the account and environment running `pip` or the helper. ]]>
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (20)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
# ODPS Skill 配置文件
# 使用步骤：
#   1. 将此文件复制为 .env：  cp config.example.env .env
#   2. 填写下方的实际配置值
#   3. .env 文件仅供本地使用，请勿提交到代码仓库

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
# ODPS Skill 配置文件
# 使用步骤：
#   1. 将此文件复制为 .env：  cp config.example.env .env
#   2. 填写下方的实际配置值
#   3. .env 文件仅供本地使用，请勿提交到代码仓库

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config.example.env (reported line 3)May include surrounding context.

text
# ODPS Skill 配置文件
# 使用步骤：
#   1. 将此文件复制为 .env：  cp config.example.env .env
#   2. 填写下方的实际配置值
#   3. .env 文件仅供本地使用，请勿提交到代码仓库

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config.example.env (reported line 5)May include surrounding context.

text
# ODPS Skill 配置文件
# 使用步骤：
#   1. 将此文件复制为 .env：  cp config.example.env .env
#   2. 填写下方的实际配置值
#   3. .env 文件仅供本地使用，请勿提交到代码仓库

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/odps_helper.py (reported line 11)May include surrounding context.

python
# ODPS Skill 配置文件
# 使用步骤：
#   1. 将此文件复制为 .env：  cp config.example.env .env
#   2. 填写下方的实际配置值
#   3. .env 文件仅供本地使用，请勿提交到代码仓库

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/odps_helper.py (reported line 13)May include surrounding context.

python
# ODPS Skill 配置文件
# 使用步骤：
#   1. 将此文件复制为 .env：  cp config.example.env .env
#   2. 填写下方的实际配置值
#   3. .env 文件仅供本地使用，请勿提交到代码仓库

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/odps_helper.py (reported line 15)May include surrounding context.

python
# ODPS Skill 配置文件
# 使用步骤：
#   1. 将此文件复制为 .env：  cp config.example.env .env
#   2. 填写下方的实际配置值
#   3. .env 文件仅供本地使用，请勿提交到代码仓库

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/odps_helper.py (reported line 16)May include surrounding context.

python
# ODPS Skill 配置文件
# 使用步骤：
#   1. 将此文件复制为 .env：  cp config.example.env .env
#   2. 填写下方的实际配置值
#   3. .env 文件仅供本地使用，请勿提交到代码仓库

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/odps_helper.py (reported line 28)May include surrounding context.

python
# ODPS Skill 配置文件
# 使用步骤：
#   1. 将此文件复制为 .env：  cp config.example.env .env
#   2. 填写下方的实际配置值
#   3. .env 文件仅供本地使用，请勿提交到代码仓库

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/odps_helper.py (reported line 32)May include surrounding context.

python
# ODPS Skill 配置文件
# 使用步骤：
#   1. 将此文件复制为 .env：  cp config.example.env .env
#   2. 填写下方的实际配置值
#   3. .env 文件仅供本地使用，请勿提交到代码仓库

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/odps_helper.py (reported line 33)May include surrounding context.

python
# ODPS Skill 配置文件
# 使用步骤：
#   1. 将此文件复制为 .env：  cp config.example.env .env
#   2. 填写下方的实际配置值
#   3. .env 文件仅供本地使用，请勿提交到代码仓库

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/odps_helper.py (reported line 92)May include surrounding context.

python
# ODPS Skill 配置文件
# 使用步骤：
#   1. 将此文件复制为 .env：  cp config.example.env .env
#   2. 填写下方的实际配置值
#   3. .env 文件仅供本地使用，请勿提交到代码仓库

Credential Access

High
Category
Privilege Escalation
Confidence
69% confidence
Finding

The script intentionally searches for a .env file in the current working directory before the skill directory, which can cause it to load secrets from an unexpected, attacker-influenced location if run in an untrusted directory. In a CLI skill context, this broadens the trust boundary and can lead to credential confusion, use of attacker-supplied endpoints, or accidental use of wrong cloud accounts.

Content

Scanner excerpt · scripts/odps_helper.py (reported line 34)May include surrounding context.

python
"""
    从 .env 文件加载配置，加载路径按顺序查找：
      1. 当前工作目录下的 .env
      2. 脚本所在目录的上一级（skill/）目录下的 .env
    已有的环境变量不会被覆盖（系统/shell 设置优先）。
    """
    candidates = [

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

This code loads .env from os.getcwd(), which is a weaker trust model than loading from a controlled application path. If the tool is invoked from a directory containing a malicious or stale .env, it may silently consume attacker-chosen credentials or endpoint settings, affecting which ODPS environment it queries and potentially exposing sensitive data to the wrong tenancy.

Content

Scanner excerpt · scripts/odps_helper.py (reported line 38)May include surrounding context.

python
已有的环境变量不会被覆盖（系统/shell 设置优先）。
    """
    candidates = [
        os.path.join(os.getcwd(), ".env"),
        os.path.join(os.path.dirname(__file__), "..", ".env"),
    ]
    for dotenv_path in candidates:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/odps_helper.py (reported line 39)May include surrounding context.

python
"""
    candidates = [
        os.path.join(os.getcwd(), ".env"),
        os.path.join(os.path.dirname(__file__), "..", ".env"),
    ]
    for dotenv_path in candidates:
        dotenv_path = os.path.normpath(dotenv_path)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/odps_helper.py (reported line 84)May include surrounding context.

python
"""
    candidates = [
        os.path.join(os.getcwd(), ".env"),
        os.path.join(os.path.dirname(__file__), "..", ".env"),
    ]
    for dotenv_path in candidates:
        dotenv_path = os.path.normpath(dotenv_path)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares required environment capabilities and instructs use of credential-bearing variables, but it does not explicitly constrain tool scope via permissions or allowed-tools. In an agent framework, that ambiguity can let the skill be invoked with broader execution context than intended, increasing the chance of unauthorized command execution or secret exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger guidance is broad enough to match many generic data-analysis requests, which can cause unintended invocation of a skill that executes Python and accesses cloud-backed data. Because this skill can run queries against ODPS using configured credentials, accidental activation expands the risk of unnecessary data access or execution in contexts where the user did not specifically request MaxCompute interaction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file contains user-facing instructional text entirely in Chinese, including setup steps and configuration guidance. The stated policy flags language or locale constraints when a skill forces a specific language without user opt-in, and there is no indication here that Chinese is optional or justified as a region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains natural-language instructions exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without opt-in can be a locale-policy violation.

Content

No source excerpt is available for this finding.