Security audit

Alibabacloud Emr Spark Manage

Security checks across malware telemetry and agentic risk

Overview

This is mostly a legitimate Alibaba Cloud EMR Spark management guide, but it also exposes access-control and token operations that need manual review before installation.

Install only if you intend an agent to manage Alibaba Cloud EMR Serverless Spark resources. Use a dedicated least-privilege RAM user or role, avoid FullAccess for normal job/query work, and manually approve member additions, role grants, public endpoints, token changes, queue scaling, and paid resource creation. Do not put real Kyuubi tokens in prompts, logs, shell history, or command-line arguments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The documentation exposes permission-management APIs such as adding members and granting roles, which materially expands the skill from Spark workspace/job operations into IAM-like access administration. In an agent setting, undocumented or under-declared privilege-management capability is dangerous because users and orchestrators may invoke actions with broader security consequences than the manifest suggests, enabling unintended access grants or privilege escalation.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: Kyuubi token management introduces direct credential creation, update, and deletion capabilities that are not declared in the manifest. In an agent workflow, hidden secret-handling functionality is especially risky because it can mint or rotate usable access material without users understanding that the skill handles credentials, increasing chances of credential exposure, abuse, or unauthorized access.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: Kyuubi service and application lifecycle management goes beyond merely executing SQL and includes creating, starting, stopping, updating, deleting services, and canceling applications. In the agent context this broadens the operational blast radius to service availability and network exposure, especially with options like publicEndpointEnabled, while remaining under-declared to users and policy layers.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The permission documentation requests and normalizes capabilities beyond the skill’s stated purpose, including member and role administration as well as broader administrative operations. This is dangerous because users may grant an over-privileged policy based on the docs, enabling unnecessary access expansion and privilege misuse if the skill or downstream tooling is compromised or misused.

Intent-Code Divergence

Low

Confidence: 95% confidence
Finding: The document describes developer workspace access as read-only while including EditWorkspaceQueue, which is a modifying action. This is dangerous because it can mislead operators into granting change-capable permissions under the assumption they are harmless, increasing the chance of unauthorized or accidental resource configuration changes.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill metadata says it is for workspace lifecycle operations such as creating workspaces, submitting jobs, querying status, Kyuubi SQL, and scaling queues, but this reference adds member management and role-granting capabilities. That scope expansion can enable privilege changes and access delegation beyond the advertised purpose, increasing the chance an agent will perform identity/authorization administration that a user or reviewer did not expect.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The token creation/update docs describe passing raw token material but provide no warning about treating it as sensitive credential data. In an agent environment, absence of secret-handling guidance raises the risk that token values are echoed in prompts, logs, transcripts, or examples, leading to credential disclosure and downstream unauthorized access.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation explicitly promotes enabling a public endpoint for the Kyuubi service but does not clearly warn about the increased attack surface, network exposure, or the need for access restrictions. In this skill context, the risk is heightened because it guides lifecycle management for a live SQL gateway, so users may enable internet-reachable access on production data services without understanding the security implications.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The examples pass the Kyuubi token directly on the beeline command line using -p, which can leak credentials through shell history, process listings, audit logs, and terminal recording. Because this skill is intended for operational use against EMR Serverless Spark services, users may copy-paste these commands into shared or production environments, turning documentation into a practical secret-exposure path.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The documentation enumerates destructive actions such as DeleteSessionCluster, DeleteKyuubiService, DeleteKyuubiToken, and Cancel operations without clear warnings, approval expectations, or impact notes. In a lifecycle-management skill, such actions are contextually plausible, but the lack of explicit caution makes accidental or overly broad authorization more likely and can lead to service disruption or loss of operational state.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.