alibabacloud-analyticdb-mysql-serverless-analysis

• Outcome: Pass
• Latest audit: Aug 11, 2026 · 2:54 AM UTC
• Version: 0.0.1-beta.1

Overview

This skill appears benign: it performs disclosed, bounded read-only Alibaba Cloud ADB queries against user-specified OSS data using a runtime token.

Install only if you want the agent to run read-only ADB Serverless queries against specific OSS data. Verify the endpoint or region, workspaceId, OSS scope, and planned SQL before live use, and remember that even read-only cloud scans can expose sensitive data or incur query costs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: This code presents its description, validation errors, help text, and runtime error output in Chinese, while also including some English text in comments/docstrings. There is no visible user opt-in or documented justification that the skill is intended only for Chinese-speaking users, so it may violate language/locale policy expectations.

External Transmission

Medium

• Category: Data Exfiltration

Content

Terminal means no retry, timeout increase, endpoint/workspace replacement, parent or sibling prefix probe, registered/direct-source switch, or alternative table function. Report the redacted failure and the exact scope that could not be accessed.

## Raw curl Form

Use this only when the Python client cannot run. Select an explicit user-supplied token before the environment fallback, then expose the selected value to `curl` only through a child-process environment variable:

• Confidence: 18% confidence
• Finding: curl Form Use this only when the Python client cannot run. Select an explicit user-supplied token before the environment fallback, then expose the selected value to `curl` only through a child-proces

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

print(json.dumps(result, ensure_ascii=False, indent=2))
        return 0
    except (ValidationError, QueryError, OSError) as exc:
        secret = selected_token or access_token or os.environ.get(TOKEN_ENV)
        print(f"错误：{_redact(str(exc), secret)}", file=sys.stderr)
        return 2

• Confidence: 70% confidence
• Finding: os.environ.get(TOKEN

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

After validation, keep the confirmed endpoint or regionCode, workspaceId, and OSS URI as an immutable parameter ledger for the current request. Copy those exact literals into every command; do not retype, normalize, abbreviate, or reconstruct them from memory. Before every invocation, compare the command arguments and SQL scope with the ledger character-for-character. Treat any mismatch as a local command-construction error: do not send a live request, rebuild the command from the confirmed literals, and run dry-run again.

When a later user message supplies the table-prefix that was missing from a bucket-root request, combine that prefix with the previously confirmed bucket, revalidate the complete current parameter set, and continue from source selection without asking again for values that remain explicit and valid. When a later message explicitly confirms an exact large-scan SQL plan, use this rigid sequence: dry-run `SHOW SCHEMAS`; live `SHOW SCHEMAS`; `SHOW TABLES`; successful `DESCRIBE`; then the exact confirmed SQL. Do not prepend, interleave, or append a direct-file query, sample, alternate aggregate, or artifact action. Execute only that confirmed SQL after the required metadata checks; do not repeat the confirmation question or broaden the plan. Resolve `scripts/adb_query.py` from the absolute base directory printed when this skill loads; do not guess a task-working-directory-relative path.

When no explicit `accessToken` was supplied, check environment-token presence only with a command that cannot print its value:

• Confidence: 75% confidence
• Finding: without asking

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `ossUri` | Required | Must start with `oss://`, include a bucket, and identify a clear scan scope. |
| `analysisGoal` | Required | Must identify the question, metric, dimension, filter, or time range to analyze. |

If any input is missing, report every missing item in one response and stop before network access. If neither credential source is available, tell the user to configure `ADB_ACCESS_TOKEN` outside the conversation. Never ask the user to paste a token into chat, but accept one they voluntarily supplied and use it only for the current request.

When the user corrects a parameter, the most recent explicit correction replaces the earlier value for the current request. Revalidate the complete parameter set and use only the corrected endpoint or regionCode, workspaceId, OSS URI, and goal in dry-run and live requests. Never send a request with a superseded value merely to prove that it is wrong.

• Confidence: 80% confidence
• Finding: Never ask the user

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

| 400 with `Cannot detect OSS file format`, `no supported files`, `No files found`, `NoSuchBucket`, or `NoSuchKey` | Stop for the current OSS scope. Do not alter the path, try globs or subdirectories, or switch readers. |
| 401/403, `InvalidAccessToken`, or `AccessDenied` | Stop. Ask the user to verify the token, workspace authorization, and OSS read permissions outside the conversation. Do not retry or switch sources. |
| 404, workspace not found, bucket not found, or prefix not found | Stop for the confirmed endpoint, workspace, and OSS scope. Do not guess another region or path. |
| 429 | Preserve requestId and wait or reduce concurrency. Do not retry indefinitely. |
| 5xx | Preserve the redacted error and requestId, then stop. Only the specific `DESCRIBE files(...)` unsupported-shape messages documented in the Skill permit one same-prefix bounded fallback. |
| SQL syntax error | Correct the statement as Presto SQL, then run dry-run again. |
| Timeout or oversized result | Narrow the OSS path, partitions, time range, projection, and LIMIT. |

• Confidence: 22% confidence
• Finding: retry indefinitely

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Trigger coverage reuses a functional scenario; the directory contains no separate trigger-only or without-skill scenarios.
- The fallback, independent cross-check, missing-schema, corrected-parameter, and empty-result branches are represented by functional scenarios.
- Follow-up handling is covered when the user supplies a previously missing table-prefix and when the user later confirms an exact large-scan plan.
- Large-scan confirmation scenarios use top-level automated `hitl` answers plus a referenced `expectations[].type: "hitl"` assertion, so they cover the confirmation action without waiting for a human. The explicit follow-up confirmation scenario executes without asking again.
- Generic evaluator requests for `outputs/`, `ran_scripts/`, or action logs do not override the terminal no-more-tools rule.

## Dry Run

• Confidence: 22% confidence
• Finding: without asking

Credential Access

High

• Category: Privilege Escalation

Content

Treat the following responses as terminal for the current endpoint, workspace, and OSS scope:

- HTTP 401 or 403, `InvalidAccessToken`, `Invalid access token`, `AccessDenied`, or an equivalent authorization failure;
- HTTP 404, `NoSuchBucket`, `NoSuchKey`, workspace not found, bucket not found, prefix not found, or an equivalent confirmed resource-not-found failure;
- Any HTTP 5xx response, including an ALB HTML `503 Service Temporarily Unavailable` response;
- `Cannot detect OSS file format`, `no supported files`, or `No files found for schema inference` from an OSS table function.

• Confidence: 70% confidence
• Finding: access token

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.