huawei-cloud-mrs-hive-sql-check
Warn
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The instructions in
SKILL.mdrecommend that the agent execute local Python scripts by interpolating raw user input into a shell command:python ~/.cac/skills/huawei-cloud-mrs-hive-sql-check/scripts/hive_sql_checker.py "<sql_text>" all. Because the user-controlled<sql_text>is placed directly inside a double-quoted string within a shell command, an attacker can escape the quotes using shell metacharacters (e.g.,;,&,|,`) to execute arbitrary commands on the host system. - [SAFE]: The underlying Python scripts (
hive_sql_checker.py,hive_sql_parser.py,hive_sql_tokenizer.py) perform static SQL analysis only. They do not import network-capable libraries likerequestsorurllib, and they do not attempt to connect to external databases or services. - [SAFE]: No hardcoded credentials, API keys, or secrets were found within the skill's scripts or configuration files. The tool is designed for offline validation.
Audit Metadata