Security audit

Volcano Engine Serverless Flink Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate Flink management skill, but it gives agents enough cloud and credential-adjacent authority that several under-scoped instructions should be reviewed before use.

Install only if you are comfortable letting the agent guide real Volcano Engine Flink operations. Require explicit confirmation before any create, delete, publish, start, stop, restart, rescale, endpoint, resource-pool, or default-config change; avoid command-line password examples; prefer TLS-backed Kafka settings and secure secret entry; and pin/verify the volc-flink-cli package source where possible.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: skills/flink-conn/kafka/SKILL.md:123
Finding: Kafka passwords exposed through command-line arguments
Content: View full analysis
--name --bootstrap-servers --security-protocol SASL_PLAINTEXT --sasl-mechanism PLAIN --username --password --set-default ``` ### Technical Analysis The skill instructs users or an executing agent to supply Kafka passwords directly through the `--password` process argument. Although the examples use sample values and placeholders, users are expected to replace them with real credentials. Command-line secrets can be exposed through: - Shell history files. - Process inspection utilities and process telemetry. - Terminal session recording. - Debug logs and command auditing. - Agent execution transcripts. - CI/CD logs or orchestration metadata. This behavior directly contradicts the repository policy in `COMMON_SECURITY.md`, which states that secrets should not be placed in command-line arguments when avoidable and that commands capable of exposing secrets through shell histo ...[truncated 1262 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: skills/flink-conn/kafka/SKILL.md:243
Finding: Authenticated Kafka connections are recommended without transport encryption
Content: View full analysis
--name --bootstrap-servers --security-protocol SASL_PLAINTEXT --sasl-mechanism PLAIN --username --password --set-default ``` ### Technical Analysis The skill presents `SASL_PLAINTEXT` with the `PLAIN` SASL mechanism as a normal authenticated endpoint configuration. SASL authenticates the client but does not provide transport encryption. With the PLAIN mechanism, credentials require a secure transport such as TLS to prevent disclosure. Without TLS, an attacker with network visibility may observe authentication traffic and Kafka message contents. An active network attacker may also interfere with the connection because server identity and traffic integrity are not protected by TLS. The documentation notes that the mode is unencrypted, but it still provides copy-ready commands and describes it as appropriate whenever authentication is needed without encryption. That guidance can lead users to deploy it on networks whose isolation or trustworthiness has not been verified. ### Attack Path 1. A user follows the documented authenticated Kafka configuration. 2. The endpoint is configured with `SASL_PLAINTEXT` and `PLAIN`. 3. The client connects over a shared, routed, cloud, container, VPN, or otherwise observable network. 4. An attacker with packet-capture or man-in-the-middle capability monitors the connecti ...[truncated 839 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: skills/flink-conn/kafka/SKILL.md:23
Finding: Kafka mutation operations are incorrectly governed by a read-only workflow
Content: View full analysis
volc_flink conn kafka endpoint rm --instance --name ``` ### Technical Analysis The repository's `COMMON_READONLY.md` policy prohibits state-changing operations in a read-only workflow. Connection and endpoint creation, modification, and deletion are explicitly classified as mutation operations by `COMMON_MUTATION.md`. `COMMON_MUTATION.md` requires the agent to: - Resolve the exact target. - Display the proposed change. - Wait for explicit user confirmation. - Avoid guessing when targets are ambiguous. - Describe rollback options where relevant. - Verify the result after mutation. The Kafka skill does not reference the mutation policy and instead labels itself read-only while documenting add and remove commands. This creates an inconsistent control model in which an agent may treat configuration mutations as safe query operations and omit the mandatory confirmation gate. ### Attack Path 1. A us ...[truncated 1315 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: skills/flink-volc/SKILL.md:74
Finding: Unpinned executable Python packages are installed from mutable third-party repositories
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (77)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly states it is managed as read-only, yet it documents mutation commands that add and remove Kafka instances and endpoints. This mismatch can cause an orchestrating agent or user to treat the skill as safe for non-destructive use while it actually modifies local configuration, creating a privilege/safety-boundary violation and increasing the chance of unauthorized or unintended state changes.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly states it is operating in read-only mode, yet later provides step-by-step mutation guidance to create resource pools. This contradiction can cause an agent or operator to perform billable, state-changing actions under a false assumption of safety, weakening control boundaries around destructive or costly operations.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: This finding correctly captures a high-risk command pattern: rm -rf used in a user-facing remediation workflow. In the context of an installation/repair skill, users may trust and execute it quickly, making accidental destructive outcomes more plausible even though the author's intent appears to be cleanup rather than harm.
Content: Scanner excerpt · skills/flink-volc/SKILL.md (reported line 267)May include surrounding context.
如果虚拟环境损坏，重新创建（仅 venv 安装用户）：

bash
# 删除旧的虚拟环境 rm -rf ~/flink-env # 重新创建并安装 python3 -m venv ~/flink-env

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: This finding correctly captures a high-risk command pattern: rm -rf used in a user-facing remediation workflow. In the context of an installation/repair skill, users may trust and execute it quickly, making accidental destructive outcomes more plausible even though the author's intent appears to be cleanup rather than harm.
Content: Scanner excerpt · skills/flink-volc/SKILL.md (reported line 267)May include surrounding context.
如果虚拟环境损坏，重新创建（仅 venv 安装用户）：

