Security audit

Byted Bytehouse Data Asset Analyzer

Security checks across malware telemetry and agentic risk

Overview

This skill does the advertised ByteHouse schema analysis, but it should be reviewed because it runs unpinned remote code with the full environment and writes sensitive database metadata to disk.

Install only if you trust the Volcengine MCP repository and are comfortable with ByteHouse schema metadata being saved locally. Use a read-only ByteHouse account, keep the environment limited to the required BYTEHOUSE_* variables, avoid shared or synced output directories, and delete generated JSON reports when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Low

Confidence: 88% confidence
Finding: The script silently persists full schema metadata and CREATE TABLE statements to local disk by default, which can expose sensitive internal structure, business logic, naming conventions, and embedded comments to other local users, backups, or downstream tooling. In data-platform contexts, schema metadata is often sensitive even when row data is not.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README tells users to place ByteHouse credentials, including the password, into shell environment variables but provides no guidance on safe secret handling, redaction, or use of a dedicated secret manager. In a database-analysis skill, this increases the chance of credential leakage through shell history, process inspection, logs, screenshots, or accidental persistence in shared environments.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger conditions include broad terms such as '数据资产', '血缘分析', '表结构', and '字段分析', which may cause the skill to activate in conversations where the user did not intend database introspection or metadata export. In this context, over-broad activation increases the chance of unnecessary access to ByteHouse metadata and accidental disclosure through generated artifacts.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly states it exports complete schema, catalog, and lineage reports to local JSON files, but it does not warn that these files may contain sensitive metadata such as table names, column names, comments, engine details, and CREATE TABLE statements. Even without row-level data, this metadata can materially aid reconnaissance, expose business context, and persist sensitive information on disk beyond the session.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Writing schema and lineage artifacts to local JSON files without a clear warning or consent creates a confidentiality risk because database metadata may be captured in readable files, logs, sync folders, or backups. Users may believe the tool only analyzes data transiently, while it actually leaves persistent artifacts on disk.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script launches an external process that pulls and runs code directly from a remote GitHub repository at runtime, creating a supply-chain and arbitrary-code-execution risk. Because it also passes environment variables into that process, any compromise of the remote source or dependency path could expose secrets and database credentials.

VirusTotal

39/39 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.