Security audit

Kes Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill package is coherent database documentation, but it includes several under-scoped high-impact deployment instructions that users should review carefully before installing or following.

Install only if you are comfortable reviewing database administration runbooks before use. Do not copy the privileged Docker, firewall/SELinux, cron, password, trust-authentication, or remote-install commands into production as written; replace them with pinned downloads, least-privilege containers, locked service accounts, scoped firewall rules, protected secrets, and explicit backups/confirmations for destructive maintenance steps.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (9)

T03 · Remote Payload Retrieval and Execution

Error

Location: docker-installer/SKILL.md:147
Finding: Unverified Remote Binary Installed as a Privileged Executable
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: kes-mcp/SKILL.md:55
Finding: Unpinned Remote Repository Is Installed with Dependency and Build Hook Execution
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: docker-installer/SKILL.md:134
Finding: Docker Group Membership Grants Effective Root-Level Host Control
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: kes-ha/ref/rwc-cluster-deployment.md:77
Finding: HA Deployment Permanently Disables SELinux and the Host Firewall
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: kes-deploy/SKILL.md:66
Finding: Deployment Creates a Predictable Operating-System Account Password
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: kes-monitoring/ref/monitoring.md:554
Finding: Monitoring Jobs Execute Persistent Scripts as Root Without Demonstrated Need
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: kes-mcp/SKILL.md:79
Finding: Database Credentials Are Embedded in MCP Command Arguments and Project Configuration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: kes-security/ref/security-national-crypto.md:165
Finding: Cryptographic Private-Key PIN Is Stored Using Reversible Base64 Encoding
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: kes-monitoring/ref/monitoring.md:686
Finding: Monitoring Examples Store Plaintext Database Passwords and Recommend a Trust Fallback
Content: View full analysis
~/.pgpass chmod 600 ~/.pgpass # 2. Or use local trust in sys_hba.conf # local all alert_user trust ``` ### Technical Analysis The first option writes a reusable database password to a local plaintext file. Mode `0600` is appropriate after creation, but the shell command includes the password in command history and the file is initially created subject to the current `umask` before `chmod` is executed. The alternative `trust` rule removes password verification for matching local connections. Any local process able to select the matching database identity may authenticate without proving possession of a credential, depending on KingbaseES authentication semantics and surrounding rules. This is substantially broader than the needs of a monitoring script. ### Attack Path For the password-file path: 1. An administrator substitutes a real password into the command. 2. The command is retained in shell history or captured by terminal/audit logging. 3. An attacker obtains the history or reads the password file through a compromised account or backup. 4. The attacker authenticates as the monitoring user. For the trust path: 1. The administrator adds the documented `trust` entry. 2. An attacker first obtains local code execution on the database host. 3. The attacker requests a database connection as `alert_user` without a password. 4. The database accepts the connection under the trust rule. 5. The attacker gains all database privileges assigned to that user. ### Impact Assessment The immediate scope is the monitoring database account. If that account can read system activity, query text, configuration, or broad schemas, exploitation can disclose operation ...[truncated 98 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (303)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.en.md (reported line 193)May include surrounding context.
git clone https://gitee.com/your-org/kes-skills.git /tmp/kes-skills
&& mkdir -p .claude/skills
&& cp -r /tmp/kes-skills/kes-* /tmp/kes-skills/docker-installer .claude/skills/
&& rm -rf /tmp/kes-skills

text
## 使用方式

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 133)May include surrounding context.
git clone https://gitee.com/your-org/kes-skills.git /tmp/kes-skills
&& mkdir -p .claude/skills
&& cp -r /tmp/kes-skills/kes-* /tmp/kes-skills/docker-installer .claude/skills/
&& rm -rf /tmp/kes-skills

text
## 使用方式

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.en.md (reported line 193)May include surrounding context.
git clone https://gitee.com/your-org/kes-skills.git /tmp/kes-skills
&& mkdir -p .claude/skills
&& cp -r /tmp/kes-skills/kes-* /tmp/kes-skills/docker-installer .claude/skills/
&& rm -rf /tmp/kes-skills

text
## 使用方式

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 133)May include surrounding context.
git clone https://gitee.com/your-org/kes-skills.git /tmp/kes-skills
&& mkdir -p .claude/skills
&& cp -r /tmp/kes-skills/kes-* /tmp/kes-skills/docker-installer .claude/skills/
&& rm -rf /tmp/kes-skills

text
## 使用方式

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · README.en.md (reported line 193)May include surrounding context.
git clone https://gitee.com/your-org/kes-skills.git /tmp/kes-skills
&& mkdir -p .claude/skills
&& cp -r /tmp/kes-skills/kes-* /tmp/kes-skills/docker-installer .claude/skills/
&& rm -rf /tmp/kes-skills

text
## 使用方式

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · README.md (reported line 133)May include surrounding context.
git clone https://gitee.com/your-org/kes-skills.git /tmp/kes-skills
&& mkdir -p .claude/skills
&& cp -r /tmp/kes-skills/kes-* /tmp/kes-skills/docker-installer .claude/skills/
&& rm -rf /tmp/kes-skills

text
## 使用方式

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · docker-installer/SKILL.md (reported line 22)May include surrounding context.
md
# 设置存储库 sudo apt-get update sudo apt-get install -y ca-certificates curl gnupg sudo install -m 0755 -d /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg sudo chmod a+r /etc/apt/keyrings/docker.gpg