bash
# 删除旧的虚拟环境 rm -rf ~/flink-env # 重新创建并安装 python3 -m venv ~/flink-env

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · COMMON.md (reported line 47)May include surrounding context.
md
- If the CLI indicates not logged in: - Stop the workflow. - Ask the user to login via interactive login (`volc_flink login`) or their approved internal method. - Do not ask the user to paste AK/SK into chat or into `--ak/--sk` command arguments. ## Scope & Identity (Project/Job/Draft Resolution)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The confirmation template shown to users is entirely in Chinese, including the confirmation prompt, while the rest of the document is in English. This imposes a specific language on the user without offering a choice or documenting a justified locale-specific requirement, which is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README advertises creation, deployment, stop/restart, scaling, configuration changes, and snapshot deletion workflows but does not pair them with user-facing warnings about impact, irreversibility, or confirmation requirements. In an AI skill that can generate executable steps, the absence of such guardrails increases the chance of accidental destructive or service-affecting actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The routing rules rely on broad action keywords such as install, login, configure, and similar terms without consistently requiring a clear Flink-specific object or scope. In an agent setting, this can cause unintended skill activation and execution planning for the wrong user request, especially when the entrypoint is meant to trigger on natural language.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Terms like project, view project, configuration, and path are ambiguous across many domains and are documented here without scope guards. In a multi-skill environment, such ambiguity can misroute unrelated requests into a Flink management workflow, increasing the chance of incorrect context handling or accidental state-changing guidance.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The connection-management triggers include generic networking and debugging terms like connection, endpoint, and consume message, which are common outside Flink. Because this skill can guide configuration of upstream/downstream systems, accidental invocation could expose users to inappropriate operational steps or mishandle sensitive connection context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The operations section maps highly generic verbs such as start, stop, restart, scale, and modify configuration to operational skills without explicit Flink-only constraints. Since these actions are state-changing and potentially disruptive, ambiguous routing materially raises the risk of unsafe operational guidance or accidental invocation in the wrong context.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document says it does not support direct AK/SK paste-style login commands, but elsewhere says execution may use AK/SK directly. In a credential-handling skill, mixed guidance weakens secret-handling guarantees and may lead an agent or user to pass long-lived secrets on the command line, where they are more easily leaked via shell history, process inspection, logs, or transcripts.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill gives contradictory account-switching procedures: one part recommends selecting an isolated configuration directory via VOLC_FLINK_CONFIG_DIR, while the workflow later instructs copying a target account's configuration into the current config. In an auth-sensitive skill, this inconsistency can cause operators or downstream agents to overwrite credentials, mix accounts, or expose the wrong identity during subsequent commands.
Content: No source excerpt is available for this finding.

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · skills/flink-auth/SKILL.md (reported line 160)May include surrounding context.
列出所有已配置的账号：

bash
ls -la ~/.volc_flink/ | grep account_

账号命名建议：

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · skills/flink-auth/SKILL.md (reported line 264)May include surrounding context.
列出所有已配置的账号：

bash
ls -la ~/.volc_flink/ | grep account_

账号命名建议：

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This section instructs the agent to publish drafts and start Flink batch jobs, which are real mutating and execution-triggering actions against cloud resources and data pipelines, but it does not itself present an explicit warning about operational impact such as resource consumption, downstream writes, or unintended production data processing. Although the skill references shared risk-confirmation rules elsewhere, the omission in the immediate execution workflow increases the chance that an agent or operator treats these steps as routine and proceeds without appreciating the consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The rerun section tells the agent to stop a currently running job and restart it, but does not explicitly warn that stopping a job is disruptive and can interrupt active workloads, cause partial processing, or affect dependent systems. In a Flink operations context, restart/stop actions are safety-sensitive because they can terminate production computations and trigger duplicate or incomplete batch outcomes if done carelessly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description begins in Chinese and the rest of the skill instructions are written to operate in Chinese, but there is no indication that the user can choose another language or opt in to Chinese-only responses. This creates a locale/language policy issue because it implicitly constrains interaction language without documented justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This YAML manifest explicitly allows source-table regex matching and pattern-based replacement, but it does not define constraints, exclusions, or narrow examples for what should and should not match. Because this is a manifest file, the broad regex-based activation/routing scope can lead to unintended matches and routing behavior, which fits the vague-trigger category for manifest files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This configuration explicitly streams MySQL change data into Kafka, which can propagate sensitive records beyond the source database boundary without any embedded warning, filtering, or minimization controls. In a CDC context, that can lead to unintended exposure of PII, credentials, or regulated data if operators enable replication broadly or publish to shared Kafka infrastructure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This manifest file includes an example trigger of source-table: .*, which is an unrestricted regex matching every table. In a trigger-like routing/transform context, that is overly broad and the surrounding comments do not provide exclusion conditions or negative examples to limit unintended application.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This manifest includes placeholders for sensitive cloud credentials (ak and sk) that will be supplied by the user or environment, but the file provides no warning about the sensitivity of those values or safe handling expectations. For a markdown/manifest-style skill asset that configures external systems, omitting any disclosure about credential use can leave users unaware of the privacy and security implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation states that if the target topic does not exist, it is created by default, but it does not warn about the operational and security consequences of auto-creating topics. In a Flink/Kafka management skill, this can lead users to unintentionally create uncontrolled topics, bypass naming/governance standards, or trigger data sprawl and misrouting in production environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation explicitly includes access key parameters (...las.ak and ...las.sk) in a configuration example without any warning about secret handling, storage, rotation, or avoiding plaintext exposure. In an agent skill repository, users may copy this pattern directly into configs, logs, prompts, or version control, increasing the chance of credential leakage and unauthorized access to the LAS/Hive environment.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This markdown file documents a transform rule with source-table: .*, which is an unconstrained pattern matching every table. In documentation for manifest-style configuration, such broad matching can lead to unintended application of the transform because the scope is not narrowly defined and no negative examples or exclusions are provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.