Alibabacloud Cksync Plan

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:15 AM UTC
• Version: 0.0.1

Overview

The skill is a legitimate ClickHouse migration planner, but it includes risky instructions for handling database/cloud credentials and running high-impact database operations.

Review this skill before installing or using it with real systems. Prefer user-executed, read-only metadata queries; do not paste production passwords into chat; use HTTPS/TLS and short-lived least-privilege accounts; avoid storing secrets in .bashrc or .netrc; and require human review, backups, identity checks, and rollback validation before running any ALTER, TRUNCATE, DROP, switchover, or decommission step.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: references/big-cluster-self-built-community.md:42

Finding

Passwordless Default Account Exposed Through a Broad Network Listener

Content

View full analysis

0.0.0.0 ``` ```xml default default ``` ### Technical Analysis The configuration binds ClickHouse to all available interfaces through `0.0.0.0` while configuring the built-in `default` account with an empty password. The network allowlist is the only remaining access boundary. Source-address filtering is not a substitute for authentication. A compromised allowlisted node, overly broad placeholder substitution, routing error, proxy, SSRF pivot, or other access from a trusted network position could permit passwordless database access. The effective privileges depend on the profile and grants assigned to `default`, which the example does not restrict to the minimum operations required for federation. ### Attack Path 1. An operator applies the example and exposes ClickHouse on every interface. 2. The operator leaves the `default` account password empty. 3. An attacker compromises an allowlisted host, gains a network position associated with an allowlisted address, or benefits from an incorrectly configured allowlist. 4. The attacker connects to the ClickHouse native service without supplying a password. 5. The attacker performs ...[truncated 605 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/big-cluster-community-enterprise.md:39

Finding

Password-Free Cross-Cluster Trust Based Only on Node IP Addresses

Content

View full analysis

::1127.0.0.1' ``` ``` ### Technical Analysis The procedure explicitly establishes password-free access to the Enterprise cluster for registered Community node addresses. This removes an independent credential boundary and treats control of a trusted source address as sufficient proof of identity. If a Community node is compromised, the attacker may inherit its trusted access to the Enterprise environment. IP-based trust also provides limited protection against configuration mistakes, traffic relays, compromised proxies, or other systems able to originate traffic from an authorized network position. ### Attack Path 1. The operator registers Community node addresses for password-free Enterprise access. 2. An attacker compromises one of those Community nodes or another system capable of originating traffic through a trusted address. 3. The attacker connects from the trusted network position to the Enterprise ClickHouse service. 4. Enterprise accepts the connection without requiring an additional secret. 5. The attacker issues queries under the permissions associated with the password-free access path. ### Impact Assessment The attacker may gain the Enterprise-cluster permissions assigned to the trusted connection. The possible scope includes: - Reading Enterprise data reachable through federation. - Querying data across both clusters. - Performing writes or DDL if the trusted identity permits them. - Pivoting from a less trusted Community environment into the Enterprise environ ...[truncated 134 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/sql.md:280

Finding

ClickHouse Credentials and Query Data Transmitted Over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/sql.md:257

Finding

Persistent Plaintext Database Credential Storage in Shell Configuration and netrc

Content

View full analysis

> ~/.netrc chmod 600 ~/.netrc # Then use: curl --netrc ... ``` ### Technical Analysis The documentation suggests storing a plaintext password in `~/.bashrc`, which creates persistent secret material loaded into future shell sessions. Exported environment variables may be inherited by child processes and captured by diagnostics, crash reports, or process-inspection mechanisms available to sufficiently privileged local users. The `~/.netrc` example appends a reusable password to a global credential file. It does not establish secure permissions before writing, validate whether conflicting or duplicate entries exist, isolate credentials to a task-specific file, or define cleanup and rotation. Although `chmod 600` is applied afterward, the credential is written before that permission change. ### Attack Path 1. A user substitutes a real production password into the documented commands. 2. The password is saved in shell startup configuration, exported into the environment, or appended to `~/.netrc`. 3. Another local process, administrator, malware process, backup system, diagnostic collector, or accidental file disclosure obtains the secret. 4. The attacker reuses the credential against the ClickHouse endpoint. 5. Access persists until the password is rotated or the account is revoked. ### Impact Assessment The exposed party may obtain all database privileges associat ...[truncated 210 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/plans.md:277

