Security audit

Alibabacloud Emr Starrocks Assistant

Security checks for vulnerabilities and agentic risk

Overview

This StarRocks assistant is mostly purpose-aligned, but it needs review because it stores database credentials, can run database-changing SQL, and documents unsafe setup and plaintext connection patterns.

Review before installing. Use a least-privilege StarRocks account, avoid the curl | sh installer path, avoid public plaintext database connections unless you have a trusted encrypted network path, and do not rely on the skill to redact sensitive query results. Treat the local ~/.starrocks profile as stored credentials and be careful with SR_PROFILE or --profile values until profile-name validation is fixed.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/connect.md:42
Finding: Unverified Remote Installer Is Downloaded and Executed Through a Shell
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/sr_connect/config.py:33
Finding: Unvalidated Profile Names Allow Path Traversal and Arbitrary File Operations
Content: View full analysis
Path: return config_dir() / f"{profile}.cnf" def grants_path(profile: str) -> Path: return config_dir() / f"{profile}.grants" ``` The resulting paths are used for writes and replacement: ```python def write(profile: str, cfg: ProfileConfig) -> Path: """Write profile config with strict mode 600. Creates ~/.starrocks with 700 if missing.""" d = config_dir() d.mkdir(parents=True, exist_ok=True) os.chmod(d, stat.S_IRWXU) # 700 path = config_path(profile) parser = configparser.ConfigParser() parser["client"] = { "host": cfg.host, "port": str(cfg.port), "user": cfg.user, "password": cfg.password, } if cfg.ssl: parser["client"]["ssl"] = "true" if cfg.logged_in_at: parser["meta"] = {"logged_in_at": cfg.logged_in_at} tmp = path.with_suffix(".cnf.tmp") fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600) try: with os.fdopen(fd, "w") as f: f.write(f"# Managed by sr-login. Do not edit manually.\n") f.write(f"# Profile: {profile}\n") parser.write(f) except Exception: tmp.unlink(missing_ok=True) raise os.replace(tmp, path) os.chmod(path, 0o600) return path ``` The same paths are also used for deletion: ```python def remove(profile: str) -> bool: """Delete profile config + grants. Returns True if .cnf was removed.""" removed = False path = config_path(profile) if path.exists(): path.unlink() removed = True ...[truncated 2432 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/sr_connect/connection.py:25
Finding: Database Credentials and Query Traffic Are Permitted Over Plaintext Public Connections
Content: View full analysis
pymysql.connections.Connection: """Open a pymysql connection. Raises SRConnectionError on failure.""" kwargs = dict( host=params.host, port=params.port, user=params.user, password=params.password, connect_timeout=params.connect_timeout, charset="utf8mb4", autocommit=True, ) if params.database: kwargs["database"] = params.database if params.ssl: # Empty dict is the pymysql idiom for "enable TLS with defaults". kwargs["ssl"] = {} try: return pymysql.connect(**kwargs) except pymysql.err.OperationalError as e: raise SRConnectionError( f"Cannot connect to {params.host}:{params.port} as {params.user}: " f"{e.args[1] if len(e.args) > 1 else e}" ) from e ``` The accompanying instructions explicitly recommend plaintext operation: ```bash # EMR Serverless internal and public endpoints both use plain MySQL wire # protocol on port 9030 — no SSL/TLS. The same command works for either. sr-login --host --port 9030 --user ``` ### Technical Analysis TLS is optional and disabled by default. The instructions explicitly direct users to use plaintext MySQL wire protocol for both internal and public endpoints. Without TLS, the connection lacks transport confidentiality and authenticated encryption. Depending on the negotiated authentication mechanism and network position, an observer or active man-in-the-middle may capture authentication material, monitor SQL statements and result data, inject traffic, or impersonate the database end ...[truncated 1361 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sr_connect/query.py:62
Finding: Sensitive Query Results Are Rendered Verbatim Despite the Documented Masking Policy
Content: View full analysis
1 else str(e) raise SRConnectError(f"SQL error [{errno}]: {msg}") from e _render(columns, rows, fmt) return 0 ``` All values are converted to strings without redaction: ```python def _s(v: Any) -> str: if v is None: return "NULL" return str(v) ``` For example, the TSV renderer prints every value directly: ```python def _render_tsv(columns: list[str], rows: list[tuple]) -> None: sys.stdout.write("\t".join(columns) + "\n") for r in rows: sys.stdout.write("\t".join(_s(v) for v in r) + "\n") ``` The documented policy states: ```markdown | Query results contain obvious key / token columns | Warn the user without displaying full content | ``` ### Technical Analysis There is no implementation that examines column names, classifies potentially sensitive fields, masks values, or asks for confirmation before displaying them. Every supported renderer receives the original rows and emits their complete values. Consequently, columns named `password`, `token`, `api_key`, `secret`, `private_key`, or similar are treated identically to ordinary fields. The documented ...[truncated 1268 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (41)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a multi-scenario assistant with substantial StarRocks operational and development capabilities. However, the supplied code chunk is only a minimal package initializer with metadata and a docstring saying it is a base skill for StarRocks EMR Serverless access. There is no code here for connection workflows, schema design, ingestion selection, SQL analysis/tuning, or health diagnostics. Based on this chunk, the actual behavior is far narrower than the declared purpose, so this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description frames the skill as a broad StarRocks development/operations assistant focused on advisory scenarios such as schema design, ingestion choice, SQL tuning, execution-plan analysis, materialized views, and cluster health diagnostics. The supplied code chunk instead exposes a narrow command-line toolset for authentication/profile management, simple connection diagnosis, and executing arbitrary SQL on a StarRocks cluster. That is a materially different behavior profile: it performs actions, including query execution, rather than primarily providing guidance, and it lacks implementation for most of the described scenario coverage. While cluster connection is one listed scenario and sr-doctor loosely aligns with diagnosis, the presence of local credential management and active SQL execution are undeclared operational capabilities, and the absence of most claimed functionality makes the description inaccurate overall.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
l-project-root>` where `<skill-project-root>` is the directory containing this `SKILL.md` and `pyproject.toml` (the Skill's base directory shown at invocation t

