Hologres Uv Compute

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:11 AM UTC
• Version: 0.2.0

Overview

This skill is documentation for building Hologres UV/PV bitmap pipelines, with database-write examples that fit its stated purpose but should be used carefully.

Before installing or using this skill, install hologres-cli in a virtual environment, prefer a pinned reviewed version, use least-privilege Hologres credentials, and test the CREATE, REFRESH, and OVERWRITE examples outside production before applying them to real data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Executable Python Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–17
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

markdown

This skill requires **hologres-cli** to be installed first:

```bash
pip install hologres-cli
export HOLOGRES_SKILL=hologres-uv-compute

text

### Technical Analysis

The installation instruction resolves and installs the current release of `hologres-cli` from the Python package index configured in the user's environment. It does not pin a reviewed version, verify package hashes, specify a trusted package index, or otherwise validate provenance.

Python packages may execute package-controlled code during installation or whenever their installed commands and modules are used. Consequently, the effective code executed by this prerequisite can change after the Skill has been reviewed. This creates exposure to package repository compromise, maintainer compromise, dependency confusion caused by index configuration, and malicious or unexpectedly unsafe future releases.

The audit did not establish that `hologres-cli` is currently malicious. The confirmed issue is the unsafe, non-reproducible dependency installation practice.

### Attack Path

1. An attacker publishes or introduces a malicious version of `hologres-cli` through compromise of its distribution channel, maintainer account, or a higher-priority package index configured in the environment.
2. A user or agent follows the prerequisite and runs `pip install hologres-cli`.
3. `pip` resolves the attacker-controlled or compromised release because no exact version, hash, or trusted index is enforced.
4. Package-controlled code executes during installation or subsequent invocation of the Hologres CLI.
5. The malicious dependency operates with the privileges of the installing user or agent and may access resources available to that process.

### Impact Assessment

Su
...[truncated 662 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin hologres-cli to an exact, reviewed version rather than installing the latest available release:

   bash

   python -m pip install "hologres-cli==REVIEWED_VERSION"
   

2. Distribute a hash-locked requirements file and require hash verification:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Document and explicitly configure the authoritative trusted package index. Avoid relying on unspecified user-level or global index configuration.
4. Verify package provenance and integrity before approving upgrades. Review release signatures, publisher identity, source repository, and transitive dependencies where available.
5. Install and execute the CLI in an isolated virtual environment or container under a least-privileged account.
6. Ensure database credentials supplied to the CLI have only the permissions needed for the documented table, extension, query, and refresh operations.
7. Introduce a controlled dependency-update process that reruns security review and tests before changing the pinned version or hashes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to run hologres sql run --write and create/refresh tables without an explicit warning that these operations modify database state. In a documentation-driven agent workflow, users may assume examples are read-only and could unintentionally create, alter, or refresh production objects, causing data integrity or operational issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file includes examples for checking whether a specific user ID is present in a bitmap and converting a bitmap back into an array of user IDs. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or privacy; these examples discuss user-level data operations without any caution about privacy or access controls.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.