alibabacloud-polardbx-ops

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:56 AM UTC
• Version: 0.0.1

Overview

This is a real PolarDB-X administration skill, but it can make broad, disruptive cloud database changes and some safety guardrails are incomplete.

Install only if you intend to let the agent administer Alibaba Cloud PolarDB-X. Use a narrowly scoped RAM role or instance-specific policy instead of Resource "*", require explicit confirmation before any create/delete/restart/upgrade/parameter/security/account action, do not put real passwords in chat or command history, verify the Aliyun CLI installer out of band, and treat slow logs and binlog links as sensitive data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The manifest frames the skill as routine instance lifecycle management, but the body expands into much broader administrative powers including account, backup, security, migration, and compliance operations. This scope expansion can cause over-privileged invocation and surprise users into authorizing sensitive actions they did not expect from the trigger surface.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The advertised triggers are instance-oriented, yet the routing table enables privileged operations such as password resets, privilege modification, and security/IP whitelist changes. A user invoking an apparently routine instance skill could unintentionally reach credential-affecting or network-changing workflows, increasing risk of misuse or prompt-routing abuse.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The document explicitly forbids literal password arguments, but later examples in the same skill include password flags populated inline, creating contradictory guidance. In an agent skill context, examples are likely to be copied verbatim into generated commands, which can expose secrets via shell history, logs, process lists, transcripts, or saved scripts.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The documented `update-custins-param` operation expands this file from tag/resource-group management into generic instance parameter mutation, which can change runtime behavior of a PolarDB-X instance. In an agent skill, undocumented or weakly scoped mutation capability increases the chance that a user request about tags or organization could trigger broader configuration changes with operational or security consequences.

Intent-Code Divergence

Low

• Confidence: 78% confidence
• Finding: The description claims the command updates an instance tag/parameter, but the command name and arguments indicate a generic name/value parameter update. This mismatch can mislead an operator or agent into treating the action as harmless metadata editing when it may actually modify instance configuration, increasing risk of unintended service changes.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill supports destructive actions such as delete and restart but does not require an explicit confirmation or impact warning at the top-level contract. In an agentic environment, missing confirmation safeguards can lead to accidental service disruption or irreversible deletion from ambiguous or rushed user requests.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide instructs users to execute a remote installer via `curl ... | bash`, which runs downloaded code immediately without inspection, integrity verification, or provenance checks. If the CDN, script source, network path, or DNS resolution were compromised, this could lead to arbitrary code execution on the host running the skill prerequisites.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: CreateStoragePool changes storage configuration but, unlike the cold-data volume operations in the same file, it lacks a required user warning or secondary confirmation. In an agentic workflow, this inconsistency increases the chance of unintended infrastructure changes, misconfiguration, or cost-impacting actions being executed from an ambiguous or mistaken user request.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The restart operation is documented as a routine command without any required user warning or confirmation step, even though restarting a database instance can cause immediate service interruption and application impact. In an agent skill that may translate user intent directly into CLI actions, omission of a disruption warning increases the chance of accidental production downtime.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The kernel upgrade operation lacks a warning about possible service disruption, compatibility risk, and the need for explicit approval, despite being a state-changing operation that can affect availability or behavior. In this skill context, an agent could initiate an upgrade on a production database with insufficient friction, leading to outages or unintended changes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The slow log section documents how to retrieve slow SQL records but does not warn that responses may contain raw SQL text, database names, node identifiers, and other operational metadata. In an agent skill context, this omission can lead users or downstream tooling to request, display, store, or share sensitive query data without appropriate caution, increasing the risk of information disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The binlog listing section states that download links are valid for 2 days but does not warn that those links may enable access to highly sensitive database change data, potentially including inserted, updated, or deleted records. In a lifecycle/operations skill, exposing or casually handling such links can result in broad confidentiality impact because binlogs may contain a large volume of business data and change history.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This section documents a state-changing administrative operation that alters the maintenance window for PolarDB-X instances, but unlike other risky operations in the same file, it does not require secondary confirmation or explicitly warn about operational consequences. An agent following this guidance could change maintenance timing without a deliberate user re-check, increasing the chance of accidental service disruption or maintenance occurring at an unsafe time.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation provides a configuration-modification command that can change live PolarDB-X instance behavior without any warning about operational risk, rollback planning, or validation requirements. In an agent skill context, this increases the chance that an automated system or user will apply unsafe changes directly to production, causing outages, degraded consistency, or unexpected service behavior.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The parameter modification section documents direct mutation of compute/storage parameters using arbitrary JSON key-value input, but it does not warn about the risk of destabilizing the database, affecting durability/performance, or causing user-impacting incidents. Because this skill is intended for operational lifecycle management, the absence of guardrails makes unsafe automation more likely and more dangerous than in purely reference-only material.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: This example shows password-bearing CLI flags directly in the command, despite earlier security guidance saying never to do so. Even placeholder literals normalize unsafe usage and may cause the agent or operator to substitute real credentials inline, leaking them to logs, telemetry, terminal history, and process inspection.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The DBA password is shown as a direct CLI argument, which is unsafe because users and automation frequently replace placeholders with real secrets inline. In this skill, which is designed to perform privileged operational changes on PolarDB-X, that pattern is especially risky because credentials for administrative roles are highly sensitive and likely to be handled by the agent.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.