alibabacloud-migration-dbm-oracle-traffic-capture

• Outcome: Pass
• Latest audit: Jul 30, 2026 · 11:31 AM UTC
• Version: 0.0.1

Overview

This skill is a disclosed Oracle workload-capture runbook with expected local file repair and a pinned sqla download, but users should review its production-database steps and English-only response rule before use.

Install only if you are comfortable with an operational Oracle capture runbook that may run remote setup commands after you provide access and confirmation. Review the sqla download source and hash, run capture first in a test or low-risk window, preserve original merge.json files, and inspect any merge_fixed output before using it for replay.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises itself as guidance-only, but it clearly includes operational steps that read from and write to local files, including producing or modifying replay artifacts like merge.json and merge_fixed.json. Undeclared file access reduces transparency and bypasses least-privilege expectations, increasing the chance that an agent using the skill performs state-changing actions the user did not authorize.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior goes beyond traffic-capture guidance into replay JSON rewriting, record dropping, anomaly normalization, and statistical analysis. This mismatch is dangerous because users and policy engines may trust the description and approve the skill for low-risk guidance, while the actual workflow alters evidence-like capture outputs and changes downstream replay semantics.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill instructs downloading software from an external OSS endpoint even though the skill is framed as procedural guidance. Introducing network retrieval expands the trust boundary to a third-party location and creates supply-chain and egress risk, especially in restricted environments where a guidance skill would not normally need to fetch executables.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The bundled repair workflow modifies merge.json output and can skip or rewrite records, which is broader than simple capture guidance. In the context of workload capture artifacts, this can silently change replay fidelity and create integrity concerns if consumers assume the output is a direct parser result.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The skill says it will not start or stop capture itself, but also states that it will run all other steps remotely once access is provided. That ambiguity is dangerous because it blurs the boundary between advisory behavior and remote operational execution on production systems, increasing the likelihood of overbroad agent action.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill includes mandatory-looking repair steps that alter merge.json without a strong warning that the output is no longer an original parse artifact. For database replay inputs, silent modification can affect auditability, forensic value, and replay correctness, especially when records are dropped or timestamps are normalized.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: The skill hard-codes an English-only output policy and forbids Chinese regardless of user preference. This is dangerous because it overrides user intent and can prevent safe, accurate communication during sensitive operational tasks, particularly for users who rely on another language to validate commands before execution.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: This repeated prohibition on Chinese reinforces a fixed language policy that supersedes user choice and normal platform behavior. Repetition makes the instruction more likely to dominate the model's response policy, causing accessibility and usability failures in a production migration context.

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: The requirement to avoid any Chinese characters anywhere in the response is an aggressive policy override unrelated to core traffic-capture functionality. In a safety-critical runbook, this can block clarifications, translated warnings, or bilingual explanations that help prevent operator error.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: The red-line section again mandates English-only conversational text, turning a formatting preference into a hard behavioral constraint. Because this is a migration/production workflow, forcing one language can materially increase misunderstanding and unsafe execution of commands.

External Script Fetching

High

• Category: Supply Chain

Content

if [ -f <install_dir>/sqla-3.3.26.tar.gz ]; then
  echo "sqla already exists, skip download"
else
  wget --timeout=60 https://cmh-prod-ap-southeast1.oss-ap-southeast-1.aliyuncs.com/agent/frodo/sqla-3.3.26.tar.gz -O <install_dir>/sqla-3.3.26.tar.gz
  EXPECTED_SHA256="baf46622d5180ea7dbf78018d9b764626fbd3be66695be75ae2ae76c203c31f9"
  echo "${EXPECTED_SHA256}  <install_dir>/sqla-3.3.26.tar.gz" | sha256sum -c - \
    || { echo "sqla integrity verification failed"; exit 1; }

• Confidence: 96% confidence
• Finding: wget --timeout=60 https://cmh-prod-ap-southeast1.oss-ap-southeast-1.aliyuncs.com/agent/frodo/sqla-3.3.26.tar.gz -O <install_dir>/sqla-3.3.26.tar.gz EXPECTED_SHA256="baf46622d5180ea7dbf78018d9b764626

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.