Security audit

OceanBase Deploy

Security checks for vulnerabilities and agentic risk

Overview

This OceanBase operations skill is mostly coherent documentation, but it exposes high-impact database and cluster actions without consistently requiring confirmation or warning about credentials and data loss.

Install only if you expect the agent to help administer OceanBase environments. Treat generated commands as proposals: require explicit confirmation before tenant drop, restore, component deletion, destroy, failover, or benchmark runs; avoid pasting real passwords into chat or shell command history; and test on non-production clusters first.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill is scoped to testing and benchmarking, but the functional test prompt claims coverage of backup as well. That scope expansion can cause an agent to invoke or validate backup-related operations outside the documented purpose of the skill, increasing the chance of unintended operational actions and misuse of adjacent capabilities.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill description is broad enough to trigger on generic mentions of 'OceanBase' or 'obd' even when the user has not clearly asked for deployment or operations help. Over-broad activation can route unrelated requests into a high-impact operational skill, increasing the chance the agent suggests or performs sensitive cluster actions in the wrong context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill documents passing credentials directly on the command line to a remote OCP endpoint (`-u <user> -p <password>`) without warning that command-line arguments may be exposed through shell history, process listings, logs, or agent telemetry. In an automation or agent setting, this increases the chance of credential disclosure and unauthorized access to the OCP control plane.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation includes a destructive deletion command (`obd cluster component del`) without an explicit warning that it removes running infrastructure components and may disrupt monitoring or management functions. In an agent skill context, users may copy commands directly, so omission of impact and confirmation guidance increases the risk of accidental operational damage.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation instructs users to retrieve generated Prometheus admin credentials via `obd cluster display <deploy_name>` and immediately use them in a shell command, but it provides no warning about terminal history, screen sharing, logging, or restricting access to the display output. In an operations skill, this materially increases the chance that sensitive credentials are exposed to other users, logs, or support artifacts during normal administration.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The description is broad enough to match general tenant-related requests without clearly limiting scope to informational or explicitly authorized administrative actions. In an agent-routing context, overbroad triggering can cause the system to select a skill that exposes destructive tenant-management commands, increasing the chance of unintended operational guidance or unsafe action suggestions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly covers destructive and recovery-affecting operations like dropping tenants, backups, and restores without any warning, confirmation requirement, or safety preconditions. In a deployment/operations skill, this is especially risky because users are likely operating against real infrastructure, so ambiguous prompts or accidental invocation could lead to data loss, service disruption, or unsafe restoration actions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The restore command is documented as creating or overwriting a tenant, but the guidance does not prominently warn about destructive effects, require validation of the target tenant, or suggest confirmation safeguards. In an operational skill for database administration, this omission can lead users or downstream agents to run a destructive restore against the wrong tenant, causing data loss or service disruption.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The manifest description includes broad trigger phrases such as general requests to evaluate cluster performance or mentions of related tools, which may cause the skill to be selected in situations where the user's intent is not specifically to benchmark or test. Over-broad invocation raises the risk of an agent surfacing or executing impactful test guidance in the wrong context.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs users to enable non-interactive auto-confirmation for scripted runs without a prominent warning that benchmarks and tests can generate significant load and may affect a running cluster. In an agent context, suppressing confirmations reduces friction for impactful actions and makes accidental execution against production-like environments more likely.

Static analysis

No suspicious patterns detected.