Security audit

Alibabacloud Analyticdb Postgresql Query

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly malicious, but it needs review because it can access and export business database data while relying on persistent credentials and loosely validated database metadata.

Install only if you can use a dedicated read-only database account limited to necessary tables, a DBA-reviewed _agent_meta semantic model, and a dedicated resource group. Avoid persistent PGPASSWORD where possible, lock down any password files, do not continue past privileged-account warnings for normal use, and review fully expanded SQL before approving execution or CSV export.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:43
Finding: Unvalidated Semantic Metadata Can Influence Agent Instructions and Generated SQL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/connection-guide.md:181
Finding: Windows Setup Guidance Persists Database Passwords in Plaintext Without Enforcing Restrictive ACLs
Content: View full analysis
", "User") # ⚠️ Replace; prefer pgpass.conf [Environment]::SetEnvironmentVariable("PGOPTIONS", "-c default_transaction_read_only=on", "User") ``` `references/connection-guide.md:197-201`: ```powershell # Create directory and file New-Item -ItemType Directory -Force -Path "$env:APPDATA\postgresql" Set-Content -Path "$env:APPDATA\postgresql\pgpass.conf" -Value "gp-xxx.gpdb.rds.aliyuncs.com:5432:mydb:analyst:" ``` `references/connection-guide.md:210-221`: ```powershell # User creates ~\.pgenv.ps1 Set-Content -Path "$HOME\.pgenv.ps1" -Value @' $env:PGHOST = "gp-xxx.gpdb.rds.aliyuncs.com" $env:PGPORT = "5432" $env:PGDATABASE = "mydb" $env:PGUSER = "analyst" $env:PGPASSWORD = "" $env:PGOPTIONS = "-c default_transaction_read_only=on" '@ ``` ```text Note: The user must run `. $HOME\.pgenv.ps1` in their own PowerShell session before launching the Agent. The Agent itself must never execute or access `.pgenv.ps1`. ``` ### Technical Analysis The guide offers multiple Windows configuration methods that persist the database password: - A user-level `PGPASSWORD` environment variable. - A plaintext `pgpass.conf` file. - A plaintext PowerShell script containing `PGPASSWORD`. A persistent user-level environment variable is stored by Windows ...[truncated 2518 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 95% confidence
Finding: The document explicitly recommends typing "continue" to bypass a security warning about excessive database privileges. Even though it is labeled a temporary workaround, normalizing warning bypasses can train operators or agents to proceed in unsafe states, undermining the startup safety checks intended to prevent use of overprivileged accounts.
Content: Scanner excerpt · references/best-practices.md (reported line 149)May include surrounding context.
md
**Temporary Workaround**: Type "continue" to skip the warning, but must fix during the next maintenance window.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list includes generic terms like 'analyze' and 'statistics' that are common in unrelated conversations, increasing the chance this skill is invoked outside its intended database-query context. In a shell-capable agent, accidental invocation can lead to unnecessary database connectivity checks or query preparation around sensitive systems.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
- **Prohibited file paths** (in ANY command, script, or code): `.pgpass`, `.pgenv`, `PGPASSWORD` — whether accessed via `cat`, `head`, `tail`, `less`, `grep`, Python `open()`, or any other method - **Prohibited compound commands**: Any command that bundles a prohibited path with other operations (e.g., `cat ~/.pg_service.conf; cat ~/.pgenv; ls ~/.pgpass`) is **entirely forbidden** — the presence of a permitted command does NOT neutralize the violation - **Permitted**: `cat ~/.pg_service.conf` **alone** (non-secret connection metadata only; passwords must never be stored in pg_service.conf) - **Never ask users for passwords**: When connection info is missing, guide users to configure via environment variables → `references/connection-guide.md` - **Verify connectivity**: Run `psql "service=<service_name>" -c "SELECT 1;"` directly; on failure, guide fixes based on error messages ---

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

rolcreaterole = true → ⚠️ Warning: Current account has role creation permission; DBA should revoke it, keeping only minimum read-only permissions

rolcreatedb = true → ⚠️ Warning: Current account has database creation permission; DBA should revoke it

All false → PASS ✅

When warnings are present, the Agent must pause and wait for user confirmation: "The following security risks have been detected: {specific risks}. Do you need to contact DBA first? Type 'continue' to skip and use the current account." — The Agent must not rationalize "no impact" and skip confirmation on its own

Check Resource Group (every session): Verify the current account is bound to a dedicated resource group (not default_group)
bash
psql -c "SELECT r.rolname, g.rsgname FROM pg_roles r LEFT JOIN pg_resgroup g ON r.rolresgroup = g.oid WHERE r.rolname = current_user;"

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

rolcreaterole = true → ⚠️ Warning: Current account has role creation permission; DBA should revoke it, keeping only minimum read-only permissions

rolcreatedb = true → ⚠️ Warning: Current account has database creation permission; DBA should revoke it

All false → PASS ✅

When warnings are present, the Agent must pause and wait for user confirmation: "The following security risks have been detected: {specific risks}. Do you need to contact DBA first? Type 'continue' to skip and use the current account." — The Agent must not rationalize "no impact" and skip confirmation on its own