Finding

OSS Access Keys Embedded Directly in BACKUP and RESTORE SQL

Content

View full analysis

. ON CLUSTER default TO S3('https://.//', '', ''); RESTORE TABLE . ON CLUSTER default FROM S3('https://.//', '', ''); ``` ```sql BACKUP TABLE . TO S3('https://.//.zip', '', ''); RESTORE TABLE . FROM S3('https://.//.zip', '', ''); ``` ```sql BACKUP DATABASE ON CLUSTER default TO S3('https://.oss-cn-hangzhou.aliyuncs.com/backup/_full/', '', ''); RESTORE DATABASE ON CLUSTER default FROM S3('https://.oss-cn-hangzhou.aliyuncs.com/backup/_full/', '', ''); ``` ### Technical Analysis The command templates place the OSS access-key ID and secret directly into SQL text. After real values are substituted, those secrets may be retained in shell history, SQL client history, ClickHouse query logs, audit records, monitoring systems, tracing infrastructure, support bundles, or copied migration plans. A static access key is reusable outside the ClickHouse session and may grant broader OSS access than the backup operation requires. ### Attack Path 1. An operator replaces the placeholders with valid OSS credentials. 2. The operator executes or distributes the SQL. 3. The complete statement is retained by a client, server query log, audit platform, monitoring system, or document repository. 4. An attacker ...[truncated 671 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/sql.md:110

Finding

Destructive Migration Retry Commands Lack Identity Checks and Confirmation Gates

Content

View full analysis

. SELECT * FROM remote('', ., '', '') WHERE _partition_id = '' SETTINGS max_execution_time = 0, max_bytes_to_read = 0, log_query_threads = 0, max_result_rows = 0; -- Push to new cluster (all versions) INSERT INTO FUNCTION remote('', '', '', '', '') SELECT * FROM . WHERE _partition_id = '' SETTINGS max_execution_time = 0, max_bytes_to_read = 0, log_query_threads = 0, max_result_rows = 0; -- Clean up partition (if migration failed, retry) ALTER TABLE . DROP PARTITION ''; ``` ```sql -- Pull from old cluster (new cluster version ≤23.8) INSERT INTO . SELECT * FROM remote('', ., '', '') SETTINGS max_execution_time = 0, max_bytes_to_read = 0, log_query_threads = 0, max_result_rows = 0; -- Push to new cluster (all versions) INSERT INTO FUNCTION remote('', '', '', '', '') SELECT * FROM . SETTINGS max_execution_time = 0, max_bytes_to_read = 0, log_query_threads = 0, max_result_rows = 0; -- Clean up table (if migration failed, retry) TRUNCATE TABLE .

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Documenting credential storage in ~/.netrc normalizes placing reusable database secrets in a local plaintext file, which may be read by other local processes, included in backups, or mishandled by users. Even with restrictive permissions, it increases credential exposure compared with managed secret stores or ephemeral auth.

Content

Scanner excerpt · references/sql.md (reported line 266)May include surrounding context.

Method 2: Using netrc file

bash

# Create ~/.netrc file with restricted permissions
echo "machine ${CLICKHOUSE_HOST} login ${CLICKHOUSE_USER} password ${CLICKHOUSE_PASSWORD}" >> ~/.netrc
chmod 600 ~/.netrc
# Then use: curl --netrc ...

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The example explicitly writes username and password into ~/.netrc, creating a persistent local secret artifact. This can be harvested from backups, developer workstations, or compromised user sessions, especially in environments lacking hardened endpoint controls.

Content

Scanner excerpt · references/sql.md (reported line 267)May include surrounding context.

Method 2: Using netrc file

bash

# Create ~/.netrc file with restricted permissions
echo "machine ${CLICKHOUSE_HOST} login ${CLICKHOUSE_USER} password ${CLICKHOUSE_PASSWORD}" >> ~/.netrc
chmod 600 ~/.netrc
# Then use: curl --netrc ...

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

Although chmod 600 reduces file exposure, the surrounding pattern still centers on persistent credential storage in ~/.netrc. The risk is not the permission change itself but the endorsement of a file-based secret cache in a planning reference.

Content

Scanner excerpt · references/sql.md (reported line 268)May include surrounding context.

bash

# Create ~/.netrc file with restricted permissions
echo "machine ${CLICKHOUSE_HOST} login ${CLICKHOUSE_USER} password ${CLICKHOUSE_PASSWORD}" >> ~/.netrc
chmod 600 ~/.netrc
# Then use: curl --netrc ...

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly asks the user to provide raw database connection details, including a password, and suggests direct HTTP querying from the agent workflow. That creates a real credential-handling risk because secrets may be exposed in chat history, logs, telemetry, or downstream tooling, and the skill does not present a safer alternative or explicit warning about secret exposure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Collecting raw database credentials in plain interaction is a true security issue even if the feature is meant for legitimate migration planning. In this context, the skill is more dangerous because it normalizes sharing live infrastructure secrets with an agent, which can lead to credential leakage, unauthorized database access, and unintended exposure of schema or data metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document instructs users to decommission the self-built cluster and perform business switchovers/rollback-related configuration changes, but it does not prominently warn that these are service-impacting and potentially destructive operations. In a migration-planning skill, omission of explicit cautions increases the chance of accidental downtime, misrouting of reads/writes, or premature retirement of the source environment before validation is complete.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation shows backup/restore commands with inline Access key ID and Secret access key parameters in the SQL examples, but gives no warning about secure credential handling. In practice, users often copy examples into query history, scripts, tickets, or shared docs, which can expose long-lived OSS credentials through logs, audits, or accidental commits.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The reference goes beyond migration planning into execution and rollback/cleanup SQL, including INSERT ... FROM remote plus DROP PARTITION and TRUNCATE TABLE. In a skill advertised as a planner, embedding operational commands materially increases the chance that an agent or user will execute state-changing actions on production systems without a stronger execution boundary or safety gating.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/sql.md (reported line 100)May include surrounding context.

