alibabacloud-migration-dbm-oracle-traffic-capture

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:40 AM UTC
• Version: 0.0.1

Overview

This Oracle migration skill is not clearly malicious, but it uses coercive agent instructions and high-impact database runbook guidance that should be reviewed before installation.

Install only if you need Oracle Workload Capture guidance and are comfortable reviewing all generated SQL and shell commands before use. Do not let the skill's absolute-priority or language rules override your own approval process. Run database capture only with DBA authorization, verify the sqla download through a trusted channel, and avoid running the repair script as root or in shared writable directories.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:16

Finding

Unconditional Agent Instruction and Output Hijacking

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fix_replay_json.py:471

Finding

Predictable Temporary File Allows Symlink-Based File Overwrite

Content

View full analysis

.tmp` as a symbolic link to a file writable by the victim process. 4. A more privileged user or service runs `fix_replay_json.py` in repair mode with that output path. 5. The script executes `open(tmp_file, 'wb')`, follows the symbolic link ...[truncated 1096 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description is for a broad Oracle traffic-capture guidance skill covering source database capture, sqla-based parsing from WCR files, and quality/repair steps. The supplied code does not interact with Oracle, DBMS_WORKLOAD_CAPTURE, WCR files, sqla installation, or capture operations at all. Its actual purpose is much narrower: analyze an existing merge.json-style replay file and print statistics and recommendations. While 'merge.json validation' is one small subset of the declared scope, the primary behavior of the code is not the declared end-to-end traffic-capture guidance. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description centers on operational guidance for capturing Oracle workload traffic and parsing WCR files with sqla into merge.json. The supplied code does not interact with Oracle databases, DBMS_WORKLOAD_CAPTURE, DB_REPLAY, sessions, directories, or sqla parsing workflows. Instead, its primary purpose is post-processing replay JSON files: scanning, validating, modifying, skipping, and rewriting records based on schema, SQL text corruption, encoding issues, and timing anomalies. While the description briefly mentions deep quality check/repair, that is only one tail-end aspect of the declared skill, whereas it is the entire behavior of this code chunk. Therefore the code's actual primary behavior is materially different from the declared purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill imposes a rigid English-only response policy regardless of user preference or context. Hard-coded communication restrictions can suppress safety-critical clarifications, reduce user comprehension, and create deceptive compliance behavior, especially when the user operates in another language during sensitive database procedures.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Repeated prohibition of Chinese characters anywhere in the response is an unnecessary policy constraint that can interfere with safe, user-understandable guidance. In security-sensitive workflows, forcing a single language can increase misconfiguration risk and conceal whether the agent is prioritizing policy over user safety.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This broad ban on Chinese characters, pinyin, and translated phrases is another coercive output constraint that can degrade clarity and informed consent. In operational runbooks, such restrictions may pressure the agent to ignore the user's language needs and elevate procedural compliance over safe execution.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

1. **The workload capture on the source database (START_CAPTURE) is triggered by the customer -- I never start/stop the capture on the database myself.** All other steps I run for you after you provide access and confirm the commands.
2. Do not modify Oracle core parameters, do not restart the database, do not delete data, do not change table structures.
3. All paths are for reference only and **must be confirmed by the customer** before execution.
4. `chmod 777` is forbidden.
5. Production environments must be risk-assessed; validating in a test environment first is recommended.
6. **Any Chinese output in conversational text, even if deliverables are English, is a violation.** The entire response must be English-only.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

An English-only red-line for the entire response is a policy abuse issue because it constrains safe communication in a context involving production database operations. It is especially concerning because the skill treats policy compliance as mandatory even when it may reduce the user's ability to verify risky steps.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The skill instructs downloading an external tarball during execution from a remote OSS URL. Even with a checksum check, this expands the trust boundary to an external artifact supply chain; if the hosting location, checksum source, or transport assumptions are compromised, operators may install malicious tooling into an environment handling production database captures.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md

if [ -f <install_dir>/sqla-3.3.26.tar.gz ]; then
  echo "sqla already exists, skip download"
else
  wget --timeout=60 https://cmh-prod-ap-southeast1.oss-ap-southeast-1.aliyuncs.com/agent/frodo/sqla-3.3.26.tar.gz -O <install_dir>/sqla-3.3.26.tar.gz
  EXPECTED_SHA256="baf46622d5180ea7dbf78018d9b764626fbd3be66695be75ae2ae76c203c31f9"
  echo "${EXPECTED_SHA256}  <install_dir>/sqla-3.3.26.tar.gz" | sha256sum -c - \
    || { echo "sqla integrity verification failed"; exit 1; }

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.

md

## Key lessons (from the field)

1. Directory residue is the biggest cause of ORA-15505 -> always use a brand-new empty directory.
2. Set minimum permissions: `chown oracle:oinstall` + `chmod 750`. Never 777.
3. Java must be 8+ for the sqla parse tool.
4. capfiles > 1MB after capture is required to be valid; 0 bytes means no traffic.
5. merge.json is one JSON per line with fields: startTime, schema, session, execTime, convertSqlText.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/fix_replay_json.py (reported line 65)May include surrounding context.

python

#    (U+951B)          =  '' corrupted           → ','
#    (U+9286)          =  FROM emptycorrupted    → ' '
#    (U+951B U+5869) = query+ → ') c' col_aol_a_n  col_a) col_a_n
# mojibakemojibakereplace  rule ','
MOJIBAKE_CHARS = ('\u951b', '\u9286', '\u5869')          #   
MOJIBAKE_COMPOUND = (('\u951b\u5869', ') c'),)           #  -> ) c
MOJIBAKE_SINGLE = (('\u9286', ' '), ('\u951b', ','))     # ->empty, ->

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill describes file-reading and file-writing behavior but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope boundaries can allow broader-than-expected filesystem access if the runtime grants defaults, increasing the risk of unintended file modification or exfiltration.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill contains contradictory instructions about whether it will start or stop capture itself. In operational security contexts, contradictory execution boundaries can cause an agent or operator to perform database actions that were supposed to require explicit customer control, increasing the chance of unauthorized or harmful production changes.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

1. **The workload capture on the source database (START_CAPTURE) is triggered by the customer -- I never start/stop the capture on the database myself.** All other steps I run for you after you provide access and confirm the commands.
2. Do not modify Oracle core parameters, do not restart the database, do not delete data, do not change table structures.
3. All paths are for reference only and **must be confirmed by the customer** before execution.
4. `chmod 777` is forbidden.
5. Production environments must be risk-assessed; validating in a test environment first is recommended.
6. **Any Chinese output in conversational text, even if deliverables are English, is a violation.** The entire response must be English-only.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.

md

## Key lessons (from the field)

1. Directory residue is the biggest cause of ORA-15505 -> always use a brand-new empty directory.
2. Set minimum permissions: `chown oracle:oinstall` + `chmod 750`. Never 777.
3. Java must be 8+ for the sqla parse tool.
4. capfiles > 1MB after capture is required to be valid; 0 bytes means no traffic.
5. merge.json is one JSON per line with fields: startTime, schema, session, execTime, convertSqlText.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The top-level documentation repeatedly describes 'replay SQL' functionality and usage around a replay file, which implies executing or driving replay behavior. In reality, the implementation only checks file existence, parses JSON lines, counts SQL categories and schemas, and prints recommendations; it never replays SQL or initiates traffic replay.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The red-lines require customer confirmation of all paths before execution, yet the non-interactive policy requires a complete copy-paste-ready script/command sequence in one pass, and multiple commands are written as directly executable templates. This creates intent-level tension between 'must confirm before execution' and 'always produce execution-ready commands regardless of interactivity.'

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.