huawei-cloud-mrs-hetu-sql-check
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The checker script
scripts/hetu_sql_checker.pyaccepts a file path as its first argument and reads the contents of the file if it exists on the local filesystem. This capability allows an agent to read sensitive files (such as.envor credentials) if a user or an indirect prompt injection provides the corresponding path, potentially leading to data exposure. - [COMMAND_EXECUTION]: Workflow instructions in
SKILL.mdguide the agent to execute shell commands with user-supplied SQL text. This pattern is vulnerable to command injection if the input contains shell metacharacters and the agent does not properly escape them. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted SQL input and processes it using scripts with file-access capabilities, creating an attack surface for indirect injection.
- Ingestion points: The
sql_textparameter inscripts/hetu_sql_checker.pyand other scripts. - Boundary markers: None identified in the instructions or code.
- Capability inventory: Local file reading via
os.path.isfileandopen().read(). - Sanitization: The skill does not perform any sanitization of the SQL text to prevent prompt injection before processing it.
Audit Metadata