Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local HetuEngine SQL checker with no evidence of network access, credential use, persistence, or hidden behavior, though its documented coverage is broader than parts of the implementation.
Install is reasonable for local HetuEngine SQL linting. Review SQL/file inputs before running it, avoid passing sensitive non-SQL files, and treat results as advisory because some documented checks are partial and reports/rule text are largely Chinese.
The skill claims comprehensive syntax, specification, and optimization review, but the finding indicates the implementation is much more limited. This can cause users to trust incomplete analysis results, leading to unsafe SQL or policy violations being missed because the tool overstates its coverage and assurance.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
**Typical Use Cases**:
- "Check this HetuEngine SQL: SELECT * FROM t1"
- "Does this CREATE TABLE follow HetuEngine specification?"
- "Validate the syntax of this INSERT OVERWRITE statement"
- "Review my SQL for HetuEngine specification compliance"
- "Check if my SQL uses PARTITIONED BY correctly"
Referenced artifact was not completely inspected
[hetu_sql_checker.py](scripts/hetu_sql_checker.py)
Referenced artifact was not completely inspected
[hetu_sql_parser.py](scripts/hetu_sql_parser.py)
Referenced artifact was not completely inspected
| [Keywords](rules/keywords.py) | 400+ HetuEngine SQL keyword definitions |
Referenced artifact was not completely inspected
| [Grammar Rules](rules/grammar_rules.py) | 30+ statement type grammar definitions |
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
"""Get the category of a statement type"""
rule = STATEMENT_RULES.get(statement_type)
if rule:
return rule["category"]
return None
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Collabel("VALUES", KeywordCategory.RESERVED, "Values list"),
Collabel("SET", KeywordCategory.RESERVED, "Set clause"),
Collabel("UPDATE", KeywordCategory.RESERVED, "Update statement"),
Collabel("DELETE", KeywordCategory.RESERVED, "Delete statement"),
Collabel("INSERT", KeywordCategory.RESERVED, "Insert statement"),
Collabel("CREATE", KeywordCategory.RESERVED, "Create statement"),
Collabel("DROP", KeywordCategory.RESERVED, "Drop statement"),
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
return node
# ============================================================
# DELETE Statement Parser
# ============================================================
def _parse_delete(self):
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
# ============================================================
def _parse_delete(self):
"""Parse DELETE statement"""
node = ASTNode("DeleteStmt")
start_token = self._current()
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
# ============================================================
def _parse_set_reset(self, stmt_type):
"""Parse SET/RESET statement"""
node = ASTNode("SetStmt")
start_token = self._current()
The skill instructs the agent to read and execute local Python scripts, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where consumers cannot clearly constrain or audit file access behavior, increasing the chance of unintended local file reads or broader capability use than expected.
The skill asserts that analysis is static, local-only, and requires no cluster connection, yet later references a rule that needs cluster queries. Conflicting security claims can mislead operators about data exposure and runtime behavior, potentially causing the skill to be used in environments where network or data-access assumptions are stricter than the real implementation.
This YAML file’s natural-language names, descriptions, and fix suggestions are entirely in Chinese, and there is no indication that the skill is region-specific or that users can opt into this language. Under the policy, forcing a specific language without user choice or documented justification is a natural-language policy violation.
This markdown template is entirely written in Chinese, including required report headings and field labels, which implies the generated report will be in a fixed language. The file does not offer any language selection, opt-in, or justification for a Chinese-only locale, which is a natural-language locale policy concern under the stated rules.
The manifest includes Chinese-only trigger phrases alongside one English phrase, and the skill's sample output/report sections are presented in Chinese without stating that users may choose another language. This can conflict with a language/locale policy requiring user choice rather than implicitly enforcing one locale.
The skill says in Step 6 that the checker generates a Markdown report and even shows Markdown output, but later states that the direct command output is JSON format. These are mutually contradictory usage instructions about what the same checker command returns, which can mislead users about the skill's actual behavior.
This YAML file defines all rule names, descriptions, and fix suggestions in Chinese, which can impose a specific language on users or downstream tooling. There is no indication that the skill is intentionally region-specific or that users may opt into another language.
This is a code file, so SQP-2 applies to safety-relevant operations such as file access. The code opens and reads any path provided by the user, but there is no confirmation prompt or nearby disclosure comment explaining that the tool will access local files; the usage text only says it supports a file path, which does not function as a safety warning.