The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple scripts, including hive_dive_thrift.py, generate_paimon_statements.py, and main_metastore_changes.py, use the subprocess module to execute system commands such as hive, hadoop, mysql, and rclone to interact with big data environments. These inputs are dynamically constructed from Metastore metadata.
[CREDENTIALS_UNSAFE]: The shell script hive_dive.sh passes database passwords via the -p command-line flag, exposing them to the process list. Additionally, generate_rclone_script.py creates a script (sync_commands.sh) containing plaintext cloud storage credentials, and config_manager.py stores database passwords in plaintext profiles within the user's home directory (~/.hive_explore/profiles).
[PROMPT_INJECTION]: The skill ingests table names and metadata from the Hive Metastore and uses them in shell commands without sanitization, creating a potential surface for indirect command injection.
Ingestion points: Metastore database and HMS Thrift API.
Boundary markers: None identified.
Capability inventory: subprocess.run, subprocess.check_output, subprocess.check_call across several scripts.
Sanitization: None identified.

alibabacloud-migration-lhm-inspect-hive-metastore