huawei-cloud-mrs-spark-sql-check
Fail
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The workflow defined in
SKILL.mdinstructs the agent to execute shell commands where user-provided input (sql_text) is directly interpolated into the command line string (e.g.,python ~/.cac/skills/.../spark_sql_tokenizer.py "<sql_text>"). An attacker can provide a SQL statement containing shell metacharacters such as;,&&, or`to execute arbitrary commands on the local system with the agent's privileges. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests untrusted data (
sql_text) and processes it to generate reports containing 'Fix Suggestions'. A malicious input could be crafted to include instructions that the agent might follow when reviewing the generated report. - Ingestion points: The
sql_textparameter in theSKILL.mdworkflow steps 2, 3, and 6. - Boundary markers: None. The instructions use double quotes for interpolation, which are insufficient to prevent shell injection or instruction leakage.
- Capability inventory: The skill has the capability to execute shell commands via the
pythonCLI and write output to the agent's context. - Sanitization: There is no evidence of sanitization or escaping of the user-provided SQL text before it is used to construct shell commands.
Recommendations
- AI detected serious security threats
Audit Metadata