huawei-cloud-ascend-profiler-db-explorer

• Outcome: Review
• Latest audit: Sep 21, 2026 · 6:54 AM UTC
• Version: 1.0.1

Overview

The skill is mostly aligned with querying Ascend profiler databases, but it needs review because its SQL execution scope and data-export behavior are not tightly bounded.

Install only if you intend to let the agent inspect Ascend/msprof SQLite profiler databases. Provide explicit database paths, review generated SQL before execution, prefer read-only sqlite access, and avoid CSV export unless you are comfortable persisting profiler metadata such as operator names, timings, hardware topology, and model-performance details.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The implemented script only inspects a local reference markdown file and optionally connects to a SQLite database to enumerate table names from sqlite_master. Its main functions are: list documented tables, list DB tables, compare document vs DB table presence, and retrieve a documentation section for a table name. While this partially aligns with the narrow claim of schema extraction/checking, it materially fails to implement the core declared purpose: converting natural language questions into safe executable SQL and querying Ascend/msprof performance data such as operator time, communication, or dispatch bottlenecks. Therefore the description significantly overstates the skill's actual behavior.

Hidden Instructions

High

• Category: Prompt Injection

Content

## msprofguideoutputdbformatformulaDataDescription

msprofcommandcommandExecution Completeafter, ableGenerate aSummaryallhavePerformanceDataofmsprof\_\{timebetweenstab\}.dbtableStructurefile, oughtfilepushrecommendUsageMindStudio InsightToolssearchsee, alsocanin order toUsageNavicat PremiumetcDatabaseDevelopmentToolsstraightconnectprintopen. whenpreviousdbfileSummaryofPerformanceDataifunder:

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence
• Finding: The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill claims to produce safe SQL, yet the instructions permit general sqlite3 command use and SQL execution against a user-supplied database without a clearly enforced read-only allowlist. In an agent setting, natural-language-to-SQL plus unrestricted execution can enable dangerous queries, data overexposure, or abuse of SQLite features if downstream tooling does not enforce strict controls.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger terms are broad and include generic database words like 'sql', 'table', and 'schema', which can cause this skill to activate for unrelated requests. In an agentic environment, unintended activation matters because it can route benign conversations into a workflow that generates and executes database queries on user-provided paths.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Very short examples like 'Operator?' and vague phrases like 'QueryprofilerDatabase' are highly collision-prone and can spuriously invoke the skill. Because the skill can lead to SQL generation and database reads, ambiguous triggering increases the chance of accidental data access or inappropriate tool use.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The instruction that this skill 'must first and only' handle any profiling DB query creates an overly broad monopoly over a large class of requests without clear boundaries. In practice this can suppress safer general-purpose handling and force users into a path that encourages SQL execution even when a non-executing answer would suffice.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Using generic trigger words plus 'similar expressions' makes invocation criteria open-ended and difficult to reason about. In agent systems, fuzzy activation increases the probability of unreviewed tool use and unintended access to local data sources.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The 'Mandatory Restrictions' section says table structure should be obtained through scripts/get_schema.py first and explicitly allows PRAGMA table_info(TABLE) as a supplement when documentation is missing. Later, the 'Track B Usage Principles' section states it is 'Forbidden' to directly execute PRAGMA table_info(TABLE) as a schema source and says the model must call get_schema.py instead. These instructions actively contradict each other about whether PRAGMA-based schema inspection is permitted.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill describes executing SQL on user-provided databases and exporting results to CSV, but it does not clearly warn about sensitive-data exposure, output-file persistence, or path/permission implications. In a profiling context, database contents and exported files may reveal model structure, operator names, timings, hardware topology, or other sensitive operational metadata.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Check file permissions
ls -la profiling.db
chmod 644 profiling.db
```

### Issue: Database locked

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.