Alibabacloud Odps Information Schema

• Outcome: Review
• Latest audit: May 28, 2026 · 7:55 AM UTC
• Version: 0.0.1

Overview

This skill is mostly a legitimate MaxCompute metadata helper, but it documents broader SQL and write-operation paths that conflict with its stated read-only Information Schema scope.

Install only for users who are authorized to inspect MaxCompute tenant metadata. Use least-privilege read-only credentials, avoid the custom SQL path unless broader SELECT execution is intended, and treat returned metadata such as privileges, identities, IPs, task history, and project settings as sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill’s top-level scope says it must not be used for DDL/DML, but the execution-channel table explicitly says odpscmd is for DDL/DML. That contradiction can cause an agent to route destructive or out-of-scope requests through this skill, expanding it from metadata-only querying into state-changing database operations.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The inline documentation gives conflicting instructions about whether odpscmd may be used for DDL/DML, creating policy ambiguity for downstream agents. In an agentic setting, ambiguous routing is dangerous because the model may choose the more permissive interpretation and perform unintended write or destructive actions under the authority of the user’s environment.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The reference instructs the agent to use `list_tables` to confirm Information Schema view existence, but the skill metadata explicitly states the skill is not for listing tables via MCP. This creates a scope-violation path where an agent may invoke an unintended capability, potentially expanding metadata enumeration beyond the skill's allowed purpose and bypassing the intended NL→SQL-only constraint.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The documentation instructs users to call MCP operations (`list_tables`, `get_table_schema`) even though the skill metadata explicitly states the skill is not for listing tables via MCP. This creates a capability-boundary violation: an agent following this file may invoke tools outside the intended scope, potentially exposing additional metadata and bypassing the skill's documented restrictions.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The reference explicitly documents write-capable operations (`create_table`, `insert_values`) inside a skill whose stated scope is read-only Information Schema querying. That broadens the effective capability boundary and can cause an agent to perform schema or data modifications when a user or prompt steers toward those tools, violating least privilege and the skill’s own contract.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The routing matrix maps natural-language requests for creating tables and inserting data to mutating tools even though the skill metadata says it is not for DDL/DML. In an agent setting, routing guidance is effectively policy, so this can directly induce unauthorized or unexpected write actions.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: Advertising a `custom 'SELECT ...'` CLI path expands the skill from constrained metadata workflows to arbitrary SQL execution. Even if examples imply read-only use, arbitrary SQL greatly weakens the boundary of an Information Schema-only skill and increases the chance of querying unintended data sets or enabling unsafe follow-on behavior through fallback paths.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Cross-project metadata search is broader than the stated purpose of querying Information Schema metadata views and can facilitate discovery across projects beyond the user’s expected scope. While not inherently a direct exploit, it increases reconnaissance capability and may expose sensitive naming or inventory information if permissions are overly broad.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: Identity and permission inspection via `check_access` exceeds pure Information Schema querying and can disclose account characteristics, grants, and default project context. In a security-sensitive environment, such introspection can aid privilege mapping and reconnaissance, especially when invoked without a clear user need.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The playbook explicitly instructs use of MCP inventory operations like `list_tables`, `list_projects`, and `list_schemas`, which expands the skill beyond its declared scope of information-schema querying. This creates a capability mismatch that can cause the agent to perform broader metadata discovery than users or policy expect, increasing the chance of unauthorized enumeration or policy bypass through prompt routing.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: These playbooks introduce configuration-audit and settings-inspection scenarios that are not clearly covered by the skill description, which says the skill is for information-schema metadata views and not general MaxCompute questions or broader operations. Scope expansion of this kind is dangerous because it can expose sensitive administrative metadata and cause the agent to answer requests outside the reviewed security boundary.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The project configuration audit playbook specifically targets sensitive settings such as backup retention, IP whitelists, and SQL cost limits. Exposing or encouraging inspection of security-relevant configuration that is not declared in the manifest materially raises risk, because it can leak defensive posture and infrastructure policy details useful for reconnaissance or misconfiguration discovery.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The terminology file documents MCP-based metadata browsing and cost-estimation capabilities that the skill manifest explicitly says are out of scope. This creates scope drift: an agent using this reference may invoke tools or answer requests beyond the skill’s declared safety boundary, enabling unintended metadata enumeration or extra execution paths.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The documentation explicitly says table/metadata browsing can be done through MCP even though the skill description says listing tables via MCP is not supported. That contradiction can directly mislead an agent into performing prohibited metadata discovery actions, weakening user expectations and any policy boundary based on the manifest.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The script explicitly exposes a generic `custom <sql>` mode even though the skill is described as metadata-only and not for ad-hoc SQL. That mismatch expands the tool from a constrained information-schema helper into a general SQL execution surface, enabling misuse and weakening any policy assumptions upstream systems may rely on.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The comments frame this script as a fallback channel for MCP SQL execution tools, which broadens its operational role beyond the declared skill scope. In practice, this encourages callers or agents to treat it as a general execution path, increasing the chance of unauthorized or out-of-scope queries against the backend.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The `custom` branch accepts caller-controlled SQL and only blocks a small set of leading DDL/DML keywords plus `SELECT *`, which is insufficient to constrain behavior safely. An attacker can still run arbitrary read queries, query non-information-schema objects, or potentially bypass simplistic regex checks with formatting or alternative statements, causing data exposure well outside the skill's metadata-only purpose.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The routing matrix uses broad natural-language triggers and includes actions outside the declared scope, which makes prompt-based misrouting more likely. In agent systems, ambiguous routing guidance can be exploited by user phrasing to reach higher-risk tools or workflows that should have been excluded.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation describes schema- and data-modifying capabilities without a clear warning that they change persistent state. In a skill advertised as metadata-only, the absence of a strong modification warning increases the chance of accidental destructive or unauthorized actions by agents or users relying on the docs.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: Broad, everyday trigger phrases increase the chance that normal user language will match a playbook unintentionally, causing the agent to run a more powerful diagnostic workflow than the user intended. In a metadata and audit context, accidental triggering can lead to unnecessary access to operational or permission data and weakens the precision of authorization-by-intent.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Using a generic trigger like "monitoring" for the real-time task monitoring playbook is overly permissive and can activate live operational visibility features from vague requests. Because the playbook accesses current task state and resource usage, ambiguous invocation can expose active workload details that are more sensitive than ordinary schema metadata.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation explicitly enables querying highly sensitive metadata, including users, roles, privileges, owner identities, IP whitelist settings, client IPs, role ARNs, and detailed job/tunnel history, but provides no guardrails, least-privilege guidance, or privacy warning. In a skill whose purpose is NL→SQL generation, this materially increases the risk that an agent will help enumerate security posture and identity data that can support reconnaissance, privilege mapping, or data exfiltration planning.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.