Security audit

Hologres Cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Hologres CLI guide, but it should be reviewed carefully because it installs external code and enables broad database, cloud storage, credential, AI, and local file actions.

Install only in an isolated environment and prefer a pinned, verified hologres-cli release. Treat this skill as capable of reading and changing production databases, exporting data to local files, uploading local files to OSS/AI services, storing credentials locally, and opening downloaded files with local applications. Use least-privilege, short-lived credentials, keep masking enabled unless explicitly needed, and require human review before writes, truncates, drops, GUC changes, model registration, file upload/download, or volume view.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Third-Party Package Installation
Content: View full analysis
Remediation: View remediation
``` Install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Explicitly identify the trusted package index and avoid silently inheriting untrusted pip configuration. 5. Document package provenance, release signing, and the process used to audit new versions. 6. Run installation in an isolated virtual environment under a non-privileged account. 7. Include or cryptographically bind the tested CLI implementation to the Skill release so the reviewed documentation and executable package cannot drift independently. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/ai-volume-model.md:286
Finding: Cloud Credentials Passed Through Command-Line Arguments and Stored in Local JSON Configuration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a production Hologres CLI skill with database and management capabilities. The supplied code chunk instead contains only testing fixtures for validating documentation and accessing reference files. Its primary purpose is test support: reading SKILL.md, parsing frontmatter, splitting markdown sections, and preparing import paths. Because the actual behavior is materially different from the declared operational CLI/database purpose, this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents an operational Hologres CLI skill that performs database-facing tasks such as SQL execution, schema inspection, data import/export, dynamic table management, and GUC parameter handling. However, the provided code chunk does none of those things. Instead, it is a pytest test file focused on validating whether project documentation covers CLI commands, error codes, output formats, masking patterns, safety features, and best practices. Its primary purpose is documentation/test quality assurance, not database interaction or CLI execution. This is a material mismatch in purpose and behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear mismatch between the declared description and the actual code chunk. The description claims a Hologres CLI for operational database tasks with guardrails and JSON output. However, the code only contains unit tests for documentation structure and content in SKILL.md and reference markdown files. It does not connect to Hologres, parse or run CLI commands, handle SQL, manage schemas/tables, enforce runtime safety guardrails, or emit structured JSON responses. Its primary function is repository/documentation validation, which is materially different from the declared purpose.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.
md
| [commands.md](references/commands.md) | Complete command reference with DT commands |

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · references/commands.md (reported line 1145)May include surrounding context.
Example:

bash
hologres guc reset statement_timeout hologres guc reset optimizer_join_order

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · references/safety-features.md (reported line 217)May include surrounding context.
md
## Dynamic Table Drop Safety

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger list includes broad terms like dynamic table, hologres database, and GUC parameter, which can match general user requests beyond this specific skill. In an agent environment, overbroad activation raises the chance that the skill is selected inappropriately for unrelated tasks, potentially leading to unintended database actions or exposure of operational capabilities.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is presented as a database CLI, but the documented command surface includes unrelated AI text/image/video generation and external model registration features. This widens the operational scope significantly and can cause agents to invoke networked or content-generation actions that a user did not reasonably expect from a database tool, increasing the risk of misuse and unintended data exposure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The volume view command downloads a file to a temporary directory and opens it with the system viewer, which crosses from database administration into local file handling and external application execution. In an agent setting, opening attacker-controlled or untrusted files via the host viewer can trigger unwanted code paths, data leakage to helper apps, or unsafe user-environment interactions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description embeds a long trigger list with several generic phrases such as "dynamic table," "hologres database," and "GUC parameter," which can cause the skill to activate in contexts broader than intended. Because this skill can perform database operations and SQL execution, unintended activation could route unrelated user requests into a capability with access to sensitive data or state-changing operations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes the skill as a Hologres CLI for database operations, schema inspection, SQL execution, data import/export, Dynamic Table lifecycle management, and GUC parameter management. This file documents substantial additional capabilities for AI text/image/video generation, OSS volume management, and external AI model registry operations, which materially broaden the skill’s behavior beyond the stated scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation permits local files to be supplied as --reference-url/--img-url and uploaded via --upload-volume, but it does not clearly warn that local content will be transmitted to OSS and then potentially to external AI generation services. In an AI-agent setting, this can lead to inadvertent exfiltration of sensitive local files or user data through seemingly routine media-generation commands.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/ai-volume-model.md (reported line 96)May include surrounding context.
md
| `--negative-prompt` | Negative prompt, max 500 chars | | `--size` | Output image size, e.g. `1280*720` | | `-n` | Number of images to generate (1-6) | | `--prompt-extend` | Enable/disable prompt rewriting (`true`/`false`) | | `--watermark` | Add watermark to image (`true`/`false`) | | `--seed` | Random seed [0, 2147483647] | | `--reference-url` | Reference image URL (`volume://vol/path`, `oss://path`, or local file path). Repeatable for multiple images |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The volume create examples show credential-bearing flags such as --access-key, --access-secret, and API-related secrets directly on the command line without strong warnings. Command-line secrets are commonly exposed via shell history, process listings, logs, screenshots, or agent telemetry, creating a significant credential leakage risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented volume view command downloads remote content to a local temp directory and opens it with the system default viewer (open, xdg-open, os.startfile). In an agent context, this crosses from database/file management into local code or handler invocation, which can trigger risky applications, unexpected protocol handlers, or unsafe processing of untrusted files on the host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The reference documents setting sensitive configuration values such as access keys and passwords but does not warn about secure handling, storage exposure, or least-privilege usage. In an AI-agent-facing CLI, this increases the chance that operators or agents will place secrets into commands, logs, screenshots, shell history, or insecure local config files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Documenting a --no-mask option without a privacy warning normalizes disabling sensitive-data masking and may cause full records or regulated fields to be exposed in agent output, logs, or downstream tools. Because this CLI is explicitly designed for AI-agent use and structured output, unmasked data may be propagated broadly and retained unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The export examples show writing table/query results to local files without warning that exported CSVs may contain sensitive records and become harder to govern than database-resident data. In an agent context, automated exports can create uncontrolled copies on disk, in shared workspaces, or in artifact storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The --truncate import option performs destructive pre-load clearing but is documented without an explicit data-loss warning or confirmation safeguard. Users or agents may misread it as a routine import flag and irreversibly erase table contents before loading replacement data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The audit logging feature explicitly stores commands and SQL statements in a local history file, but the documentation does not warn users that queries may contain sensitive literals, identifiers, or operational details that will persist on disk. In a database CLI context, this increases the risk of credential leakage, PII exposure, or forensic recovery of sensitive query contents from local files, backups, or shared workstations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The manifest and intro at L004-L005 and L011 present the CLI as having safety guardrails, but later documentation shows users can disable row-limit masking protections with flags like --no-limit-check and --no-mask (L286-L288, L334). While not a direct contradiction in implementation details, this does create an intent-level tension between the strong safety framing and the documented ability to bypass protections.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The guide documents persistent database-level GUC changes via ALTER DATABASE without warning that they affect future sessions and can alter performance, reliability, or security posture across workloads. An agent or operator may treat these as low-risk tuning commands when they are actually configuration changes with shared blast radius.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The reset command is presented as a simple operation without clarifying that it persistently changes database behavior by removing an override and reverting future sessions to defaults. In production, resets can unexpectedly re-enable risky defaults or disable required safeguards/performance settings.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.