Security audit

Byted Bytehouse Load Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This ByteHouse load analyzer has a coherent purpose, but it downloads mutable remote code at runtime with the full environment and saves potentially sensitive query details locally.

Review before installing. Use only in an environment where ByteHouse credentials are low-privilege and where unrelated secrets are not present in the process environment. Prefer a version pinned to an immutable, reviewed MCP server source and a ByteHouse-only environment allowlist, and treat generated reports as sensitive because they may contain table names, operational metadata, and active SQL text.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/load_analyzer.py:43
Finding: Mutable Remote Code Is Downloaded and Executed with Inherited Credentials<![CDATA[ ## Vulnerability Details **File Location**: `scripts/load_analyzer.py`, lines 43–54 **Vulnerability Type**: Remote payload retrieval through a mutable dependency source **Risk Level**: High ### Vulnerable Code ```python # 从环境变量获取配置 env = os.environ.copy() # MCP Server参数 server_params = StdioServerParameters( command='/root/.local/bin/uvx', args=[ '--from', 'git+https://github.com/volcengine/mcp-server@main#subdirectory=server/mcp_server_bytehouse', 'mcp_bytehouse', '-t', 'stdio' ], env=env ) ``` ### Technical Analysis The script instructs `uvx` to retrieve and execute the ByteHouse MCP server directly from the mutable `main` branch of an external Git repository. Because the source is not pinned to an immutable commit hash or verified artifact, the effective code executed by the Skill can change after the Skill itself has been audited. The subprocess also receives `os.environ.copy()`, which exposes the complete parent process environment—not only the required ByteHouse connection variables. This may include `BYTEHOUSE_PASSWORD`, cloud credentials, API tokens, CI/CD secrets, or other unrelated sensitive values. The issue does not establish that the current upstream repository is malicious. The vulnerability arises because future upstream changes or repository compromise can alter locally executed code without any corresponding change to this project. ### Attack Path 1. An attacker compromises the upstream repository, its maintainers, or the referenced `main` branch. 2. The attacker modifies the MCP server code referenced by the Git URL. 3. A user invokes the load analyzer. 4. `uvx` retrieves and executes the modified remote code. 5. The remote code reads inherited environment variables, including ByteHouse credentials and potentially unrelated secrets. 6. The malicious process can use those credentials locally or transmit them using available network access. ### Impact Assessment Succes ...[truncated 475 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the remote MCP server to an audited immutable commit hash rather than `main`. 2. Prefer a versioned, integrity-verified package or a locally vendored and reviewed dependency. 3. Use package hashes, signed releases, or another integrity-verification mechanism. 4. Do not resolve executable dependencies dynamically during normal Skill execution. 5. Replace `os.environ.copy()` with an explicit allowlist containing only required variables, for example: - `BYTEHOUSE_HOST` - `BYTEHOUSE_PORT` - `BYTEHOUSE_USER` - `BYTEHOUSE_PASSWORD` - `BYTEHOUSE_SECURE` - `BYTEHOUSE_VERIFY` 6. Run the MCP server under a restricted account or sandbox with minimal filesystem and network permissions. 7. Pin the inline `mcp>=1.0.0` dependency to a reviewed version and lock its transitive dependencies. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/load_analyzer.py:163
Finding: Sensitive Active SQL Is Persisted in a Plaintext Report<![CDATA[ ## Vulnerability Details **File Location**: `scripts/load_analyzer.py`, lines 163–181 and 251–259 **Vulnerability Type**: Plaintext persistence of potentially sensitive query contents **Risk Level**: Medium ### Vulnerable Code Query collection: ```python # 4. 获取当前正在执行的查询 print("\n4️⃣ 获取当前正在执行的查询...") try: sql = """ SELECT query_id, query, elapsed, read_rows, read_bytes FROM system.processes LIMIT 10 """ result = await session.call_tool("run_select_query", {"query": sql}) current_queries_data = [] for content in result.content: if content.type == 'text': current_queries_data = content.text analysis["query_load"]["current_queries"] = current_queries_data ``` Report persistence: ```python # 保存分析结果 output_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), "output") os.makedirs(output_dir, exist_ok=True) timestamp = datetime.now().strftime("%Y%m%d_%H%M%S") output_file = os.path.join(output_dir, f"load_analysis_{timestamp}.json") with open(output_file, "w", encoding="utf-8") as f: json.dump(analysis, f, ensure_ascii=False, indent=2) ``` ### Technical Analysis The `system.processes` query retrieves the complete SQL text of active queries through the `query` column. The returned value is inserted into the analysis object and then written to a persistent JSON file. SQL statements can contain credentials, access tokens, personal information, customer identifiers, confidential predicates, or literal business data. The report file is created using the process's default permission behavior and no explicit restrictive mode is applied. The implementation also defines no retention period, deletion policy, encryption, or query-redaction mechanism. Capturing complete query text is not required to calculate aggregate load metrics such as elapsed time, rows read, bytes read, or concurrency. ### Attack Pat ...[truncated 1059 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `query` column from the `system.processes` query unless full SQL text is strictly necessary. 2. Retain only non-sensitive metrics such as query ID, elapsed time, rows read, and bytes read. 3. If query text is required, redact string literals, comments, credentials, tokens, and other sensitive values before persistence. 4. Create report files with owner-only permissions such as mode `0600`. 5. Store reports in a dedicated directory with restrictive permissions such as mode `0700`. 6. Define and enforce a report retention and secure-deletion policy. 7. Avoid including these reports in logs, backups, build artifacts, or support bundles without additional sanitization. 8. Consider encryption at rest where reports must retain potentially sensitive diagnostic information. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Env Variable Harvesting

