huawei-cloud-mrs-hetu-sql-check

• Outcome: Pass
• Latest audit: Sep 21, 2026 · 6:51 AM UTC
• Version: 1.0.2

Overview

This skill is a local HetuEngine SQL checker with no evidence of network access, credential use, persistence, or hidden behavior, though its documented coverage is broader than parts of the implementation.

Install is reasonable for local HetuEngine SQL linting. Review SQL/file inputs before running it, avoid passing sensitive non-SQL files, and treat results as advisory because some documented checks are partial and reports/rule text are largely Chinese.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill claims comprehensive syntax, specification, and optimization review, but the finding indicates the implementation is much more limited. This can cause users to trust incomplete analysis results, leading to unsafe SQL or policy violations being missed because the tool overstates its coverage and assurance.

Memory Manipulation

High

• Category: Memory Poisoning

Content

**Typical Use Cases**:
- "Check this HetuEngine SQL: SELECT * FROM t1"
- "Does this CREATE TABLE follow HetuEngine specification?"
- "Validate the syntax of this INSERT OVERWRITE statement"
- "Review my SQL for HetuEngine specification compliance"
- "Check if my SQL uses PARTITIONED BY correctly"

• Confidence: 85% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Ae1

High

• Category: analysis-evasion

Content

[hetu_sql_checker.py](scripts/hetu_sql_checker.py)

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

[hetu_sql_parser.py](scripts/hetu_sql_parser.py)

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| [Keywords](rules/keywords.py) | 400+ HetuEngine SQL keyword definitions |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| [Grammar Rules](rules/grammar_rules.py) | 30+ statement type grammar definitions |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

"""Get the category of a statement type"""
    rule = STATEMENT_RULES.get(statement_type)
    if rule:
        return rule["category"]
    return None

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Memory Manipulation

High

• Category: Memory Poisoning

Content

Collabel("VALUES", KeywordCategory.RESERVED, "Values list"),
    Collabel("SET", KeywordCategory.RESERVED, "Set clause"),
    Collabel("UPDATE", KeywordCategory.RESERVED, "Update statement"),
    Collabel("DELETE", KeywordCategory.RESERVED, "Delete statement"),
    Collabel("INSERT", KeywordCategory.RESERVED, "Insert statement"),
    Collabel("CREATE", KeywordCategory.RESERVED, "Create statement"),
    Collabel("DROP", KeywordCategory.RESERVED, "Drop statement"),

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High

• Category: Memory Poisoning

Content

return node

    # ============================================================
    # DELETE Statement Parser
    # ============================================================

    def _parse_delete(self):

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High

• Category: Memory Poisoning

Content

# ============================================================

    def _parse_delete(self):
        """Parse DELETE statement"""
        node = ASTNode("DeleteStmt")
        start_token = self._current()

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High

• Category: Memory Poisoning

Content

# ============================================================

    def _parse_set_reset(self, stmt_type):
        """Parse SET/RESET statement"""
        node = ASTNode("SetStmt")
        start_token = self._current()

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill instructs the agent to read and execute local Python scripts, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where consumers cannot clearly constrain or audit file access behavior, increasing the chance of unintended local file reads or broader capability use than expected.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The skill asserts that analysis is static, local-only, and requires no cluster connection, yet later references a rule that needs cluster queries. Conflicting security claims can mislead operators about data exposure and runtime behavior, potentially causing the skill to be used in environments where network or data-access assumptions are stricter than the real implementation.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This YAML file’s natural-language names, descriptions, and fix suggestions are entirely in Chinese, and there is no indication that the skill is region-specific or that users can opt into this language. Under the policy, forcing a specific language without user choice or documented justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This markdown template is entirely written in Chinese, including required report headings and field labels, which implies the generated report will be in a fixed language. The file does not offer any language selection, opt-in, or justification for a Chinese-only locale, which is a natural-language locale policy concern under the stated rules.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The manifest includes Chinese-only trigger phrases alongside one English phrase, and the skill's sample output/report sections are presented in Chinese without stating that users may choose another language. This can conflict with a language/locale policy requiring user choice rather than implicitly enforcing one locale.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: The skill says in Step 6 that the checker generates a Markdown report and even shows Markdown output, but later states that the direct command output is JSON format. These are mutually contradictory usage instructions about what the same checker command returns, which can mislead users about the skill's actual behavior.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: This YAML file defines all rule names, descriptions, and fix suggestions in Chinese, which can impose a specific language on users or downstream tooling. There is no indication that the skill is intentionally region-specific or that users may opt into another language.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: This is a code file, so SQP-2 applies to safety-relevant operations such as file access. The code opens and reads any path provided by the user, but there is no confirmation prompt or nearby disclosure comment explaining that the tool will access local files; the usage text only says it supports a file path, which does not function as a safety warning.

Static analysis

No suspicious patterns detected.