Security audit

Alibabacloud Odps Information Schema

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a MaxCompute metadata helper, but it also includes poorly scoped paths that can run broader SQL or steer users toward mutating database operations.

Review before installing. Use this only with a least-privileged MaxCompute identity restricted to Information Schema reads, avoid the custom SQL mode, and do not rely on this skill for DDL/DML, table creation, data insertion, or broad environment enumeration unless you intentionally grant that authority. Treat outputs involving users, roles, privileges, job statements, client IPs, and project settings as sensitive administrative data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/odps_is_query.sh:147
Finding: Custom SQL Validation Can Be Bypassed to Execute DDL or DML Statements
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/odps_is_query.sh:120
Finding: Permission Audit Queries Use an Incomplete Table Join Key
Content: View full analysis
GETDATE()) ORDER BY p.table_name;" ;; ``` ### Technical Analysis A table is identified by the combination of: - `table_catalog` - `table_schema` - `table_name` The project's own guidance in `SKILL.md` requires all three fields when joining Information Schema table-related views. However, the executable permission queries join only on `table_catalog` and `table_name`. When identically named tables exist in different schemas within the same catalog, a privilege record can match multiple unrelated table records. The reported owner may therefore belong to a different schema's table. This can cause: - Duplicate audit records. - Incorrect owner attribution. - False positives where an owner is reported as a non-owner grantee. - False negatives where an unauthorized grant is hidden by an incorrect owner match. - Ambiguous results because the selected output also omits catalog and schema names. ### Attack Path 1. A catalog contains two schemas ...[truncated 1377 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill’s declared scope explicitly excludes ad-hoc SQL and broader execution, but the documentation references a custom SQL mode and odpscmd fallback that can execute user-supplied queries. That mismatch is dangerous because agents may trust the narrow description while still exposing a broader execution path, increasing the chance of unauthorized queries, policy bypass, or use of the skill for unintended database operations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The reference explicitly documents create_table and insert_values capabilities even though the skill is described as metadata-only and not for DDL/DML. In an agent setting, embedded guidance often influences tool selection, so this can cause the skill to perform state-changing operations outside its declared safety boundary, leading to unauthorized data creation or modification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The routing matrix instructs handling create table, insert data, and DDL/DML requests, directly contradicting the skill’s declared scope. This is especially dangerous because routing tables are high-authority decision aids for agents, so the skill may actively route destructive or privilege-affecting requests into execution paths rather than refusing them.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script exposes a generic custom <sql> mode even though the skill is scoped to Information Schema metadata queries, and its validation only blocks obvious DDL/DML prefixes and SELECT *. That still allows arbitrary SELECT statements against non-Information-Schema objects, broad data exfiltration, expensive scans, and potentially multi-statement or dialect-specific bypasses if odpscmd accepts them.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file states that the skill is only for Information Schema metadata queries, but later instructions broaden usage to general MCP and odpscmd operations. Such inconsistent guidance can mislead orchestration logic or human reviewers into granting trust based on a narrower purpose while the skill still facilitates broader execution patterns.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation tells users to route non-Information-Schema tasks such as DDL/DML to odpscmd, which expands operational use beyond the skill’s stated safety boundary. Even if framed as fallback guidance, this can cause an agent to perform mutating or sensitive actions under the authority of a metadata-oriented skill, undermining least privilege and user expectations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation materially broadens the apparent scope of the skill beyond the stated manifest by advertising additional INFORMATION_SCHEMA targets such as UDFs, resources, packages, volumes, foreign servers, and security-label metadata. This can cause downstream agents or users to issue more sensitive metadata queries than intended, increasing exposure of privilege, labeling, and infrastructure details and undermining least-privilege expectations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation instructs use of MCP operations (list_tables, get_table_schema) even though the skill metadata explicitly says listing tables via MCP is out of scope. This creates a scope-bypass path where an agent may invoke broader discovery capabilities than intended, potentially exposing metadata outside the approved INFORMATION_SCHEMA-only workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: These examples normalize queries that enumerate admin users, role assignments, and permission exposure, which are sensitive security metadata. In an agent setting, providing such ready-made queries without warning or access-control guidance can facilitate reconnaissance and privilege mapping by unauthorized or over-broadly authorized users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The project settings audit query exposes potentially sensitive configuration values such as backup retention, IP whitelist, and SQL cost limits. Publishing this as a routine example without caution increases the risk of configuration reconnaissance that could aid targeting, bypass planning, or exfiltration of internal security posture details.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger examples and routing guidance are broad enough to capture requests beyond the intended read-only metadata use case, and they do not consistently state exclusions. In LLM-driven systems, ambiguous scope increases the chance of prompt-to-tool misrouting, including execution of unsupported or unsafe operations under this skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The CLI documentation includes a generic custom SQL mode, which broadens the skill from Information Schema metadata access to arbitrary query execution. Even if intended for convenience, this weakens scope boundaries and can enable access to non-IS data or facilitate risky commands if other controls fail or are bypassed.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The playbook explicitly directs use of MCP operations like list_tables and execute_sql as a 'Quick Path', which expands behavior beyond the stated skill scope of information-schema NL→SQL and even contradicts the manifest note 'NOT for ... listing tables via MCP'. Scope drift like this is dangerous because agents may follow the broader operational guidance instead of the manifest, resulting in unauthorized enumeration or ad-hoc data access paths.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file repeatedly recommends list_tables even though the skill description expressly says it is 'NOT for ... listing tables via MCP'. This contradiction can cause an agent to bypass intended SQL-only metadata patterns and perform broader table enumeration, which is especially risky in multi-project or tenant-level catalog contexts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The data transfer audit section encourages analysis of top downloads and client IP tracing without any caution about sensitive audit data handling, minimization, or authorization requirements. Because these queries can surface download activity and source IPs, omission of safety guidance raises the risk of unnecessary exposure of personal or security-sensitive telemetry.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This guidance introduces list_projects and list_schemas MCP operations that are not described in the skill metadata and broaden the skill into environment enumeration. In a metadata-access skill, undocumented project/schema discovery increases the chance of over-collection and access to tenant structure beyond the user's intended question.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This reference documents queries over highly sensitive metadata surfaces, including user identities, role assignments, privilege grants, client IPs, scheduler metadata, and raw job statements (operation_text), but it does not warn users that these views can expose security-relevant and potentially regulated information. In the context of an NL→SQL skill, omission of these cautions increases the chance that the agent will generate and return broad metadata queries that over-disclose internal access patterns, identities, and workload details to users who may not expect the sensitivity of the results.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest says the skill is not for listing tables via MCP, yet the script documents MCP tools such as list_tables and also implements tables/top-storage listing queries itself. This indicates the skill behavior includes direct table enumeration capabilities that are broader than the narrowly framed information-schema NL→SQL purpose and blur the declared boundary around table listing channels.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script forwards user-supplied custom SQL directly to odpscmd via a subprocess without any interactive warning, approval gate, or strong scope validation. In an agent context, that increases the chance of unintended execution of broad or sensitive queries, especially because the command is presented as a helper for metadata access but can issue more expansive reads.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The placeholder rules explicitly state that '' should be avoided due to incomplete data risk, yet the cost spike queries filter on both yesterday and today. This is an active contradiction between the file's own guidance and its example query behavior, which could mislead users performing causal analysis.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 66% confidence
Finding: Throughout the playbooks, intent signals are hard-coded in Chinese and English, but the document does not explain whether users may choose their preferred language or how locale handling works. This can create an implicit language policy without explicit user opt-in or documentation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.