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · docker-installer/SKILL.md (reported line 23)May include surrounding context.
md
# 设置存储库 sudo apt-get update sudo apt-get install -y ca-certificates curl gnupg sudo install -m 0755 -d /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg sudo chmod a+r /etc/apt/keyrings/docker.gpg

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · docker-installer/SKILL.md (reported line 24)May include surrounding context.
md
# 设置存储库 sudo apt-get update sudo apt-get install -y ca-certificates curl gnupg sudo install -m 0755 -d /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg sudo chmod a+r /etc/apt/keyrings/docker.gpg

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · docker-installer/SKILL.md (reported line 27)May include surrounding context.
md
# 设置存储库 sudo apt-get update sudo apt-get install -y ca-certificates curl gnupg sudo install -m 0755 -d /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg sudo chmod a+r /etc/apt/keyrings/docker.gpg

Chaining Abuse

High

Category: Tool Misuse
Confidence: 86% confidence
Finding: Piping data fetched from the network directly into a privileged processor (curl ... | sudo gpg --dearmor) reduces the opportunity to inspect, validate, or recover safely from tampering. Although the source is Docker's official key endpoint, the one-liner pattern is risky because it normalizes trust-on-first-use with elevated execution in a reusable skill.
Content: Scanner excerpt · docker-installer/SKILL.md (reported line 23)May include surrounding context.
md
sudo apt-get update sudo apt-get install -y ca-certificates curl gnupg sudo install -m 0755 -d /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg sudo chmod a+r /etc/apt/keyrings/docker.gpg echo \

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation includes hardcoded database credentials in example connection strings (SYSTEM:123456), which normalizes insecure practices and can lead users to copy secrets directly into source code. Even if presented as sample data, embedded credentials in reference material are dangerous because they are often reused, committed to repositories, or deployed unchanged.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · kes-app-builder/ref/project-layout-python.md (reported line 77)May include surrounding context.
debug: bool = False

text
class Config: env_file = ".env"

settings = Settings()

text

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The password-reset workflow instructs users to switch local authentication to trust mode, which disables password verification for matching connections. Without strong warnings and strict procedural safeguards, this can allow anyone with local access, or anyone matching a broader-than-intended rule, to connect as privileged users and fully compromise the database during the window of exposure.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The skill includes a forceful recursive deletion command against a system path during uninstall. In an agent context, destructive shell snippets are dangerous because variable substitution mistakes, copied commands, or path confusion can lead to permanent deletion of software, configuration, and possibly adjacent data.
Content: Scanner excerpt · kes-deploy/SKILL.md (reported line 311)May include surrounding context.
bash
systemctl stop kingbase $KINGBASE_HOME/Uninstaller/uninstall.sh sudo rm -rf /opt/Kingbase/ES/V9 sudo userdel -r kingbase

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The skill includes a forceful recursive deletion command against a system path during uninstall. In an agent context, destructive shell snippets are dangerous because variable substitution mistakes, copied commands, or path confusion can lead to permanent deletion of software, configuration, and possibly adjacent data.
Content: Scanner excerpt · kes-deploy/SKILL.md (reported line 311)May include surrounding context.
bash
systemctl stop kingbase $KINGBASE_HOME/Uninstaller/uninstall.sh sudo rm -rf /opt/Kingbase/ES/V9 sudo userdel -r kingbase

Privileged Container / Container Escape

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: Using --privileged grants the container broad kernel capabilities, device access, and weakened confinement, materially increasing the risk of host compromise if the database process, image contents, or attached tooling are exploited. In a copy-paste deployment skill, this is a real operational security issue, not just theoretical hardening advice.
Content: Scanner excerpt · kes-docker/SKILL.md (reported line 39)May include surrounding context.
快速启动

bash
docker run -d --privileged \ -p 4321:54321 \ -v /opt/kingbase/data:/home/kingbase/userdata/ \ --restart=always \

