Alibabacloud Emr Starrocks Manage

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:32 AM UTC
• Version: 0.0.1

Overview

The skill is mostly coherent cloud-management guidance, but it handles a database administrator password in command-line arguments and overstates some lifecycle capabilities.

Review before installing. Use this only with a least-privilege Alibaba Cloud profile and confirm account, region, VPC, payment type, and cost before creation. Avoid putting real admin passwords directly in command text; prefer a secure secret-input or temporary-file workflow if the CLI supports it, and rotate credentials if example passwords were used. Treat scale, restart, modify, and diagnostic requests cautiously because those workflows are not fully specified here.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: references/api-reference.md:61

Finding

StarRocks Administrator Password Exposed in Command-Line Arguments

Content

View full analysis

/cmdline` or process-monitoring tools. - Shell history when a user manually runs or copies the documented command. - Agent tool-call and command-execution logs. - Terminal recordings, debugging traces, audit systems, and observability platforms. - Parent-process telemetry or endpoint monitori ...[truncated 1923 chars]

Remediation

View remediation

`. - Add a warning that example values must never be used as actual credentials. 5. **Harden temporary handling if a file is unavoidable.** - Create the file atomically in a trusted directory. - Set a restrictive `umask`, such as `077`, before creation. - Avoid predictable file names and symbolic-link-following behavior. - Remove the file in a cleanup handler on both success and failure. - Do not persist the file in project directories, shared storage, or diagnostic archives. 6. **Rotate potentially affected credentials.** - Change administrator passwords for instances created using copied example values or commands that may have be ...[truncated 114 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The top-level description claims support for restart, configuration changes, scaling, maintenance, and diagnostics, while the actual intent-routing table only documents create and query flows. This discrepancy is dangerous because users and downstream agents may rely on unsupported or underspecified destructive operations, increasing the chance of unsafe improvisation or accidental service-impacting actions outside reviewed procedures.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises broad lifecycle management and includes operational guidance for write actions, but the declared permissions and documented operation mapping are incomplete and inconsistent. This mismatch can cause an agent or operator to assume the skill is authorized for actions it cannot safely or transparently perform, leading to confused-deputy behavior, unsafe fallbacks, or execution of undocumented high-impact operations without clear guardrails.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md

## Instance Creation Workflow

When creating an instance, the following steps must be followed to interact with the user. **No confirmation step may be skipped**:

1. **Confirm Region**: Ask the user for the target RegionId (e.g., cn-hangzhou, cn-beijing, cn-shanghai)
2. **Confirm Purpose**: Development testing / small-scale production / large-scale production, to determine the payment method (postPaid/prePaid)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The CreateInstanceV1 section documents commands that create cloud instances and includes payment-related parameters such as PayType, but it does not include any explicit warning that running the example will provision resources and may incur charges. For markdown documentation describing operations that can affect user data or system integrity, SQP-2 expects user-facing warnings about such impactful behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation includes a hardcoded example admin password in plaintext within a shell command. Even if presented as an example, operators may copy it directly into production workflows, shell history, logs, screenshots, or shared runbooks, creating avoidable credential exposure and encouraging unsafe secret-handling practices.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation includes a literal admin password in a CLI example for provisioning a real cloud resource. Even though the value is clearly a placeholder, users commonly copy commands verbatim into shell history, terminals, shared docs, or CI logs, which can lead to insecure secret handling and accidental credential exposure for a privileged account.

Content

No source excerpt is available for this finding.