ClawHub
Back to skill

Security audit

Byted Bytehouse Hybrid Search

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed ByteHouse hybrid-search helper that uses database and embedding-service credentials for its stated purpose, with privacy and least-privilege precautions needed.

Install only if you intend to connect an agent to ByteHouse and the Ark embedding API. Use least-privilege database credentials, verify the embedding endpoint, avoid sending confidential or regulated text unless your policy allows it, and require confirmation before creating tables or inserting/updating documents.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documentation requires access to environment variables containing database credentials and an external API key, but no permissions are declared. This creates a transparency and governance gap: an agent or platform may expose secrets or allow capability use that users and reviewers were not explicitly informed about.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The declared purpose emphasizes search, but the documented behavior also includes external embedding API calls, table creation/index management, and document insertion/update operations. This mismatch is risky because users may invoke what appears to be a read-oriented retrieval skill while unintentionally permitting outbound data transfer and write-side database changes.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
Document title and content are concatenated and sent to the embedding component without any visible consent, disclosure, or data-classification guard. If TextEmbedding uses a remote model endpoint, sensitive document contents may be exfiltrated to an external service, creating privacy, compliance, or data-handling risks.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
Batch processing sends multiple titles and contents for embedding generation, which can amplify data exposure because large volumes of potentially sensitive records may be transmitted externally in one operation. The absence of explicit notice and controls increases the chance of unintentional leakage of proprietary or regulated data.

Missing User Warnings

Low
Confidence
78% confidence
Finding
Search queries are embedded before vector search, so user-entered queries may be transmitted to an external embedding backend. While queries are usually less sensitive than full documents, they can still contain secrets, PII, or internal investigative terms, making silent transmission a privacy risk.

Static analysis

No suspicious patterns detected.