Privileged Kubernetes Workload

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: privileged: true grants the container broad access to the host, substantially weakening container isolation and making a container compromise far more damaging. In a public deployment example with no justification or warning, this can cause users to run a database service with unnecessary host-level privileges, increasing the risk of breakout or destructive host access.
Content: Scanner excerpt · kes-docker/ref/docker-compose-examples.md (reported line 12)May include surrounding context.
md
kingbase: image: kingbase:v1 container_name: kingbase privileged: true restart: always ports: - "4321:54321"

Privileged Kubernetes Workload

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The primary database example is configured as a privileged container, unnecessarily exposing the host if the database or image is compromised. Since replication setups are often deployed in more sensitive environments, documenting this as a default can propagate a high-risk configuration into production clusters or servers.
Content: Scanner excerpt · kes-docker/ref/docker-compose-examples.md (reported line 36)May include surrounding context.
md
kingbase-primary: image: kingbase:v1 container_name: kingbase-primary privileged: true restart: always ports: - "4321:54321"

Privileged Kubernetes Workload

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Using privileged: true for the standby node gives an additional database instance extensive host access, compounding the attack surface in a replicated deployment. A compromise of either node could potentially lead to host-level actions, lateral movement, or tampering with persistent data beyond the container boundary.
Content: Scanner excerpt · kes-docker/ref/docker-compose-examples.md (reported line 52)May include surrounding context.
md
kingbase-standby: image: kingbase:v1 container_name: kingbase-standby privileged: true restart: always ports: - "4322:54321"

Privileged Kubernetes Workload

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The external-network example still enables full privileged mode, which is especially risky because the service is intentionally network-connected and may be more reachable by adjacent systems. Combining elevated host privileges with network exposure increases the potential impact of remote exploitation.
Content: Scanner excerpt · kes-docker/ref/docker-compose-examples.md (reported line 77)May include surrounding context.
md
kingbase: image: kingbase:v1 container_name: kingbase privileged: true restart: always networks: - db-network

Privileged Kubernetes Workload

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The shared-database example encourages multiple applications to depend on a database container running with full host privileges, so a compromise through the database tier could affect the host and all dependent services. This is more dangerous in this context because multi-application environments tend to broaden trust boundaries and increase the chance of lateral movement.
Content: Scanner excerpt · kes-docker/ref/docker-compose-examples.md (reported line 109)May include surrounding context.
md
kingbase: image: kingbase:v1 container_name: kingbase privileged: true restart: always ports: - "4321:54321"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The documented command rm -rf $KINGBASE_HOME/data/* is dangerous because it performs recursive deletion based on an environment variable, and if that variable is empty, incorrect, or manipulated, it can wipe unintended files or a live database directory. In an operational runbook for HA recovery, users are especially likely to execute such commands quickly under outage pressure, increasing the chance of catastrophic destruction.
Content: Scanner excerpt · kes-ha/ref/high-availability.md (reported line 356)May include surrounding context.
md
systemctl stop kingbase # 2. 清空数据目录 rm -rf $KINGBASE_HOME/data/* # 3. 从新主库做基础备份 sys_basebackup -h new_primary -p 54321 -U krc_user -D $KINGBASE_HOME/data

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The command 'rm -rf $KINGBASE_HOME/data/*' is a classic high-risk destructive operation whose safety depends entirely on correct variable expansion and operator context. In a cluster deployment and maintenance guide, this becomes more dangerous because it is presented as a routine node removal step, increasing the chance of copy-paste misuse, accidental path mistakes, or wiping active data.
Content: Scanner excerpt · kes-ha/ref/rwc-cluster-deployment.md (reported line 405)May include surrounding context.
systemctl stop kingbase

3. 清理数据（可选）

rm -rf $KINGBASE_HOME/data/*

text
### 节点维护

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · kes-hibernate/ref/activiti-config.md (reported line 32)May include surrounding context.
xml
<dependencies>  <dependency> <groupId>org.activiti</groupId> <artifactId>activiti-spring-boot-starter</artifactId>

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.exposed_secret_literal

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: kes-deploy/SKILL.md:311

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: kes-ha/ref/high-availability.md:43

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T03 · Remote Payload Retrieval and Execution

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Chaining Abuse

Chaining Abuse

Credential Access

Credential Access

Credential Access

Credential Access

Chaining Abuse

Missing User Warnings

Credential Access

Missing User Warnings

Tool Parameter Abuse

Tool Parameter Abuse

Privileged Container / Container Escape

快速启动

Privileged Kubernetes Workload

Privileged Kubernetes Workload

Privileged Kubernetes Workload

Privileged Kubernetes Workload

Privileged Kubernetes Workload

Tool Parameter Abuse

Tool Parameter Abuse

3. 清理数据（可选）

Hidden Instructions

Static analysis

Documentation contains a destructive delete command without an explicit confirmation gate.

File appears to expose a hardcoded API secret or token.