Hadoop

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:12 AM UTC
• Version: 1.0.0

Overview

This Hadoop skill is mostly legitimate cluster-administration guidance, but it should be reviewed because it stores broad activation behavior in global agent memory and includes high-impact cluster commands.

Install only if you are comfortable with a Hadoop assistant retaining cluster context locally and possibly changing future activation behavior. Before use, avoid saving sensitive cluster names or access details unless needed, and require explicit confirmation before any delete, skipTrash, kill, failover, decommission, chmod/chown, or service-impacting command is run.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: setup.md:15

Finding

Persistent Global Agent Memory Modification for Skill Activation

Content

View full analysis

Vulnerability Details

File Location: setup.md, lines 15–19
Vulnerability Type: Persistent modification of shared Agent memory
Risk Level: Medium

Vulnerable Code

markdown

### 1. First: Integration

Within the first 2-3 exchanges, understand how to activate:
- "Should I help whenever you mention Hadoop, HDFS, or YARN?"
- "Want me to jump in on any distributed processing questions?"

Save their answer to their MAIN memory for future sessions.

Technical Analysis

The setup instructions direct the Agent to save an automatic Hadoop activation preference to its global “MAIN memory.” This exceeds the Skill-local persistence required for Hadoop cluster notes and conflicts with the declared architecture in SKILL.md, which states that memory lives under ~/hadoop/.

Because MAIN memory is shared persistent state, the instruction can alter Agent behavior in unrelated future sessions. The saved preference is behavioral rather than merely informational: it determines when the Agent should automatically activate Hadoop-specific assistance. Even when the user agrees during onboarding, placing this rule in global memory unnecessarily expands its lifetime and scope.

This is classified as Agent Memory Poisoning because Skill instructions cause a persistent behavioral rule to be written outside the Skill’s dedicated storage namespace.

Attack Path

1. The Skill is loaded when ~/hadoop/ does not exist or is empty.
2. The Agent reads setup.md as required by SKILL.md.
3. During the first two or three exchanges, the Agent asks whether it should automatically assist whenever Hadoop, HDFS, or YARN is mentioned.
4. The user’s response is stored in global MAIN memory.
5. Subsequent sessions inherit the stored activation behavior, including sessions outside the original Hadoop workflow.
6. Mentions of Hadoop-related terms may trigger unsolicited Skill-specific behavior until the global memory entry is manually removed or changed.

Impact

...[truncated 653 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to write the activation preference to global MAIN memory.
2. Store the preference only in the Skill-specific file ~/hadoop/memory.md, using the existing integration field.
3. Require explicit, informed user consent before persisting any activation preference.
4. Scope the preference strictly to this Hadoop Skill rather than applying it as a general Agent rule.
5. Provide an explicit command or documented procedure for reviewing, disabling, and deleting the stored preference.
6. Avoid broad keyword-triggered activation. Require contextual relevance or direct user invocation.
7. Update the setup text to use a bounded instruction such as:

markdown

If the user explicitly consents, record the Hadoop Skill integration
preference in ~/hadoop/memory.md. Do not modify global or MAIN memory.
The user may review, disable, or remove this preference at any time.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (25)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

hdfs dfs -mv /src /dst # Move within HDFS

Maintenance

hdfs dfs -rm -r /path # Delete (trash) hdfs dfs -rm -r -skipTrash /path # Delete (permanent) hdfs dfs -expunge # Empty trash

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The skill includes hdfs dfs -rm -r -skipTrash /path, which permanently deletes HDFS data and bypasses the normal recovery safety net. In a Hadoop administration skill, providing a ready-to-use irreversible deletion command without nearby guardrails, path-scoping requirements, or strong confirmation language increases the chance of catastrophic operator or agent error.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

Maintenance

hdfs dfs -rm -r /path # Delete (trash) hdfs dfs -rm -r -skipTrash /path # Delete (permanent) hdfs dfs -expunge # Empty trash

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · hdfs.md (reported line 56)May include surrounding context.

Deleting Data

bash

# Move to trash (recoverable)
hdfs dfs -rm /path/file
hdfs dfs -rm -r /path/dir

# Permanent delete (skip trash)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

bash

# Move to trash (recoverable)
hdfs dfs -rm /path/file
hdfs dfs -rm -r /path/dir

# Permanent delete (skip trash)
hdfs dfs -rm -skipTrash /path/file

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · hdfs.md (reported line 57)May include surrounding context.

bash

# Move to trash (recoverable)
hdfs dfs -rm /path/file
hdfs dfs -rm -r /path/dir

# Permanent delete (skip trash)
hdfs dfs -rm -skipTrash /path/file

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · hdfs.md (reported line 57)May include surrounding context.

bash

# Move to trash (recoverable)
hdfs dfs -rm /path/file
hdfs dfs -rm -r /path/dir

# Permanent delete (skip trash)
hdfs dfs -rm -skipTrash /path/file

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The document explicitly teaches hdfs dfs -rm -skipTrash /path/file, which bypasses recovery and permanently deletes data. In a cluster-management skill, this is more dangerous because users may apply it directly to production datasets, causing irreversible loss from a single mistaken path.

Content

Scanner excerpt · hdfs.md (reported line 60)May include surrounding context.

md

hdfs dfs -rm -r /path/dir

# Permanent delete (skip trash)
hdfs dfs -rm -skipTrash /path/file
hdfs dfs -rm -r -skipTrash /path/dir

# Empty trash

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The recursive permanent deletion command hdfs dfs -rm -r -skipTrash /path/dir combines bulk deletion with bypassing trash, making mistakes catastrophic and unrecoverable. Because this skill is meant for Hadoop operations, the context increases the danger: users are likely to run these commands against real cluster paths at scale.

