byted-bytehouse-mcp

该技能整体目的与能力基本一致：连接 ByteHouse、查询数据、生成资产目录和血缘。主要风险不在恶意行为，而在安装与执行信任边界：技能会从官方但可变的 GitHub `@main` 分支动态拉起 MCP Server，并把数据库凭证及可能的其他环境变量转发给该外部进程；另有本地 `eval` 解析配置文件的脚本风险。未见非官方中转域名、明显凭证窃取或隐藏外传，因此更适合判定为 SUSPICIOUS 而非 MALICIOUS。

The fragment is a readable MCP client with no direct evidence of malware, but it creates a significant supply-chain and credential-exposure risk by executing code fetched from a mutable GitHub main branch and forwarding all environment variables to it. Use a trusted, reviewed, immutable commit or package version, restrict the subprocess environment, and allowlist permitted tools.

代码是一个 ByteHouse MCP Server 测试客户端，但存在显著供应链和凭据暴露风险：它从 GitHub 可变 main 分支实时下载并执行代码，并将完整环境变量传给该代码。自动调用第一个 MCP 工具还可能产生未预期的数据库副作用。未发现本片段中明确的恶意载荷或直接数据外传证据；应固定可信 commit/hash，仅传递必要环境变量，并在调用工具前进行白名单和副作用确认。

代码是一个用于启动 ByteHouse MCP Server 的服务脚本，未发现本身包含凭据窃取、数据外传、反向 shell 或破坏性操作。主要安全问题是通过 uvx 直接执行 GitHub main 分支的未固定远程代码，并将数据库凭据环境变量暴露给该代码，因此存在中等供应链风险。

The fragment is an MCP database-query client, not demonstrably malware. It has meaningful supply-chain and credential-exposure risks because it executes code fetched from an unpinned GitHub main branch and passes the complete environment to that code. It also prints database results and is syntactically incomplete due to the missing SQL assignment. Pin and verify the dependency, pass only required environment variables, review the MCP server implementation, and avoid logging sensitive results.

The fragment is a database-inspection client and does not itself demonstrate malware or data exfiltration. It has a meaningful supply-chain and credential-exposure risk because it downloads and executes the mutable GitHub main branch through uvx and passes the complete environment to it. Pin the repository to a reviewed commit or trusted release, restrict the environment, and review the MCP server before execution.

This module is security-sensitive because it turns external JSON file content into shell code and executes it using eval. Even with jq @sh applied to values, the JSON keys are not validated as safe shell identifiers, leaving a potential command-injection vector if an attacker can modify ~/.bytehouse_config.json (or otherwise influence its contents). No explicit malware (exfiltration/persistence/backdoors) is visible in the provided fragment, but the eval-based design is a significant risk that warrants review and likely replacement with a safer non-eval approach (e.g., strict key validation and direct environment assignment).