Ambari API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:54 AM UTC
• Version: 0.1.0

Overview

This skill is a legitimate Ambari cluster-management tool, but it handles privileged credentials and live service changes with unsafe defaults that users should review before installing.

Review carefully before installing, especially for production clusters. Use a least-privilege Ambari account, avoid real passwords on the command line, do not rely on the plaintext config file for sensitive credentials, enable certificate verification or a trusted CA path before use, and treat stop/restart commands as outage-causing administrative actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ambari_api.py:35

Finding

TLS Certificate Verification Disabled by Default

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ambari_api.py:26

Finding

Ambari Credentials Stored in a Plaintext Configuration File

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ambari_api.py:319

Finding

Password Accepted and Documented as a Command-Line Argument

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Runtime Dependencies Use Open-Ended Version Constraints Without Integrity Pinning

Content

View full analysis

=2.28.0 urllib3>=1.26.0 ``` The documented installation command resolves these ranges at installation time: ```bash pip install -r ~/.claude/skills/ambari-api/scripts/requirements.txt ``` ### Technical Analysis The dependencies use lower bounds without upper bounds, exact version pins, lock-file resolution, or cryptographic hashes. Each installation may therefore retrieve a different future version that was not reviewed with this project. The package names shown are legitimate and the audited files do not specify a suspicious package source. Nevertheless, the dependency policy leaves the installation process exposed to compromised future releases, unexpected compatibility changes, and package-index or resolution attacks. The absence of hashes also prevents pip from verifying that an artifact is the exact artifact approved by the project. ### Attack Path 1. A user runs the documented `pip install` command. 2. Pip resolves the newest versions satisfying the open-ended constraints. 3. A future dependency release, package-index artifact, or transitive dependency is compromised or behaves incompatibly. 4. Pip downloads and installs the unreviewed artifact. 5. Package installation code or imported runtime code executes with the privileges of the user performing the installation or running the Skill. 6. The compromised dependency can access the same files, credentials, and network resources available to that process. ### Impact Assessment The potential impact is bounded by the privileges of the installing or executing user. Those privileges may include access to the plaintext Ambari configuration, the user's files, and network access to cluster-management endpoints. No currently m ...[truncated 159 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose understates and inconsistently describes the skill’s behavior, including local credential storage and host-level operations beyond the stated management scope. Description-behavior mismatches are dangerous because users and orchestration systems may invoke the skill under false assumptions, leading to sensitive credential exposure or broader-than-expected administrative actions on cluster infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file shows plaintext credentials on the command line for both development and production examples without warning that shell arguments are exposed via history, process listings, terminal logging, and operational runbooks. In the context of an Ambari administration tool, this is especially dangerous because the credentials are for privileged cluster management, making accidental disclosure likely and high-value to an attacker.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The client sends HTTP Basic Auth credentials while TLS certificate verification is disabled by default and related warnings are suppressed. In the context of cluster administration, this enables man-in-the-middle interception or tampering of credentials and management commands, potentially allowing an attacker to take over or disrupt Hadoop services.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documents commands that read and write local files and perform network operations against Ambari, but it declares no explicit tool scope or permission boundaries. This increases the chance that an agent or reviewer will underestimate the skill’s real capabilities, enabling unintended file access, credential handling, or cluster changes without clear policy constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation text uses broad triggers such as mentions of Ambari, HDP, HDF, or cluster operations without clear guardrails. Over-broad activation can cause the skill to be selected in contexts where the user did not intend administrative actions, increasing the risk of unnecessary credential prompts, information disclosure, or destructive API calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The quick-start instructions tell users to supply and store Ambari credentials, including a password, without any warning about sensitive data handling or storage protections. Because this skill manages administrative cluster access, unsafe credential storage can directly enable unauthorized control over services, hosts, and operational state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation presents stop and restart operations as routine commands without warning about operational impact, downtime, or the need for explicit confirmation. In the context of production cluster administration, these are highly sensitive actions that can interrupt storage, scheduling, or query services across a Hadoop environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents a PUT endpoint that changes service state, including starting and stopping cluster services, but provides no warning that these actions can affect availability or production workloads. Under the markdown-specific missing-warning rule, operational changes that can impact system integrity should be accompanied by a user-facing caution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file includes a PUT endpoint for changing host component state, such as starting a DATANODE on a host, but does not warn users that this performs live infrastructure changes. Markdown guidance for such actions should disclose potential effects on service health, availability, and system integrity.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation includes production-labeled Ambari configuration examples with plaintext usernames and passwords, which normalizes unsafe secret handling and can lead users to paste real credentials into shell history, CI logs, screenshots, or shared docs. In an infrastructure-management skill, admin credentials grant broad operational control, so even example secrets in a production context materially increase the chance of credential exposure and misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The examples instruct users to stop and restart production services without any warning, confirmation, rollback guidance, or discussion of availability impact. In a cluster-operations skill, such commands are inherently disruptive and can cause outages or data-processing failures if run casually or in the wrong environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Python example hardcodes administrator credentials directly in source, encouraging copy-paste into scripts, notebooks, and repositories where secrets are often retained indefinitely. Because this skill manages Ambari clusters, those credentials could enable unauthorized service operations, cluster reconfiguration, or broader compromise of Hadoop environments if replaced with real values.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The troubleshooting guidance explicitly recommends trying the default Ambari credentials admin/admin without any warning or restriction. In a cluster-management skill, this normalizes insecure authentication practices and could lead users to attempt or retain well-known credentials on privileged infrastructure, increasing the chance of unauthorized administrative access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Suggesting default credentials as a normal troubleshooting step is unsafe because Ambari provides administrative control over Hadoop clusters and their services. In this context, encouraging use of a known default username/password pair materially increases risk by enabling weak-authentication behavior on production-like systems.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The unsafe default verify_ssl=False makes insecure transport the standard behavior for all API interactions unless a caller overrides it, and this file never exposes a safe way to do so through configuration. Because this skill manages Ambari cluster operations with administrative credentials, the insecure default materially increases the likelihood of credential theft and command tampering.

