Security audit

alibabacloud-migration-lhm-inspect-hive-metastore

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly performs Hive metadata inspection, but it also creates migration artifacts and can persist credentials in ways users should review before installing.

Install only if you intentionally want this skill to prepare migration artifacts, not just inspect metadata. Use least-privilege read-only Metastore credentials, avoid storing passwords in config files or profiles, do not provide broad S3 keys, review generated shell and SQL files before execution, and prefer Kerberos or tightly isolated NOSASL endpoints.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/hive_explore.py:633
Finding: Automatic Persistence of Plaintext Database Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_rclone_script.py:36
Finding: S3 Access Keys Written Verbatim into Generated Shell Scripts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_rclone_script.py:41
Finding: Shell Command Injection in Generated Rclone Migration Script
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_paimon_statements.py:111
Finding: Hive and Paimon SQL Injection Through Unescaped Metadata
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/hive_dive_thrift.py:198
Finding: Path Traversal and Arbitrary File Overwrite Through Metastore Names
Content: View full analysis
Export DDL to: {ddl_file_path}") try: ddl = build_ddl(table) with open(ddl_file_path, 'w', encoding='utf-8') as f: f.write(ddl) except Exception as e: print(f" -> Error: DDL generation failed: {e}") with open(ddl_file_path, 'w', encoding='utf-8') as f: f.write(f"-- FAILED TO GET DDL for {db_name}.{tbl_name}\n") ``` ### Technical Analysis Database and table names obtained from the Metastore are placed directly into a filesystem path. The implementation does not reject path separators, normalize the filename, encode unsafe characters, or verify that the resolved path remains below `ddl_subdir`. If a Metastore implementation or compromised metadata source returns names containing traversal sequences or path separators, `os.path.join()` does not neutralize them. Opening the resulting path with write mode can truncate or replace files accessible to the exploration process. Although standard Hive naming rules may reduce exposure in normal deployments, the scanner consumes remote Thrift data and should not assume that the server or metadata is trustworthy. ### Attack Path 1. An attacker controls or compromises Metastore metadata or a compatible Thrift service. 2. The service returns a crafted database or table name containing path traversal components. 3. The operator runs full Thrift exploration. 4. The crafted name is concatenated into `ddl_file_path`. 5. The resolved path escapes the intended `ddl_files` directory. 6. The script writes generated DDL or an error message to the attacker-selected writable location. ### Impact Assessment The attacker may overwrite or truncate files writable by the exploration account ...[truncated 241 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_paimon_statements.py:39
Finding: Database Passwords Exposed in Process Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (37)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill states it is only for exploration and not migration-related work, but later documents generation of rclone migration scripts, Paimon sync SQL, and an orchestrated pipeline. That inconsistency weakens operator understanding and can cause an agent to execute or prepare materially riskier actions than the user expected from a supposedly read-only inspection skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill states it is only for exploration and not migration-related work, but later documents generation of rclone migration scripts, Paimon sync SQL, and an orchestrated pipeline. That inconsistency weakens operator understanding and can cause an agent to execute or prepare materially riskier actions than the user expected from a supposedly read-only inspection skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill states it is only for exploration and not migration-related work, but later documents generation of rclone migration scripts, Paimon sync SQL, and an orchestrated pipeline. That inconsistency weakens operator understanding and can cause an agent to execute or prepare materially riskier actions than the user expected from a supposedly read-only inspection skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill states it is only for exploration and not migration-related work, but later documents generation of rclone migration scripts, Paimon sync SQL, and an orchestrated pipeline. That inconsistency weakens operator understanding and can cause an agent to execute or prepare materially riskier actions than the user expected from a supposedly read-only inspection skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill states it is only for exploration and not migration-related work, but later documents generation of rclone migration scripts, Paimon sync SQL, and an orchestrated pipeline. That inconsistency weakens operator understanding and can cause an agent to execute or prepare materially riskier actions than the user expected from a supposedly read-only inspection skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill states it is only for exploration and not migration-related work, but later documents generation of rclone migration scripts, Paimon sync SQL, and an orchestrated pipeline. That inconsistency weakens operator understanding and can cause an agent to execute or prepare materially riskier actions than the user expected from a supposedly read-only inspection skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file generates CREATE TABLE and INSERT OVERWRITE statements for Hive-to-Paimon migration, which materially exceeds the declared inspection-only scope of the skill. In an agent environment, hidden write-capable or migration-capable functionality expands the blast radius from metadata inspection to downstream data modification or destructive overwrite, increasing the chance of unsafe invocation or privilege misuse.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: 该 skill 的清单明确说明其职责是 Hive 元数据探查，且“不适用于数据迁移执行、DDL 转换、数据写入等场景，这些功能由下游 skill 承担”。但此文件会根据配置生成 HDFS 到 S3 的 rclone config/create 和 copy 命令，属于为数据迁移准备同步脚本，而非元数据探查本身。
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: 这里将 access_key_id 和 secret_access_key 直接拼接进生成的 shell 命令，随后会写入输出脚本文件，导致敏感凭据以明文形式落盘。任何能读取脚本文件、进程参数历史、CI 日志或工件的人都可能获得对象存储访问权限，进而造成数据泄露、篡改或横向移动。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This script exceeds the declared inspection-only scope by orchestrating downstream migration artifacts: it generates rclone sync scripts and Paimon synchronization SQL after metastore inspection. In an agent-skill context, this broadens the blast radius from read-only metadata analysis to producing actionable migration commands, increasing the risk of unintended data movement or unsafe follow-on execution by users or other automation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documentation describes capabilities that require shell, network, and file read/write access, but it does not declare an explicit tool scope or permission boundary. In agent environments, this can lead to over-broad execution authority and makes it harder to enforce least privilege or prevent unexpected command execution against databases, HMS endpoints, local files, and external systems.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation first reassures users that incremental exploration does not generate rclone or Paimon statements, then later describes an orchestrator that chains those exact steps. Conflicting safety messaging is dangerous because it undermines informed consent and can lead operators to approve a workflow under false assumptions about what artifacts or follow-on actions it may produce.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 86% confidence
Finding: The example configuration defaults Thrift authentication to NOSASL, which encourages unauthenticated or weakly authenticated connections to the Hive Metastore unless users proactively switch to Kerberos. In environments where the HMS endpoint is reachable beyond a tightly controlled network boundary, this can expose sensitive metadata and increase the risk of unauthorized enumeration.
Content: Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.
md
[thrift] host = your_hms_host # HMS Thrift service address port = 9083 # Thrift port auth = NOSASL # NOSASL or KERBEROS kerberos_principal = hive/_HOST@YOUR.REALM # only for KERBEROS mode timeout = 60 # connection timeout (seconds) size_source = params # table-size source: params / hadoop / skip

