huawei-cloud-mrs-hive-sql-check

• Outcome: Pass
• Latest audit: Sep 21, 2026 · 6:52 AM UTC
• Version: 1.0.1

Overview

This is a local Hive SQL checker that runs bundled Python scripts and did not show exfiltration, persistence, or deceptive behavior.

Install only if you want a local Hive SQL checking helper. Run it on SQL text or SQL files you intend to share with the agent, because reports may include snippets or the original SQL. Expect Chinese-language rule names and remediation text, and be aware of minor documentation mismatches in the listed defaults/rule counts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (19)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

**Typical Use Cases**:
- "Check this Hive SQL: SELECT * FROM t1"
- "Does this CREATE TABLE follow Hive specification?"
- "Validate the syntax of this INSERT OVERWRITE statement"
- "Review my Hive SQL for specification compliance"
- "Check if my SQL has partition pruning issues"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

md

[hive_sql_parser.py](scripts/hive_sql_parser.py)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

md

| [Keywords](rules/keywords.py) | Hive SQL keyword definitions |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

md

| [Grammar Rules](rules/grammar_rules.py) | Statement type grammar definitions |

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/hive_sql_parser.py (reported line 490)May include surrounding context.

python

return node

    # ============================================================
    # DELETE Statement Parser
    # ============================================================

    def _parse_delete(self):

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/hive_sql_parser.py (reported line 756)May include surrounding context.

python

DE
        if "CASCADE" in node.children.get("actions", "").upper():
            node.children["has_cascade"] = True

        node.tokens = [start_token]
        node.raw_text = self._get_raw_text(start_token)
        return node

    # ============================================================
    # DROP Parser
    # ============================================================

    def _parse_drop(self):
        node = ASTNode("DropStmt")
        start_token = self._current()

        self._advance()  # skip DROP

        # Object type
        obj_types = ["TABLE", "INDEX", "VIEW", "DATABASE", "SCHEMA", "FUNCTION",
                    "MATERIALIZED", "PROCEDURE", "PACKAGE"]
        obj_type = None
        for ot in obj_types:
            if self._current().is_keyword(ot):
                obj_type = ot
                self._advance()
                break
        node.children["object_type"] = obj_type or "UNKNOWN"

        # IF EXISTS
        if self._current().is_keyword("IF"):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill documents executable command paths and explicit file-based script access, but it does not declare any tool restrictions such as allowed-tools or permissions. In agent environments, missing scope declarations can let the skill run with broader-than-intended file/tool access, increasing the chance of unauthorized local file reads or command execution if the skill is invoked in a privileged runtime.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

**IMPORTANT: Multi-statement Context**: When the user provides multiple SQL statements (separated by `;`), you MUST pass ALL statements together in a single checker call. Do NOT split and check them individually. The checker engine has built-in multi-statement support that:

1. **First pass**: Scans all CREATE TABLE ... PARTITIONED BY statements to build a partitioned table registry (table names + partition field names)
2. **Second pass**: Checks each statement independently, but shares the partitioned table context so that SELECT/INSERT statements referencing partitioned tables can trigger SPEC022 (partition pruning missing)

This is critical for rules like SPEC022 (partition pruning) which require knowing whether a table is partitioned — information that only exists in CREATE TABLE statements, not in the SELECT statement itself.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown template is entirely written in Chinese, including headings and field labels, which effectively requires generated reports to be in a specific language. The file does not offer a language choice or explain that the skill is intentionally region-specific, so it creates a locale-policy issue under the natural-language policy rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This YAML rule file is written entirely in Chinese, including rule names, descriptions, and remediation text, with no indication that language selection is optional or configurable. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy concern applicable to all file types.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This YAML file contains human-readable rule names, descriptions, and fix suggestions exclusively in Chinese, which imposes a specific language on users or maintainers. Under the natural-language policy rule, forcing a language without opt-in or justification is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python skill embeds user-facing rule names, categories, messages, and fix suggestions in Chinese, such as the violation metadata starting at L0130. For a general-purpose SQL checker, forcing one language in outputs without offering a language/locale option can violate language-choice policy.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

## CRITICAL CONSTRAINT: No Extra Analysis

**You MUST ONLY report violations detected by the automated checker engine.** Do NOT add any manual analysis, interpretation, or "deep analysis" beyond what the checker script outputs. This includes but is not limited to:

- Do NOT manually inspect SQL logic for contradictions, dead code, or range conflicts
- Do NOT comment on Hive semantics of double quotes vs single quotes (Hive supports both as string literals)

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Check Modes section explicitly states 'Default: all mode' while the Parameters table lists the default for check_mode as 'syntax+spec'. These two statements cannot both be correct, so the documentation contradicts itself about the skill's actual default behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Output Format section says the report includes violations from INTERCEPT001-INTERCEPT011, while the earlier Large SQL Interception Check section enumerates only INTERCEPT001 through INTERCEPT007. This is an active contradiction in the skill's documentation about what the checker actually supports.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This YAML file’s natural-language fields, comments, and user-facing descriptions are all in Chinese, and there is no indication that the skill is region-specific or that users can opt into this locale. Under the policy for natural-language violations, forcing a specific language without user choice can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The CLI accepts SQL text or a file path, parses it, and prints AST content and detailed errors derived directly from the SQL input. In a SQL-review/checking skill, queries can contain sensitive table names, literals, partition values, comments, or embedded secrets, so printing them to stdout or logs can leak confidential information to terminals, CI logs, or agent traces.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code file contains a user-visible natural-language string, "未闭合的字符串", for unterminated string errors. Because the skill otherwise uses English for docstrings and CLI output, this hard-coded language choice can violate language/locale policy when no user opt-in or documented locale requirement is provided.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The skill's stated purpose is Hive SQL specification checking and this file is documented as a lexical analyzer, but the CLI also accepts a filesystem path and reads file contents directly. Reading arbitrary local files is not necessary to the tokenizer's core intent and introduces a capability beyond straightforward SQL text tokenization.

Content

No source excerpt is available for this finding.