Content

Scanner excerpt · scripts/ambari_api.py (reported line 39)May include surrounding context.

python

class AmbariClient:
    """Ambari REST API Client"""

    def __init__(self, base_url, username, password, verify_ssl=False):
        self.base_url = base_url.rstrip('/')
        self.auth = HTTPBasicAuth(username, password)
        self.verify_ssl = verify_ssl

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The service_action docstring says supported actions include INSTALLED (same as STOP), yet the valid_actions list excludes INSTALLED and the function rejects it. This creates a direct contradiction between the function's documentation and its runtime behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill stores Ambari credentials in plaintext in a local JSON config file under the user's home directory without setting restrictive file permissions or warning the user. On multi-user systems, backups, endpoint collection tools, or compromised user sessions, these credentials could be exposed and then used to administer Hadoop cluster services.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The CLI parser documents and accepts INSTALL as a valid component action, but component_action only allows START and STOP and returns an invalid-action error for INSTALL. This is an active contradiction between the exposed command interface/documentation and the code's actual behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a lower bound only (requests>=2.28.0), so builds may resolve to different versions over time and could inadvertently install a release with known vulnerabilities or breaking behavior. In a cluster-management skill that makes outbound API calls to Ambari, dependency drift in an HTTP client increases supply-chain and runtime risk, even though this file alone does not prove a currently vulnerable version is installed.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.28.0
urllib3>=1.26.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

requests has multiple known advisories, and because the manifest does not pin the version, there is no way to verify from this file whether deployments avoid affected releases. In a skill that performs authenticated REST operations against Ambari, an affected HTTP client could expose credentials, weaken TLS/request handling, or mishandle redirects depending on the resolved version.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is unpinned (urllib3>=1.26.0), which makes installations non-reproducible and can result in pulling a vulnerable or incompatible version in the future. Because this skill manages Hadoop clusters over REST, the HTTP transport library is security-relevant and version ambiguity makes safe deployment harder to verify.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.28.0
urllib3>=1.26.0

Unverifiable Dependency: urllib3 has 16 known advisory(ies) (CVE-2025-66471 (urllib3 streaming API improperly handles highly compressed data); CVE-2024-37891 (urllib3's Proxy-Authorization request header isn't stripped during cross-origin ); CVE-2026-21441 (Decompression-bomb safeguards bypassed when following HTTP redirects (streaming ) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

urllib3 has known advisories, but the unpinned requirement prevents determining whether installed environments are exposed. Since urllib3 underpins HTTP communication and may process redirects, proxies, and compressed responses, this uncertainty is more concerning in a cluster-management tool that interacts with potentially sensitive infrastructure endpoints.

Content

No source excerpt is available for this finding.