Security audit

Alibabacloud Emr Starrocks Manage

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate Alibaba Cloud StarRocks operations skill, but it gives agents high-impact cloud provisioning and management workflows without enough guardrails around spend, secrets, and permissions.

Review before installing. Use only a least-privilege Alibaba Cloud RAM role, confirm any paid resource creation or restart/scale/configuration change before execution, and do not paste real passwords or access keys into commands, prompts, logs, or shared docs. Replace example passwords with securely sourced secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill advertises full lifecycle management including scaling, configuration changes, restarts, and maintenance, but the manifest only declares create and mostly read-only permissions. This mismatch can cause downstream agents, operators, or policy systems to overtrust the documented capabilities, attempt undeclared write operations, or approve a skill under incorrect assumptions about what it can safely do and what permissions it truly needs.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill metadata promises full lifecycle management of StarRocks instances, including scaling, configuration changes, restarts, maintenance, and diagnosis, but the documented RAM policy only grants create and read/query permissions. This mismatch can cause operators to over-trust the documented access model, leading to failed operations, ad hoc privilege expansion, or attachment of overly broad policies to make the skill work.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The document includes example commands for creating billable cloud resources and embeds an admin password directly in request examples without any warning about secret handling, credential leakage, or unintended spend. In an agent skill context, such examples are especially risky because models or operators may copy them verbatim into logs, prompts, shell history, or automation, leading to exposed credentials and accidental resource provisioning.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation embeds an example `AdminPassword` directly in a CLI command body, which encourages operators to pass credentials on the command line. Command-line arguments and inline JSON can be exposed through shell history, process listings, logging, terminal recording, and copy/paste into tickets or chat, leading to unintended credential disclosure. In this skill context, the risk is heightened because it targets SREs and operators performing real infrastructure provisioning, so example commands are likely to be reused with live secrets.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation embeds an `AdminPassword` field with a plausible literal password value and does not clearly warn users to replace it with a securely sourced secret or avoid passing secrets directly on the command line. In an ops-focused skill, users are likely to copy-paste commands verbatim, which increases the chance of credential reuse, shell history leakage, exposure in process listings, CI logs, screenshots, and shared runbooks.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.