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documented suite relationship expands a read-only exploration skill into downstream migration script generation and orchestration, blurring the boundary between inspection and operational change preparation. In agent systems, this kind of scope creep increases the chance that a user invokes a seemingly safe skill that can materially facilitate data transfer or schema-sync actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains natural-language instructions and prompts exclusively in Chinese, including the module description and interactive configuration guidance. Because the file provides no user opt-in, alternate locale, or justification that the skill is region-specific, it violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/config_manager.py (reported line 121)May include surrounding context.
python
has_password = True break if has_password: print(f" 注意: 文件包含密码明文，建议执行: chmod 600 {path}") def merge_cli_args_into_config(args, base_config=None):

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code presents its natural-language documentation and operational messages exclusively in Chinese, which imposes a specific language on users. The policy for SQP-3 applies to all file types and flags language/locale constraints unless the skill offers a user choice or clearly justifies the restriction.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code actively invokes Hive CLI/Beeline to derive DDL that is then used for migration and synchronization workflows, which is inconsistent with a read-only inspection skill. Although the immediate commands shown are read-oriented, this capability enables unauthorized operational coupling to production Hive environments and supports generation of write SQL beyond the manifest's stated purpose.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/generate_paimon_statements.py (reported line 49)May include surrounding context.
python
'--silent=true', '--showHeader=false', '--outputformat=tsv2', '-e', cmd ] result = subprocess.check_output(beeline_cmd, stderr=subprocess.PIPE) else: result = subprocess.check_output( ['hive', '-S', '-e', cmd], stderr=subprocess.PIPE)

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/generate_paimon_statements.py (reported line 51)May include surrounding context.
python
] result = subprocess.check_output(beeline_cmd, stderr=subprocess.PIPE) else: result = subprocess.check_output( ['hive', '-S', '-e', cmd], stderr=subprocess.PIPE) else: result = subprocess.check_output(

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/generate_paimon_statements.py (reported line 54)May include surrounding context.
python
] result = subprocess.check_output(beeline_cmd, stderr=subprocess.PIPE) else: result = subprocess.check_output( ['hive', '-S', '-e', cmd], stderr=subprocess.PIPE) else: result = subprocess.check_output(

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: 脚本要求读取 S3 目标端的 provider、endpoint、access_key_id、secret_access_key 和 bucket，并将这些信息拼接到生成的 rclone 配置命令中。对于一个声明为执行 Hive Metastore 全量/增量探查的 skill，这种面向跨存储数据同步的凭据处理能力并非其直接、显然必要的实现细节。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The program generates rclone copy commands that transfer data from HDFS to S3, which is a safety-relevant network/data movement operation. While this is part of the tool's purpose, the code provides no explicit user disclosure that the generated script will perform bulk data transfer when run, nor any confirmation or caution about reviewing the commands first.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language instructions and runtime messages exclusively in Chinese, which effectively forces a specific language for users and operators. The policy allows locale constraints only when the skill offers user choice or clearly documents and justifies the restriction, which is not present here.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest describes Hive metastore inspection via DB direct connection or HMS Thrift API, exporting metadata, sizes, and DDL. While collecting table size is in scope, implementing it by spawning the local hadoop command introduces an extra capability—external process execution against HDFS—that is not stated in the skill purpose or connection model.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.