Security audit

Byted EMR Skills

Security checks across malware telemetry and agentic risk

Overview

This EMR management skill is purpose-aligned, but it needs careful review because it can make live cloud changes and has weak safeguards around credentials, uploads, and logging.

Install only in an environment dedicated to EMR administration. Use least-privilege and preferably short-lived Volcengine credentials, avoid production credentials unless necessary, review every mutating action before execution, avoid passing sensitive local paths to job submission, and treat logs/output from this skill as sensitive because they may contain cloud identifiers, configs, audit records, and credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill describes capabilities to read environment variables, read/write files, invoke shell commands, and make networked API calls, yet it declares no explicit permissions or constraints. This creates a transparency and policy-enforcement gap: a caller may invoke a highly privileged operational skill without clear consent boundaries, increasing the chance of secret exposure or unintended infrastructure changes.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The guide explicitly states that VOLCENGINE_AK/VOLCENGINE_SK are automatically injected into Spark configuration for submitted jobs. Passing long-lived cloud credentials into job conf can expose them through Spark UIs, logs, job metadata, environment dumps, or to untrusted user code running in the cluster, enabling credential theft and broader cloud compromise.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger rules instruct immediate invocation for broadly phrased EMR-related requests and 'any' EMR Serverless/job/diagnostic inquiry. Overbroad routing can cause the skill to activate on ambiguous user requests, leading to unnecessary access to credentials, logs, or mutating infrastructure operations when a narrower or read-only workflow would have been more appropriate.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill advertises sensitive operations such as restarting services, changing configs, creating users, updating passwords, granting queue privileges, and deleting or stopping resources, but it does not define confirmation, authorization, or safety checks. In an operational cloud environment, these actions can cause outages, privilege escalation, or unauthorized changes if triggered too casually or by a confused deputy workflow.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The setup instructions tell users to export long-lived access keys and secret keys directly into environment variables without guidance on secure storage, rotation, least privilege, or avoiding logging and shell history exposure. While environment variables are common, presenting this pattern without safeguards increases the risk of accidental credential leakage through debugging output, process inspection, or reused shell sessions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This section documents state-changing infrastructure operations such as disk expansion and ECS spec changes without any warning about service interruption, operational risk, rollback considerations, or required authorization checks. In an agent skill context, omission of such safeguards can cause the model or user to invoke impactful cluster modifications too casually, increasing the chance of accidental production disruption or cost-impacting changes.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation includes a literal password in CLI examples and request bodies without any warning about shell history, terminal logging, CI logs, or documentation copy-paste risks. Even if the shown value is only illustrative, this pattern normalizes passing secrets directly on the command line and can lead users to expose real credentials in local history, process listings, support tickets, or shared logs.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The password update example exposes both old and new passwords in plaintext within the CLI invocation and JSON body, with no guidance on protecting those values. This is more dangerous than a single-password example because it can leak both current and replacement credentials through shell history, process inspection, audit trails, or copied operational artifacts.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The guide documents a reboot action for EMR applications without any warning that restarting services such as Spark or Ray can interrupt running jobs, cause temporary downtime, or affect dependent workloads. In an operational skill that users may invoke directly, omission of impact warnings increases the chance of accidental service disruption.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The component reboot instructions provide direct commands to restart service components but do not warn about operational consequences such as control-plane interruption, loss of in-flight sessions, or partial service degradation. Because this skill manages production-style EMR-on-VKE resources, such undocumented disruptive actions are more dangerous than in a read-only or tutorial-only context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The configuration update section gives users a direct path to modify live service configuration without clearly warning that changes can alter cluster behavior, break workloads, or require restarts before taking effect. In an infrastructure-management skill, undocumented config mutation is especially risky because a malformed or unsafe setting can cause persistent outages or hard-to-diagnose failures across shared data-processing services.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide documents sensitive fields such as custom image repository credentials, including a password parameter, without any warning about secret handling, storage, masking, or avoiding plaintext in examples and logs. In an operational EMR skill, users are likely to copy these patterns into CLI invocations, configuration files, or job definitions, which can expose credentials through shell history, documentation, logs, or API payload capture.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The RunJobDefinition section shows how to trigger execution of a real job template but does not warn that this action launches workloads and may consume paid compute, access data, or produce side effects. In a cloud operations skill, omission of an execution warning increases the risk of accidental job launches by users or agents following the guide verbatim.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The guide describes automatic upload of local resources to TOS without prominently warning that local contents are transferred to remote cloud storage. In an agent skill context, this can cause accidental exfiltration of sensitive local code, data, configs, or embedded secrets if users provide filesystem paths assuming only local execution semantics.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Automatically injecting access keys into Spark configuration without a strong security warning is dangerous because Spark configuration is often observable by operators, users, logs, and application code. In this skill's cloud job-submission context, that creates a credible path for secret disclosure and misuse of the user's cloud account.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The PySpark section states that local scripts and dependencies may be automatically uploaded to TOS, but does not clearly warn about remote transfer of the script contents and bundled artifacts. Because PySpark jobs commonly include business logic, embedded credentials, and local helper files, this can lead to unintended disclosure of sensitive material.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The audit-log response example includes real-looking operator identity attributes such as AccountId, OperatorUserId, and OperatorName without any masking or warning that these fields are sensitive. In an EMR administration skill, this normalizes disclosure of personally identifying or account-linked data and can encourage downstream copying into prompts, logs, tickets, or shared documentation where unauthorized parties may access it.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The document provides direct instructions to grant and alter queue privileges, including Admin access, without prominently warning that these actions change access control and can expand a principal's ability to manage queues and jobs. In an agent skill context, such omission increases the chance of unsafe or overly broad privilege changes being executed without sufficient operator awareness or approval.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The guide documents a one-click flow that immediately provisions EMR Serverless and LAS resources, which can trigger billing and create cloud assets, but it provides no warning, confirmation step, or cost/side-effect notice. In an agent skill context, this is more dangerous because an automation agent may translate documentation directly into action, causing unintended spend or unauthorized resource creation.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script downloads a wheel from remote URLs and immediately installs it with pip, but performs no integrity verification such as a pinned hash or signature check. If the hosting endpoint, DNS, TLS trust chain, or network path is compromised, an attacker could replace the wheel and achieve arbitrary code execution during installation or later import/use of the package.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code logs the full API action, region, request body, and returned result, which can expose operational metadata and potentially sensitive EMR-related data in application logs. In an infrastructure-management skill, request bodies and responses may contain identifiers, status details, configuration data, or other tenant-specific information that can later be accessed by operators, support personnel, or attackers who obtain log access.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Chat outputs are written to a predictable temp-file location using the process ID as the filename, which can expose potentially sensitive operational data to other local users or processes depending on temp directory permissions. Because this skill handles EMR diagnostic and knowledge outputs, results may contain cluster details, IDs, errors, or other internal metadata that should not be casually persisted on disk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The function logs the full request context and raw API result at INFO level, including query and body fields that may contain sensitive operational metadata, resource identifiers, job definitions, paths, tags, or other tenant-specific data. In a cloud management skill that issues live backend requests, this creates a realistic risk of sensitive data exposure through centralized logs and log aggregation systems, even if the network call itself is expected behavior.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The function sends an arbitrary request body to the EMR API and then logs the full action, region, request body, and raw result. In an infrastructure-management skill, these payloads and responses can contain cluster identifiers, configuration values, operational metadata, and potentially secrets or tokens, creating a clear risk of sensitive-data exposure through logs and downstream log aggregation systems.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.