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Piping network content directly into sh is a classic command-chaining risk because it turns a documentation step into immediate arbitrary code execution with the user's privileges. In the context of a skill that manages local credentials under ~/.starrocks/, compromise of the installer path could lead to credential theft, tampering with CLI behavior, or broader host compromise.
Content: Scanner excerpt · references/connect.md (reported line 43)May include surrounding context.
bash
# Install uv (if not already installed) curl -LsSf https://astral.sh/uv/install.sh | sh # Install the CLI from the skill's project root uv tool install .

Cloud Metadata Access

High

Category: Server-Side Request Forgery
Confidence: 85% confidence
Finding: Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.
Content: Scanner excerpt · references/connect.md (reported line 183)May include surrounding context.
md
### Implementation notes - `sr-doctor` uses standard-library `socket.create_connection` for the TCP probe (5 s timeout) and `urllib.request` for the egress IP lookup. No extra dependencies. - Egress IP discovery uses `https://ipinfo.io/ip` (plain-text response). `api.ipify.org` and the Aliyun ECS metadata service (`100.100.100.200`) were observed to be unreliable in agenthub-style sandboxes — ipinfo.io is the only one that worked there. - All network calls are encapsulated inside the CLI; the assistant never invokes `curl` itself, preserving the Runtime-security boundary set out in [SKILL.md](../SKILL.md#runtime-security). ## Password input guidelines

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/data-import.md (reported line 127)May include surrounding context.
md
### 3. SQL Statement ```sql -- Complete SQL statement, with comments on key parts ```

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/data-import.md (reported line 129)May include surrounding context.
md
### 3. SQL Statement ```sql -- Complete SQL statement, with comments on key parts ```

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/schema.md (reported line 119)May include surrounding context.
md
### 3. SQL Statement ```sql -- Complete SQL statement, with comments on key parts ```

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/schema.md (reported line 121)May include surrounding context.
md
### 3. SQL Statement ```sql -- Complete SQL statement, with comments on key parts ```

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/sql.md (reported line 103)May include surrounding context.
md
### 3. SQL Statement ```sql -- Complete SQL statement, with comments on key parts ```

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/sql.md (reported line 105)May include surrounding context.
md
### 3. SQL Statement ```sql -- Complete SQL statement, with comments on key parts ```

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/sql.md (reported line 109)May include surrounding context.
md
### 3. SQL Statement ```sql -- Complete SQL statement, with comments on key parts ```

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/sql.md (reported line 111)May include surrounding context.
md
### 3. SQL Statement ```sql -- Complete SQL statement, with comments on key parts ```

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
md
selection, SQL optimization, window functions, CTEs, JOIN tuning, materialized view design, cluster health inspection, node-down diagnosis. Not applicable for: StarRocks instance lifecycle management (create / scale / restart / config change / version upgrade — these are control-plane operations, please use the EMR Serverless console or the corresponding OpenAPI), or other Alibaba Cloud products (EMR Cluster, Spark, Milvus, ClickHouse, Doris, RDS, ECS).

