Hadoop

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:12 AM UTC
• Version: 1.0.0

Overview

This Hadoop skill is mostly legitimate cluster-administration guidance, but it should be reviewed because it stores broad activation behavior in global agent memory and includes high-impact cluster commands.

Install only if you are comfortable with a Hadoop assistant retaining cluster context locally and possibly changing future activation behavior. Before use, avoid saving sensitive cluster names or access details unless needed, and require explicit confirmation before any delete, skipTrash, kill, failover, decommission, chmod/chown, or service-impacting command is run.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: setup.md:15
• Finding: Persistent Global Agent Memory Modification for Skill Activation## Vulnerability Details **File Location**: `setup.md`, lines 15–19 **Vulnerability Type**: Persistent modification of shared Agent memory **Risk Level**: Medium ### Vulnerable Code ```markdown ### 1. First: Integration Within the first 2-3 exchanges, understand how to activate: - "Should I help whenever you mention Hadoop, HDFS, or YARN?" - "Want me to jump in on any distributed processing questions?" Save their answer to their MAIN memory for future sessions. ``` ### Technical Analysis The setup instructions direct the Agent to save an automatic Hadoop activation preference to its global “MAIN memory.” This exceeds the Skill-local persistence required for Hadoop cluster notes and conflicts with the declared architecture in `SKILL.md`, which states that memory lives under `~/hadoop/`. Because MAIN memory is shared persistent state, the instruction can alter Agent behavior in unrelated future sessions. The saved preference is behavioral rather than merely informational: it determines when the Agent should automatically activate Hadoop-specific assistance. Even when the user agrees during onboarding, placing this rule in global memory unnecessarily expands its lifetime and scope. This is classified as Agent Memory Poisoning because Skill instructions cause a persistent behavioral rule to be written outside the Skill’s dedicated storage namespace. ### Attack Path 1. The Skill is loaded when `~/hadoop/` does not exist or is empty. 2. The Agent reads `setup.md` as required by `SKILL.md`. 3. During the first two or three exchanges, the Agent asks whether it should automatically assist whenever Hadoop, HDFS, or YARN is mentioned. 4. The user’s response is stored in global MAIN memory. 5. Subsequent sessions inherit the stored activation behavior, including sessions outside the original Hadoop workflow. 6. Mentions of Hadoop-related terms may trigger unsolicited Skill-specific behavior until the global memory entry is manually removed or changed. ### Impact ...[truncated 653 chars]
• Remediation: ## Remediation Suggestions 1. Remove the instruction to write the activation preference to global MAIN memory. 2. Store the preference only in the Skill-specific file `~/hadoop/memory.md`, using the existing `integration` field. 3. Require explicit, informed user consent before persisting any activation preference. 4. Scope the preference strictly to this Hadoop Skill rather than applying it as a general Agent rule. 5. Provide an explicit command or documented procedure for reviewing, disabling, and deleting the stored preference. 6. Avoid broad keyword-triggered activation. Require contextual relevance or direct user invocation. 7. Update the setup text to use a bounded instruction such as: ```markdown If the user explicitly consents, record the Hadoop Skill integration preference in ~/hadoop/memory.md. Do not modify global or MAIN memory. The user may review, disable, or remove this preference at any time. ```

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (25)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

hdfs dfs -mv /src /dst             # Move within HDFS

# Maintenance
hdfs dfs -rm -r /path              # Delete (trash)
hdfs dfs -rm -r -skipTrash /path   # Delete (permanent)
hdfs dfs -expunge                  # Empty trash
```

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Maintenance
hdfs dfs -rm -r /path              # Delete (trash)
hdfs dfs -rm -r -skipTrash /path   # Delete (permanent)
hdfs dfs -expunge                  # Empty trash
```

• Confidence: 85% confidence
• Finding: The skill includes `hdfs dfs -rm -r -skipTrash /path`, which permanently deletes HDFS data and bypasses the normal recovery safety net. In a Hadoop administration skill, providing a ready-to-use irreversible deletion command without nearby guardrails, path-scoping requirements, or strong confirmation language increases the chance of catastrophic operator or agent error.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Deleting Data
```bash
# Move to trash (recoverable)
hdfs dfs -rm /path/file
hdfs dfs -rm -r /path/dir

# Permanent delete (skip trash)

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# Move to trash (recoverable)
hdfs dfs -rm /path/file
hdfs dfs -rm -r /path/dir

# Permanent delete (skip trash)
hdfs dfs -rm -skipTrash /path/file

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# Move to trash (recoverable)
hdfs dfs -rm /path/file
hdfs dfs -rm -r /path/dir

# Permanent delete (skip trash)
hdfs dfs -rm -skipTrash /path/file

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# Move to trash (recoverable)
hdfs dfs -rm /path/file
hdfs dfs -rm -r /path/dir

# Permanent delete (skip trash)
hdfs dfs -rm -skipTrash /path/file

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

hdfs dfs -rm -r /path/dir

# Permanent delete (skip trash)
hdfs dfs -rm -skipTrash /path/file
hdfs dfs -rm -r -skipTrash /path/dir

# Empty trash

• Confidence: 98% confidence
• Finding: The document explicitly teaches hdfs dfs -rm -skipTrash /path/file, which bypasses recovery and permanently deletes data. In a cluster-management skill, this is more dangerous because users may apply it directly to production datasets, causing irreversible loss from a single mistaken path.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Permanent delete (skip trash)
hdfs dfs -rm -skipTrash /path/file
hdfs dfs -rm -r -skipTrash /path/dir

# Empty trash
hdfs dfs -expunge

• Confidence: 99% confidence
• Finding: The recursive permanent deletion command hdfs dfs -rm -r -skipTrash /path/dir combines bulk deletion with bypassing trash, making mistakes catastrophic and unrecoverable. Because this skill is meant for Hadoop operations, the context increases the danger: users are likely to run these commands against real cluster paths at scale.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The instruction to save the user's answer to MAIN memory for future sessions directs persistent storage without any notice or consent flow. Persistent retention of operational preferences and environment context can create privacy and security risks, especially in enterprise infrastructure support scenarios.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill instructs storing distribution/version, cluster names, workflows, problem areas, and user role in persistent files, which may expose sensitive infrastructure metadata if accessed by other tools or users. In a Hadoop administration context, these details materially aid reconnaissance against production systems.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# ⚠️ DATA LOSS WARNING - only for fresh nodes with no data
# 1. Confirm node has no valuable data
# 2. Back up if uncertain: cp -r /data/hdfs/datanode/current /backup/
# 3. Only then remove: rm -rf /data/hdfs/datanode/current
# 4. Restart: service hadoop-hdfs-datanode restart
```