Content

Scanner excerpt · hdfs.md (reported line 61)May include surrounding context.

md

# Permanent delete (skip trash)
hdfs dfs -rm -skipTrash /path/file
hdfs dfs -rm -r -skipTrash /path/dir

# Empty trash
hdfs dfs -expunge

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction to save the user's answer to MAIN memory for future sessions directs persistent storage without any notice or consent flow. Persistent retention of operational preferences and environment context can create privacy and security risks, especially in enterprise infrastructure support scenarios.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs storing distribution/version, cluster names, workflows, problem areas, and user role in persistent files, which may expose sensitive infrastructure metadata if accessed by other tools or users. In a Hadoop administration context, these details materially aid reconnaissance against production systems.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Although operationally legitimate for reinitializing a fresh DataNode, this guidance includes a destructive recursive delete command that can cause permanent data loss if an operator or agent applies it to the wrong host or to a node with live data. In an agent skill context, such commands are more dangerous because they may be surfaced or executed without sufficient environment validation beyond the textual warning.

Content

Scanner excerpt · troubleshooting.md (reported line 90)May include surrounding context.

⚠️ DATA LOSS WARNING - only for fresh nodes with no data

1. Confirm node has no valuable data

2. Back up if uncertain: cp -r /data/hdfs/datanode/current /backup/

3. Only then remove: rm -rf /data/hdfs/datanode/current

4. Restart: service hadoop-hdfs-datanode restart

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Although operationally legitimate for reinitializing a fresh DataNode, this guidance includes a destructive recursive delete command that can cause permanent data loss if an operator or agent applies it to the wrong host or to a node with live data. In an agent skill context, such commands are more dangerous because they may be surfaced or executed without sufficient environment validation beyond the textual warning.

Content

Scanner excerpt · troubleshooting.md (reported line 90)May include surrounding context.

⚠️ DATA LOSS WARNING - only for fresh nodes with no data

1. Confirm node has no valuable data

2. Back up if uncertain: cp -r /data/hdfs/datanode/current /backup/

3. Only then remove: rm -rf /data/hdfs/datanode/current

4. Restart: service hadoop-hdfs-datanode restart

text

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · yarn.md (reported line 85)May include surrounding context.

Capacity Scheduler Config

Key parameters in capacity-scheduler.xml:

xml

<!-- Queue capacity (% of cluster) -->
yarn.scheduler.capacity.root.default.capacity=40
yarn.scheduler.capacity.root.production.capacity=60

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

**This skill does NOT:**
- Store credentials (use kinit/keytab separately)
- Make external API calls beyond your cluster
- Run destructive commands without asking first

## Related Skills
Install with `clawhub install <slug>` if user confirms:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document includes permanent and bulk deletion commands, including skip-trash variants, without surrounding cautions, scoping guidance, or verification steps. In an operational admin skill, this can normalize destructive commands and increase the chance of accidental irreversible data loss, especially if copied verbatim into production environments.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · hdfs.md (reported line 171)May include surrounding context.

md

hdfs dfs -chown -R user:group /path

# Change permissions
hdfs dfs -chmod 755 /path
hdfs dfs -chmod -R 755 /path

# Check ACLs

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill uses broad activation prompts like responding whenever Hadoop, HDFS, or YARN are mentioned, which can cause unintended invocation in unrelated contexts. This increases the chance the assistant will engage, collect information, or take actions without the user clearly intending to use this skill.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Persisting user-provided environment details across sessions creates a cross-session data retention channel that can outlive the immediate support interaction. Even if intended for convenience, retained operational context can be surfaced later inappropriately or exposed through file access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly collects and stores detailed cluster configuration and role information internally, which is sensitive operational data in a distributed systems environment. Because the skill context is Hadoop cluster management, the collected data is especially valuable for lateral understanding of enterprise infrastructure and therefore more dangerous than generic preference storage.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · troubleshooting.md (reported line 303)May include surrounding context.

Fix:

bash

# As superuser
hdfs dfs -chmod 755 /path
hdfs dfs -chown user:group /path

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown includes a yarn application -kill example that can terminate a running application, but it provides no warning about impact to running jobs or user workloads. For markdown files, safety-affecting behaviors should include clear warnings when they can affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

These steps append a host to /etc/hadoop/conf/yarn.exclude and refresh cluster nodes, which changes cluster state and can disrupt workloads during migration or removal. The section does not warn readers about required privileges, possible workload impact, or the need to verify the target node before proceeding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The transitionToActive and transitionToStandby commands alter HA state for ResourceManager instances and can affect cluster availability if used incorrectly. The markdown does not disclose that these are administrative, high-impact operations or advise operators to confirm target roles before execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The template explicitly directs the agent to create and update ~/hadoop/memory.md, which is a local filesystem write, but it provides no user-facing notice, consent step, or safety boundary around modifying local data. While the content appears operational rather than malicious, silent persistence to a user's home directory can surprise users, create unintended data retention, and normalize unauthorized file writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The cluster template instructs creation of additional per-cluster files under ~/hadoop/clusters/{name}.md without warning that more local files and directories will be written. In context this is likely meant for helpful state tracking, but it still expands persistent local modifications and could lead to unexpected storage of environment details on disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.