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: The bootstrap protocol authorizes the agent to autonomously install tooling and attempt credential initialization before obtaining explicit user consent. Even though it is limited to local skill tooling, this increases risk because the agent may alter the local environment or consume sensitive environment-provided credentials without a deliberate approval step.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
When this Skill is invoked and you anticipate running any cluster query, ensure `srsql` is available *before* asking the user for anything: 1. Run `which srsql`. If it returns a path, skip to step 4. 2. If missing, install it yourself: `uv tool install <skill-project-root>` where `<skill-project-root>` is the directory containing this `SKILL.md` and `pyproject.toml` (the Skill's base directory shown at invocation time; commonly `~/.claude/skills/alibabacloud-emr-starrocks-assistant/`, which may be a symlink). **Do not ask the user to run this** — the bundled CLI is part of the Skill's capability surface, not user infrastructure. 3. If `uv` itself is missing (`which uv` fails), surface that to the user — `uv` is a system tool and not auto-installed. 4. Check `~/.starrocks/{profile}.cnf` (default profile name: `default`; respect `SR_PROFILE` env var if set). If it exists, skip to step 5. If missing: - **First try `sr-login --from-env`.** Safe to call unconditionally — it exits 2 with a clear "missing" message when the environment doesn't have the credentials it needs, and does nothing else. You do not need to inspect environment variables yourself.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/connect.md (reported line 12)May include surrounding context.
md
| `sr-login` | Register a cluster credential locally + smoke-test connection | First time on a cluster, or to switch the password | | `sr-logout` | Remove the local profile (no cluster-side action) | When done with a cluster | | `sr-whoami` | Print profile state — host, user, login time, captured grants | Verify which cluster is active | | `sr-doctor` | Diagnose connection failures (endpoint type, reachability, egress IP, /24 whitelist) | Automatically run by `sr-login` on failure; can also be called directly | | `srsql` | Daily query entry point; classifies SQL and gates non-READ behind `--yes` | Run any SQL | ## Security model

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: L022 explicitly states that JSON is not supported by Broker Load and instructs users to use INSERT INTO ... FROM FILES() instead. Later, L225-L235 presents a JSON (v3.2.3+) section with FORMAT AS "json" as if Broker Load supports JSON, which is a direct documentation contradiction within the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide shows credential-bearing examples using access keys and secrets directly in SQL-like configuration blocks without warning that real secrets should not be embedded in statements, documentation, screenshots, query history, or logs. In this skill context, users may copy-paste these patterns into production workflows, increasing the chance of credential leakage through SQL clients, audit logs, shell history, shared notebooks, or incident tickets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The examples embed credential fields such as usernames and passwords directly in connector configurations, including privileged defaults like root and empty passwords, without any warning to use secret management or non-production placeholders. In an operations-focused skill, users often copy examples verbatim, which can normalize insecure secret handling, lead to hardcoded credentials in source control, and encourage overprivileged database access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The CDC guidance describes continuous replication from source systems into StarRocks, including INSERT/UPDATE/DELETE handling, but does not prominently warn that the pipeline can propagate destructive changes and sensitive records automatically once enabled. In a data-platform assistant, that omission is risky because users may enable sync against the wrong source, database, or table and unintentionally mirror deletions or regulated data into the target environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation shows OSS access credentials being passed inline in SQL statements, which normalizes insecure secret-handling and creates a high chance that users will copy the pattern into real systems. In a development/operations assistant, examples are especially likely to be reused verbatim, so this can lead to credential exposure through query history, logs, screenshots, shared notebooks, or version control.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example includes cloud access keys and secrets without any warning about sensitive data handling, which can mislead users into treating credentials as ordinary parameters. In SQL-centric workflows, secrets embedded in statements are commonly exposed via audit logs, client history, monitoring systems, and collaboration artifacts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.