Security audit
Security checks for vulnerabilities and agentic risk
This diagnostic skill needs review because its default connections risk exposing credentials and its read-only instructions conflict with available administrative actions.
Before supplying production credentials, enable verify_ssl:true with the cluster's trusted CA in both configurations. Use a narrowly scoped diagnostic account and enforce an API allowlist excluding administrative writes and database-password retrieval. Resolve the conflicting log-collection instructions, and have an administrator review cleanup, restart, SSH, permission, and disk-test procedures. The reported coverage-gap files were independently examined; live responses, deployment permissions, and service-side authorization remain untested.
.Default TLS settings allow interception of service credentials and diagnostic traffic
Interception of reusable LakeWatch or Manager credentials, theft of tokens or session cookies, disclosure of diagnostic data, and manipulation of API responses. Subsequent account access is limited by the compromised account's permissions.
.Destructive Manager APIs bypass the documented read-only policy
With sufficiently privileged credentials, direct invocation can delete Manager users, alter alarm visibility, or abort running tasks without an execution-time authorization check. Server-side account permissions still apply; the helper does not itself elevate privileges.
External input (network, user) flows to a code execution sink. This enables remote code execution or command injection.
bin_path = config.get("crypto", {}).get("bin_path", "/usr/local/seccomponent/bin/CryptoAPI")
if not os.path.isfile(bin_path):
raise RuntimeError(f"CryptoAPI not found: {bin_path}")
proc = subprocess.run(
[bin_path, "-f", scc_conf, f"-{crypto_type}"],
input=data,
capture_output=True,
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
method="POST",
)
try:
res = urllib.request.urlopen(req, context=ctx)
body = json.loads(res.read().decode("utf-8"))
res.close()
except Exception as e:
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
)
try:
res = opener.open(req, timeout=30)
res.read()
res.close()
except urllib.error.HTTPError as e:
The repair guidance explicitly recommends truncating files with shell redirection before deleting them, irreversibly destroying their contents. In database incident diagnosis this can erase evidence or affect active files; requiring user confirmation reduces automatic-execution risk but does not make the procedure safe.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
| collectd | Abnormal collection plugin or excessively high collection frequency | Check whether there is an fd leak: `ls /proc/<pid>/fd \| wc -l` |
| rsyslog | A surge in log volume causes log writing to consume CPU | Check disk usage via `get_host_resource` |
| python/shell script | Scheduled task or abnormal script infinite loop | Confirm the script path and parameters |
| kswapd0 | Kernel paging process, indicating insufficient memory | Confirm the memory and swap state via `get_host_resource` |
---
L287 instructs restarting GaussDB if necessary, but the skill does not warn that this can interrupt database access and dependent services. A diagnosis workflow can therefore lead to a production-impacting action without disclosing its availability consequences.
The procedure changes SSH port configuration and restarts sshd without validating the configuration or confirming an alternate access path. An invalid configuration or a port blocked by firewall rules can prevent new administrative connections and impede recovery of the already-faulty node.
curl -k disables TLS certificate and hostname verification for the configured HTTPS health endpoint. An interceptor could impersonate the service and return a false healthy response; this diagnostic request shows no credentials or state-changing action, which limits the demonstrated impact.
HTTP/HTTPS type: Manually request the health check URL to confirm reachability:
curl -k <monitor.info>
| Phenomenon | Conclusion |
The guide escalates missing installation files to uninstalling and reinstalling a component instance without checking its role or preserving state. Because this alarm covers stateful components such as NameNode and DBService, an unsuitable uninstall procedure could remove essential state or prolong a cluster outage.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
ACS has no GC logs: If high CPU is located on the acs process, it cannot be investigated through GC logs; thread state must be analyzed directly via jstack.
messages log permission: The omm user may not have permission to read
/var/log/messages; sudo is required. If API collection fails, it is recommended that the user manually view it with sudo on the node.
python3 lakewatch_api_client.py -a collect_alarm_log_data \
The skill uses 'file_read' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
The diagnosis API catalog includes mutating operations that clear alarms or shield their reporting, expanding capability beyond read-only investigation. If the client exposes these entries and its credentials have cluster-management permission, misuse or agent instruction injection could conceal unresolved failures; the catalog alone does not demonstrate an authorization bypass.
In scripts/manager_api_apis/command.yaml, L32-L41 configure a PUT operation that aborts a task selected by command_id. Querying task status can support alarm diagnosis, but terminating a task is an operational intervention not justified by the manifest's purpose of identifying root causes and providing repair and verification steps.
The catalog exposes user creation and deletion despite their lack of relevance to alarm diagnosis. If callable with user-management credentials, these operations could enable unauthorized account provisioning or account removal through misuse of the diagnostic agent; actual impact depends on server-enforced permissions and accepted user data.
The catalog documents retrieval of database passwords, including an administrator password, while presenting the operation as a username-list query. Exposing this capability to an alarm-diagnosis agent creates an unnecessary secret-access path: an induced call using sufficiently privileged credentials could bring database secrets into agent context or diagnostic output, although the actual response contents are not shown.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- The password MUST be encrypted with `--encrypt-password` and stored in `scripts/lakewatch_api_config.yaml` (`auth.encrypted_password`). Never store the plaintext password.
- **Security Rules**:
- Never expose the LakeWatch password in conversation or command output
- Never ask the user to input the plaintext password in conversation; use the interactive `--encrypt-password` flow
- The token is cached locally with owner-only file permissions (Win: `%TEMP%\lakewatch_token\`, Linux: `/tmp/lakewatch_token/`)
### 3. MRS Manager Credential Configuration (Manager Mode)
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- The password MUST be encrypted with `python3 scripts/manager_api_client.py --encrypt-password` and stored in `scripts/manager_api_config.yaml` (`auth.encrypted_password`). Never store the plaintext password.
- **Security Rules**:
- Never expose the Manager password in conversation or command output
- Never ask the user to input the plaintext password in conversation; use the interactive `--encrypt-password` flow
- Windows AES ciphertext requires the `.aes_key` file to be migrated together to decrypt on another machine; Linux SCC ciphertext is not portable across clusters
- See [MRS Manager API Client](references/manager-api-client.md) for the full client usage.
The fallback instructs the diagnostic agent to invoke gather_log, which the skill explicitly prohibits as a write operation. This conflicting executable example can cause an agent to create a log package outside its read-only authorization boundary.
The automatic fallback creates an additional archive without addressing storage capacity, access restrictions, or retention of potentially sensitive audit logs. This can consume scarce disk space and duplicate sensitive records, although no external transmission is shown.
The repair guidance recommends restarting GaussDB without explaining its potential effect on active connections and database-dependent services. Calling the action a repair suggestion does not disclose the disruption it can cause.
The repair guidance directs cleanup of log and temporary files without warning that deletion may remove diagnostic evidence or files still needed by running services. It provides no preservation or target-validation safeguards.
The skill recommends cleaning up files without warning that this can permanently remove diagnostic evidence or affect files in active use. No instructions require preserving needed records or validating cleanup targets.
The DBService fallback explicitly instructs execution of the prohibited gather_log operation during diagnosis. Its placement in the executable diagnostic flow creates a direct conflict with the read-only boundary and can induce unauthorized archive creation.