huawei-cloud-mrs-hive-sql-check

• Outcome: Pass
• Latest audit: Sep 21, 2026 · 6:52 AM UTC
• Version: 1.0.1

Overview

This is a local Hive SQL checker that runs bundled Python scripts and did not show exfiltration, persistence, or deceptive behavior.

Install only if you want a local Hive SQL checking helper. Run it on SQL text or SQL files you intend to share with the agent, because reports may include snippets or the original SQL. Expect Chinese-language rule names and remediation text, and be aware of minor documentation mismatches in the listed defaults/rule counts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (19)

Memory Manipulation

High

• Category: Memory Poisoning

Content

**Typical Use Cases**:
- "Check this Hive SQL: SELECT * FROM t1"
- "Does this CREATE TABLE follow Hive specification?"
- "Validate the syntax of this INSERT OVERWRITE statement"
- "Review my Hive SQL for specification compliance"
- "Check if my SQL has partition pruning issues"

• Confidence: 85% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Ae1

High

• Category: analysis-evasion

Content

[hive_sql_parser.py](scripts/hive_sql_parser.py)

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| [Keywords](rules/keywords.py) | Hive SQL keyword definitions |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| [Grammar Rules](rules/grammar_rules.py) | Statement type grammar definitions |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Memory Manipulation

High

• Category: Memory Poisoning

Content

return node

    # ============================================================
    # DELETE Statement Parser
    # ============================================================

    def _parse_delete(self):

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match

Content

DE
        if "CASCADE" in node.children.get("actions", "").upper():
            node.children["has_cascade"] = True

        node.tokens = [start_token]
        node.raw_text = self._get_raw_text(start_token)
        return node

    # ============================================================
    # DROP Parser
    # ============================================================

    def _parse_drop(self):
        node = ASTNode("DropStmt")
        start_token = self._current()

        self._advance()  # skip DROP

        # Object type
        obj_types = ["TABLE", "INDEX", "VIEW", "DATABASE", "SCHEMA", "FUNCTION",
                    "MATERIALIZED", "PROCEDURE", "PACKAGE"]
        obj_type = None
        for ot in obj_types:
            if self._current().is_keyword(ot):
                obj_type = ot
                self._advance()
                break
        node.children["object_type"] = obj_type or "UNKNOWN"

        # IF EXISTS
        if self._current().is_keyword("IF"):

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill documents executable command paths and explicit file-based script access, but it does not declare any tool restrictions such as allowed-tools or permissions. In agent environments, missing scope declarations can let the skill run with broader-than-intended file/tool access, increasing the chance of unauthorized local file reads or command execution if the skill is invoked in a privileged runtime.

Session Persistence

Medium

• Category: Rogue Agent

Content

**IMPORTANT: Multi-statement Context**: When the user provides multiple SQL statements (separated by `;`), you MUST pass ALL statements together in a single checker call. Do NOT split and check them individually. The checker engine has built-in multi-statement support that:

1. **First pass**: Scans all CREATE TABLE ... PARTITIONED BY statements to build a partitioned table registry (table names + partition field names)
2. **Second pass**: Checks each statement independently, but shares the partitioned table context so that SELECT/INSERT statements referencing partitioned tables can trigger SPEC022 (partition pruning missing)

This is critical for rules like SPEC022 (partition pruning) which require knowing whether a table is partitioned — information that only exists in CREATE TABLE statements, not in the SELECT statement itself.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown template is entirely written in Chinese, including headings and field labels, which effectively requires generated reports to be in a specific language. The file does not offer a language choice or explain that the skill is intentionally region-specific, so it creates a locale-policy issue under the natural-language policy rule.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This YAML rule file is written entirely in Chinese, including rule names, descriptions, and remediation text, with no indication that language selection is optional or configurable. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy concern applicable to all file types.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This YAML file contains human-readable rule names, descriptions, and fix suggestions exclusively in Chinese, which imposes a specific language on users or maintainers. Under the natural-language policy rule, forcing a language without opt-in or justification is a locale/language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This Python skill embeds user-facing rule names, categories, messages, and fix suggestions in Chinese, such as the violation metadata starting at L0130. For a general-purpose SQL checker, forcing one language in outputs without offering a language/locale option can violate language-choice policy.

Scope Creep

Low

• Category: Excessive Agency

Content

## CRITICAL CONSTRAINT: No Extra Analysis

**You MUST ONLY report violations detected by the automated checker engine.** Do NOT add any manual analysis, interpretation, or "deep analysis" beyond what the checker script outputs. This includes but is not limited to:

- Do NOT manually inspect SQL logic for contradictions, dead code, or range conflicts
- Do NOT comment on Hive semantics of double quotes vs single quotes (Hive supports both as string literals)

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: The Check Modes section explicitly states 'Default: all mode' while the Parameters table lists the default for check_mode as 'syntax+spec'. These two statements cannot both be correct, so the documentation contradicts itself about the skill's actual default behavior.

Intent-Code Divergence

Low

• Confidence: 93% confidence
• Finding: The Output Format section says the report includes violations from INTERCEPT001-INTERCEPT011, while the earlier Large SQL Interception Check section enumerates only INTERCEPT001 through INTERCEPT007. This is an active contradiction in the skill's documentation about what the checker actually supports.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This YAML file’s natural-language fields, comments, and user-facing descriptions are all in Chinese, and there is no indication that the skill is region-specific or that users can opt into this locale. Under the policy for natural-language violations, forcing a specific language without user choice can be a locale-policy issue.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The CLI accepts SQL text or a file path, parses it, and prints AST content and detailed errors derived directly from the SQL input. In a SQL-review/checking skill, queries can contain sensitive table names, literals, partition values, comments, or embedded secrets, so printing them to stdout or logs can leak confidential information to terminals, CI logs, or agent traces.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: This code file contains a user-visible natural-language string, "未闭合的字符串", for unterminated string errors. Because the skill otherwise uses English for docstrings and CLI output, this hard-coded language choice can violate language/locale policy when no user opt-in or documented locale requirement is provided.

Context-Inappropriate Capability

Low

• Confidence: 79% confidence
• Finding: The skill's stated purpose is Hive SQL specification checking and this file is documented as a lexical analyzer, but the CLI also accepts a filesystem path and reads file contents directly. Reading arbitrary local files is not necessary to the tokenizer's core intent and introduces a capability beyond straightforward SQL text tokenization.

Static analysis

No suspicious patterns detected.