• Confidence: 90% confidence
• Finding: Although operationally legitimate for reinitializing a fresh DataNode, this guidance includes a destructive recursive delete command that can cause permanent data loss if an operator or agent applies it to the wrong host or to a node with live data. In an agent skill context, such commands are more dangerous because they may be surfaced or executed without sufficient environment validation beyond the textual warning.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# ⚠️ DATA LOSS WARNING - only for fresh nodes with no data
# 1. Confirm node has no valuable data
# 2. Back up if uncertain: cp -r /data/hdfs/datanode/current /backup/
# 3. Only then remove: rm -rf /data/hdfs/datanode/current
# 4. Restart: service hadoop-hdfs-datanode restart
```

• Confidence: 90% confidence
• Finding: Although operationally legitimate for reinitializing a fresh DataNode, this guidance includes a destructive recursive delete command that can cause permanent data loss if an operator or agent applies it to the wrong host or to a node with live data. In an agent skill context, such commands are more dangerous because they may be surfaced or executed without sufficient environment validation beyond the textual warning.

Hidden Instructions

High

• Category: Prompt Injection

Content

### Capacity Scheduler Config
Key parameters in `capacity-scheduler.xml`:
```xml
<!-- Queue capacity (% of cluster) -->
yarn.scheduler.capacity.root.default.capacity=40
yarn.scheduler.capacity.root.production.capacity=60

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**This skill does NOT:**
- Store credentials (use kinit/keytab separately)
- Make external API calls beyond your cluster
- Run destructive commands without asking first

## Related Skills
Install with `clawhub install <slug>` if user confirms:

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document includes permanent and bulk deletion commands, including skip-trash variants, without surrounding cautions, scoping guidance, or verification steps. In an operational admin skill, this can normalize destructive commands and increase the chance of accidental irreversible data loss, especially if copied verbatim into production environments.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

hdfs dfs -chown -R user:group /path

# Change permissions
hdfs dfs -chmod 755 /path
hdfs dfs -chmod -R 755 /path

# Check ACLs

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill uses broad activation prompts like responding whenever Hadoop, HDFS, or YARN are mentioned, which can cause unintended invocation in unrelated contexts. This increases the chance the assistant will engage, collect information, or take actions without the user clearly intending to use this skill.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Persisting user-provided environment details across sessions creates a cross-session data retention channel that can outlive the immediate support interaction. Even if intended for convenience, retained operational context can be surfaced later inappropriately or exposed through file access.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly collects and stores detailed cluster configuration and role information internally, which is sensitive operational data in a distributed systems environment. Because the skill context is Hadoop cluster management, the collected data is especially valuable for lateral understanding of enterprise infrastructure and therefore more dangerous than generic preference storage.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Fix:**
```bash
# As superuser
hdfs dfs -chmod 755 /path
hdfs dfs -chown user:group /path
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The markdown includes a `yarn application -kill` example that can terminate a running application, but it provides no warning about impact to running jobs or user workloads. For markdown files, safety-affecting behaviors should include clear warnings when they can affect user data or system integrity.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: These steps append a host to `/etc/hadoop/conf/yarn.exclude` and refresh cluster nodes, which changes cluster state and can disrupt workloads during migration or removal. The section does not warn readers about required privileges, possible workload impact, or the need to verify the target node before proceeding.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The `transitionToActive` and `transitionToStandby` commands alter HA state for ResourceManager instances and can affect cluster availability if used incorrectly. The markdown does not disclose that these are administrative, high-impact operations or advise operators to confirm target roles before execution.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The template explicitly directs the agent to create and update `~/hadoop/memory.md`, which is a local filesystem write, but it provides no user-facing notice, consent step, or safety boundary around modifying local data. While the content appears operational rather than malicious, silent persistence to a user's home directory can surprise users, create unintended data retention, and normalize unauthorized file writes.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The cluster template instructs creation of additional per-cluster files under `~/hadoop/clusters/{name}.md` without warning that more local files and directories will be written. In context this is likely meant for helpful state tracking, but it still expands persistent local modifications and could lead to unexpected storage of environment details on disk.

Static analysis

No suspicious patterns detected.