Check Resource Group (every session): Verify the current account is bound to a dedicated resource group (not default_group)
bash
psql -c "SELECT r.rolname, g.rsgname FROM pg_roles r LEFT JOIN pg_resgroup g ON r.rolresgroup = g.oid WHERE r.rolname = current_user;"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/best-practices.md (reported line 219)May include surrounding context.
│ ▼ [Execution Layer] ├── DB level: Read-only account (no write permissions as fallback) ├── DB level: Resource Group (concurrency/CPU/memory limits) └── Skill level: ≤5 psql calls per turn, SQL displayed for user audit

text

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/connection-guide.md (reported line 52)May include surrounding context.
Method 4: apt (Debian/Ubuntu, when official package is unavailable)

bash
sudo apt-get install -y postgresql-client psql --version

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/connection-guide.md (reported line 110)May include surrounding context.
export PGPASSWORD="<YOUR_PASSWORD_HERE>" # ⚠️ Replace with actual password; prefer ~/.pgpass instead

text
> More secure approach: Use `~/.pgpass` file (permissions `chmod 600`), format: `host:port:database:user:password` > > **⚠️ Security Warning**: Never hardcode passwords in scripts, commit them to version control, or store them in plain-text configuration files without restricted permissions (chmod 600). The recommended approach is `~/.pgpass` (Linux/macOS) or `%APPDATA%\postgresql\pgpass.conf` (Windows) with file permissions limited to the owning user only.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/connection-guide.md (reported line 141)May include surrounding context.
export PGPASSWORD="<YOUR_PASSWORD_HERE>" # ⚠️ Replace with actual password; prefer ~/.pgpass instead

text
> More secure approach: Use `~/.pgpass` file (permissions `chmod 600`), format: `host:port:database:user:password` > > **⚠️ Security Warning**: Never hardcode passwords in scripts, commit them to version control, or store them in plain-text configuration files without restricted permissions (chmod 600). The recommended approach is `~/.pgpass` (Linux/macOS) or `%APPDATA%\postgresql\pgpass.conf` (Windows) with file permissions limited to the owning user only.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/connection-guide.md (reported line 165)May include surrounding context.
export PGPASSWORD="<YOUR_PASSWORD_HERE>" # ⚠️ Replace with actual password; prefer ~/.pgpass instead

text
> More secure approach: Use `~/.pgpass` file (permissions `chmod 600`), format: `host:port:database:user:password` > > **⚠️ Security Warning**: Never hardcode passwords in scripts, commit them to version control, or store them in plain-text configuration files without restricted permissions (chmod 600). The recommended approach is `~/.pgpass` (Linux/macOS) or `%APPDATA%\postgresql\pgpass.conf` (Windows) with file permissions limited to the owning user only.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/connection-guide.md (reported line 112)May include surrounding context.
md
> More secure approach: Use `~/.pgpass` file (permissions `chmod 600`), format: `host:port:database:user:password` > > **⚠️ Security Warning**: Never hardcode passwords in scripts, commit them to version control, or store them in plain-text configuration files without restricted permissions (chmod 600). The recommended approach is `~/.pgpass` (Linux/macOS) or `%APPDATA%\postgresql\pgpass.conf` (Windows) with file permissions limited to the owning user only. ---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 78% confidence
Finding: The guide instructs users to create persistent local configuration files (~/.pg_service.conf and ~/.pgpass) containing connection metadata and credentials. While common for psql, this creates long-lived secret material on disk and can increase the blast radius if the host, home directory, backups, or developer workspace are later accessed by another process or user. In an agent context, persistent credentials are more sensitive because future agent sessions or unrelated tooling may inherit easy database access.
Content: Scanner excerpt · references/connection-guide.md (reported line 126)May include surrounding context.
Completely independent of environment variables; psql automatically reads connection info from files:

Step 1: Create ~/.pg_service.conf

ini
[adbpg] host=gp-xxx.gpdb.rds.aliyuncs.com

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.
md
- Gate 1 (read-only) is an absolute prerequisite; if not passed, no psql command may be executed - Gate 3 (semantic model) failure must not be bypassed to continue to gates 4/4b/5/6 - Gate 4b (metric_meta) is a lookup optimization, not a hard gate; absence of metrics does NOT block queries - **Bypassing gates is prohibited under any circumstances**, including but not limited to: "user needs it urgently", "just this once", "semantic model is only advisory", "let me just \dt for a quick look", "I can infer the table structure myself" ---

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
- Gate 1 (read-only) is an absolute prerequisite; if not passed, no psql command may be executed - Gate 3 (semantic model) failure must not be bypassed to continue to gates 4/4b/5/6 - Gate 4b (metric_meta) is a lookup optimization, not a hard gate; absence of metrics does NOT block queries - **Bypassing gates is prohibited under any circumstances**, including but not limited to: "user needs it urgently", "just this once", "semantic model is only advisory", "let me just \dt for a quick look", "I can infer the table structure myself" ---

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The decision tree uses broad examples like 'Query data / Analysis' and 'Look up XX' without strict activation qualifiers, which can cause ambiguous routing into this skill. Because the skill performs connection checks and prepares database actions, ambiguous activation can expose metadata or prompt risky operations in contexts not clearly asking for database access.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: At L003 the documentation says the agent 'no longer uses \dt or information_schema to discover table structure', implying schema discovery is not part of runtime behavior. However, L029 describes '\d+ table_name' output as the recommended input method that the agent can automatically extract structure from, which contradicts the earlier absolute wording and creates confusion about whether schema discovery is truly avoided or merely shifted to setup time.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The guide repeatedly specifies that display names are Chinese, such as "Chinese display name" and Chinese-language examples in schema comments. This is a natural-language locale preference embedded in the skill documentation, and the file does not state that Chinese is optional, user-selected, or required for a region-specific deployment.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.