Alibabacloud Polardbx Sql

• Outcome: Review
• Latest audit: May 29, 2026 · 9:34 PM UTC
• Version: 0.0.2

Overview

The skill is mostly a PolarDB-X SQL guidance skill, but it also includes unrelated Alibaba Cloud CLI credential and account-administration guidance that expands access beyond the stated SQL-design purpose.

Review this skill before installing. It is not malicious on the artifacts inspected and it contains no executable code, but users should avoid giving an agent Alibaba Cloud account keys or running Aliyun CLI setup from this SQL-focused skill unless they intentionally need that separate cloud-admin capability. Treat all DDL, partition changes, TTL cleanup, and EXPLAIN ANALYZE-style commands as production-impacting operations that require backups, staging validation, and explicit confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: This reference file is materially unrelated to the declared PolarDB-X SQL design skill and expands the skill's scope into Alibaba Cloud CLI installation, authentication, and account administration. In an agent context, this kind of scope drift is dangerous because it can cause the agent to solicit, handle, or persist cloud credentials and perform privileged cloud operations that are unnecessary for SQL design tasks.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The documentation introduces broad cloud administration capabilities such as credential configuration, profile management, RAM role usage, plugin installation, and region/account operations that are not justified by a SQL-focused skill. In practice this increases blast radius: a user invoking a database design skill could be steered into granting cloud account access or enabling actions far beyond query writing and schema design.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guide recommends `aliyun configure get` and nearby debug commands without warning that configuration output or debug logs may expose sensitive values, profile names, endpoints, or credential source details in terminals, transcripts, or CI logs. In an agent-assisted environment, this can lead to inadvertent secret disclosure through captured output.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide promotes non-interactive command-line credential entry and environment-variable exports without warning that secrets may be exposed in shell history, process listings, CI job logs, or agent traces. Because this skill is not supposed to handle cloud administration, encouraging direct secret entry materially increases the chance of credential leakage.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document includes operationally destructive partition-management commands such as DROP PARTITION, SPLIT/MERGE, and MOVE PARTITIONS without surrounding cautions about data deletion, service impact, redistribution cost, locking, or rollback planning. In a database administration skill, users may copy these examples directly into production, which can cause irreversible data loss or availability/performance incidents even though the content appears instructional rather than malicious.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document states that `EXPLAIN ANALYZE_EXECUTE` actually executes SQL, but it does not clearly warn users not to use it with mutating statements such as INSERT, UPDATE, DELETE, DDL, or procedures with side effects. In a database tuning skill, users may copy examples or generalize the command to arbitrary SQL, which can lead to unintended data changes or destructive operations in production while believing they are performing a safe diagnostic action.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.