md

SHOW databases;

-- Show database definition
SHOW CREATE DATABASE <DATABASE>; 

-- List tables in database
SHOW tables from <DATABASE>;

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The cleanup commands DROP PARTITION and TRUNCATE TABLE are destructive and are presented as retry steps without strong warnings about irreversibility, scope, backup requirements, or validation steps. In migration scenarios, accidental execution against the wrong table or partition could cause immediate data loss.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Telling users to add database credentials to ~/.bashrc creates long-lived session persistence for secrets, increasing exposure through shell startup files, backups, accidental disclosure, or cross-session reuse. For a planning skill, this is unnecessary credential persistence guidance.

Content

Scanner excerpt · references/sql.md (reported line 257)May include surrounding context.

Method 1: Environment Variables (Recommended)

bash

# Set credentials as environment variables (add to ~/.bashrc or export in session)
export CLICKHOUSE_HOST="cc-xxx.clickhouse.rds.aliyuncs.com"
export CLICKHOUSE_PORT="8123"
export CLICKHOUSE_USER="your_username"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/sql.md (reported line 268)May include surrounding context.

bash

# Create ~/.netrc file with restricted permissions
echo "machine ${CLICKHOUSE_HOST} login ${CLICKHOUSE_USER} password ${CLICKHOUSE_PASSWORD}" >> ~/.netrc
chmod 600 ~/.netrc
# Then use: curl --netrc ...

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sql.md (reported line 288)May include surrounding context.

Get Database Information

bash

echo "SELECT name AS database_name, engine FROM system.databases WHERE name NOT IN ('system', 'information_schema', 'INFORMATION_SCHEMA') FORMAT TabSeparatedWithNames SETTINGS readonly = 1, max_execution_time = 300, max_threads = 1;" | \
curl --connect-timeout 30 --max-time 300 \
  -u "${CLICKHOUSE_USER}:${CLICKHOUSE_PASSWORD}" \
  "http://${CLICKHOUSE_HOST}:${CLICKHOUSE_PORT}/" -d @-

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sql.md (reported line 295)May include surrounding context.

Get Database Information

bash

echo "SELECT name AS database_name, engine FROM system.databases WHERE name NOT IN ('system', 'information_schema', 'INFORMATION_SCHEMA') FORMAT TabSeparatedWithNames SETTINGS readonly = 1, max_execution_time = 300, max_threads = 1;" | \
curl --connect-timeout 30 --max-time 300 \
  -u "${CLICKHOUSE_USER}:${CLICKHOUSE_PASSWORD}" \
  "http://${CLICKHOUSE_HOST}:${CLICKHOUSE_PORT}/" -d @-

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The 'Execute Any Query via HTTP' section authorizes arbitrary SQL over authenticated HTTP, which exceeds the planning scope and creates a direct path to data modification, deletion, or exfiltration. Because it is generic and unconstrained, it can be reused for any statement the connected ClickHouse account permits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Generic 'any query' HTTP guidance lacks warnings that submitted SQL may alter or destroy data and that queries and credentials may be exposed through logs, shell history, proxies, or plaintext transport if HTTP is used. This omission makes unsafe execution appear routine.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This example sends arbitrary user-supplied SQL over authenticated HTTP, enabling remote execution of any permitted database action and possible data exfiltration. Combined with the unrestricted '<YOUR_SQL_QUERY>' placeholder, it meaningfully expands abuse potential beyond planning or introspection.

Content

Scanner excerpt · references/sql.md (reported line 345)May include surrounding context.

Execute Any Query via HTTP

bash

echo '<YOUR_SQL_QUERY>' | curl --connect-timeout 30 --max-time 300 \
  -u "${CLICKHOUSE_USER}:${CLICKHOUSE_PASSWORD}" \
  "http://${CLICKHOUSE_HOST}:${CLICKHOUSE_PORT}/" -d @-

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document instructs operators to run ALTER TABLE ... ON CLUSTER commands that change merge behavior across the entire cluster, but it does not prominently warn about operational side effects, pre-change validation, or rollback steps. In a migration/planning skill, operators may copy these commands directly into production, risking prolonged merge backlog, storage growth, or degraded performance if limits are set too low or restored incorrectly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This section teaches credential setup and shell-based HTTP access patterns that are not necessary for a planning-only skill, increasing the likelihood that secrets are handled in ad hoc local environments and that operators run commands directly from the documentation. While not inherently malicious, it broadens the skill from planning into live system access.

Content

No source excerpt is available for this finding.