alibabacloud-migration-lhm-inspect-hive-metastore

• Outcome: Review
• Latest audit: Aug 4, 2026 · 7:09 AM UTC
• Version: 0.0.1

Overview

This skill is mostly an inspection tool, but it also bundles and documents migration-script and overwrite-SQL generators that go beyond the advertised read-only inspection purpose.

Install only if you intend to allow this skill to do more than read Hive metadata. Use read-only Metastore credentials, avoid saving plaintext profiles or generated rclone scripts with secrets, prefer Kerberos/authenticated Thrift where possible, and review any generated rclone script or Paimon SQL before execution, especially INSERT OVERWRITE statements.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation clearly describes capabilities requiring shell execution, network access, and file read/write, but it does not declare permissions explicitly. That weakens platform trust boundaries because a caller may invoke what appears to be a simple inspection skill while it can access external services and write local artifacts. In an agent setting, undeclared capabilities increase the chance of overbroad execution and accidental data exposure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The manifest frames the skill as read-only Hive metastore inspection, but the documentation includes downstream migration orchestration, rclone script generation, and Paimon SQL generation. That is a material behavior mismatch: users or orchestrators may approve execution expecting metadata discovery, while the skill can prepare data movement and synchronization steps that materially expand operational impact. In agent ecosystems, this kind of hidden breadth is dangerous because routing and permission decisions often rely on the declared description.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The documented suite relationship and downstream toolchain extend beyond passive inspection into migration-script generation and orchestration. Even if those are presented as adjacent capabilities, including them in this skill broadens the effective operational scope and can mislead users about what the skill may enable. In a security review, documentation that normalizes later data-copy and sync steps increases risk because operators may treat the whole bundle as read-only.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The documentation states incremental exploration does not generate rclone/Paimon artifacts, but later sections describe orchestrators and downstream generators that do exactly that. This inconsistency can cause reviewers and automated policy systems to underestimate what execution may trigger, especially if wrappers call the broader pipeline. Ambiguous or contradictory security-relevant docs are a real risk in agent environments where human trust and automated routing depend on precise scope.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file materially exceeds the declared scope of a read-only Hive inspection skill by generating migration and synchronization SQL for Paimon, including table creation and overwrite operations. In a skill ecosystem, this scope mismatch is dangerous because a user or orchestrator invoking an inspection capability could unintentionally obtain write-capable migration artifacts that enable destructive or unauthorized changes.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code generates CREATE TABLE and INSERT OVERWRITE SQL, which are write/destructive operations unrelated to a read-only inspection task. Because the surrounding skill is advertised for inspection, these hidden write capabilities increase the risk of misuse, privilege boundary violations, and accidental data modification in production environments.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The comments say the script creates a Paimon internal table, but the generated DML targets the original full_tbl name with INSERT OVERWRITE TABLE {full_tbl}. This inconsistency can mislead operators into believing they are syncing into a new target while actually overwriting the source Hive table or another object bound to that name, creating a serious risk of data loss or corruption.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script’s implemented behavior materially exceeds the skill’s stated purpose. Instead of only inspecting Hive metastore state, it generates an executable migration shell script that configures rclone remotes and performs HDFS-to-S3 copy operations, creating a dangerous capability mismatch that could trigger unauthorized or unintended data movement.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code generates executable rclone configuration and copy commands, including destination credentials, which gives the skill an unjustified data-migration capability. In the context of a metastore inspection skill, this enables data exfiltration or unauthorized bulk transfer beyond user expectations and weakens any trust boundary implied by the manifest.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This script goes beyond inspection and actively orchestrates generation of migration and synchronization artifacts, including rclone sync commands and Paimon sync SQL. In the context of a skill explicitly documented as inspection-only, this creates a dangerous scope expansion: an agent selecting this skill for read-only metadata analysis could unintentionally produce artifacts that enable downstream data movement or schema-changing operations.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The CLI description advertises a full metadata sync and migration orchestration workflow, which contradicts the skill's declared inspection-only purpose. This mismatch increases the risk of unsafe agent behavior, because routing and trust decisions may be based on metadata that understates the script's operational impact.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script emits INSERT OVERWRITE statements for whole tables and partitions without any safety interlocks, confirmation prompts, backup guidance, or dry-run mode. In the context of an inspection skill, this is especially dangerous because overwrite semantics can replace existing data and cause irreversible production impact if the generated SQL is executed under the assumption that it is merely observational.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The generated shell script embeds access_key_id and secret_access_key directly in command lines, exposing secrets to anyone who can read the script, logs, shell history, process arguments, or downstream artifacts. Even if the script is never executed, writing reusable credentials into a file materially increases credential leakage risk.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

[thrift]
host = your_hms_host        # HMS Thrift service address
port = 9083                 # Thrift port
auth = NOSASL               # NOSASL or KERBEROS
kerberos_principal = hive/[e-mail]  # only for KERBEROS mode
timeout = 60                # connection timeout (seconds)
size_source = params        # table-size source: params / hadoop / skip

• Confidence: 84% confidence
• Finding: auth = NO

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.