High

Category: Data Exfiltration
Content: print() # 从环境变量获取配置 env = os.environ.copy() # MCP Server参数 server_params = StdioServerParameters(
Confidence: 99% confidence
Finding: `os.environ.copy()` forwards the entire process environment to the spawned MCP server, not just the ByteHouse variables needed for operation. Because that server is fetched from a remote GitHub source at runtime, this can leak unrelated secrets such as API keys, tokens, proxy credentials, or cloud environment variables to untrusted code.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill documentation is written entirely in Chinese, including headings, instructions, and usage guidance, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific audience. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents capabilities that access environment variables, interact with an MCP server, and write output files, but it does not declare any tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls and can cause the agent to invoke broader capabilities than a user would reasonably expect when the skill is activated.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation conditions are broad enough to trigger on ordinary discussion of performance, load, or throughput, not just explicit requests to run cluster analysis. In a skill that can access infrastructure and write reports, over-broad invocation increases the chance of unintended execution against real systems or unnecessary collection of operational data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation states that multiple JSON reports will be written to disk, but it does not warn the user about filesystem modification or obtain consent first. Silent file creation can surprise users, overwrite artifacts, leak sensitive operational metadata into local storage, or fill shared workspaces with monitoring outputs.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script launches an MCP server directly from a remote GitHub source at runtime using `uvx --from git+https://github.com/...@main`, which introduces a supply-chain and arbitrary code execution risk. Pinning to `@main` is especially dangerous because the executed code can change over time without review, and it receives the full copied environment including secrets.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script executes an externally fetched tool from GitHub without prominently warning the user that remote code will be downloaded and run. This removes informed consent for a high-risk behavior and increases the chance that users expose their systems and ByteHouse credentials to unreviewed third-party code.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The natural-language content appears to force a single language for all user-facing documentation and invocation guidance. Under the stated policy, this is a language/locale constraint unless the skill offers user choice or clearly documents that it is intended only for a specific locale or audience.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The module docstring and all user-visible console output are in Chinese, with no indication that users can select another language. This can violate language/locale policy when a skill imposes a specific language without opt-in or documented regional scope.

Description-Behavior Mismatch

Low

Confidence: 85% confidence
Finding: The manifest describes the skill as a ByteHouse load analysis and performance monitoring tool, which implies collecting and analyzing cluster metrics. At L258-L266, the code additionally creates a local output directory and persists the analysis as a JSON file, a side effect not reflected in the manifest's read/monitoring-oriented description.

Static analysis

No suspicious patterns detected.