azure-hdinsight-migration-hbase-to-fabric-cosmosdb
Fail
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The assessment phase contains a shell pipeline that pipes the output of a
curlrequest directly topython3. While the Python logic is provided as a command-line argument, this execution flow is a high-risk pattern typically used for remote code execution. - [COMMAND_EXECUTION]: The shell scripts in the assessment section iterate over table names and inject them into subsequent shell commands (e.g.,
hdfs dfs -duandhbase shell). This creates a command injection surface if table names in the source environment are attacker-controlled. - [EXTERNAL_DOWNLOADS]: The skill performs several network requests using
curlto retrieve cluster metadata from Azure HDInsight APIs and operational statistics from local JMX endpoints. - [DATA_EXFILTRATION]: The skill automates the collection of sensitive infrastructure metadata, including cluster configurations, full table inventories, region server load statistics, and actual sample data. This information is saved to local files (
cluster_meta.json,sample_data.txt, etc.), representing a significant data exposure risk if run in a sensitive production environment.
Recommendations
- HIGH: Downloads and executes remote code from: http://$(hostname):16010/jmx - DO NOT USE without thorough review
Audit Metadata