Aliyun Codeup

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:18 AM UTC
• Version: 1.0.0

Overview

This Codeup helper appears purpose-built for read-only repository queries, but its token handling could expose a personal access token during normal use.

Review this skill before installing. Use only a least-privileged, short-lived Codeup token, and be aware that the current implementation may expose that token in local process listings or Git error output. Prefer a version that uses API headers or a safer Git credential mechanism and avoids token-bearing command-line URLs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: codeup_cli.py:47

Finding

Personal Access Token Exposed in Git Command-Line Arguments

Content

View full analysis

.git" ``` `SKILL.md:143-146` duplicates the vulnerable implementation: ```python git_url = f"https://oauth2:{token}@codeup.aliyun.com/{project_path}.git" subprocess.run( ['git', 'clone', '--quiet', '--depth=1', git_url, repo_path], ``` ### Technical Analysis The personal access token is interpolated directly into an HTTPS repository URL and passed to `git clone` as a command-line argument. Although `subprocess.run` uses an argument list and is therefore not directly vulnerable to shell command injection, the resulting Git process contains the complete credential-bearing URL in its argument vector. Depending on operating-system process visibility controls, other local users, privileged monitoring agents, audit systems, crash reporters, or process telemetry collectors may be able to observe and retain the command line. The documented shell examples also expand the token before starting Git and may expose it through shell tracing, command auditing, or other terminal instrumentation. The exception handler returns Git's stderr without credential reda ...[truncated 1716 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (18)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The documented workflow chains repository operations with cleanup commands, including rm -rf, creating a pattern that can magnify mistakes and make destructive actions occur automatically after prior steps. In agent or copy-paste usage, command chaining reduces opportunities to validate paths and state before deletion, increasing the chance of unintended file removal.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

临时克隆查询

git clone --quiet "https://oauth2:$[e-mail]/.git" cd && git branch -a cd /tmp && rm -rf

text

**优点：**

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This example explicitly performs cd /tmp && rm -rf data-admin-api before cloning, normalizing a destructive pattern that depends on current directory and exact path assumptions. If reused with modified variables or in a different context, it can delete unintended local content and is especially risky when executed by automation.

Content

Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.

执行：

bash

cd /tmp && rm -rf data-admin-api
git clone --quiet "https://oauth2:$[e-mail]/flashexpress/ard/be/tools/data-admin-api.git"
cd data-admin-api && git branch -a | grep -v HEAD | sed 's/remotes\/origin\///' | sort
cd /tmp && rm -rf data-admin-api

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The post-operation cd /tmp && rm -rf data-admin-api repeats the same destructive chaining pattern, encouraging automatic deletion without an explicit safety check. In agent workflows, such examples can be parameterized or generalized in unsafe ways, turning a benign cleanup into accidental data loss.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

cd /tmp && rm -rf data-admin-api git clone --quiet "https://oauth2:$[e-mail]/flashexpress/ard/be/tools/data-admin-api.git" cd data-admin-api && git branch -a | grep -v HEAD | sed 's/remotes/origin///' | sort cd /tmp && rm -rf data-admin-api

text

**输出：**

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes sensitive capabilities including environment-variable access, network access, and shell commands, but does not declare any explicit tool scope or permissions boundary. In an agent setting, this weakens reviewability and least-privilege controls, making it easier for the skill to access secrets and execute external commands without clear authorization constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation includes recursive deletion commands (rm -rf) as part of the normal workflow without prominently warning about local data-loss risk. Users or agents adapting the example could delete unintended directories if variables, paths, or working-directory assumptions differ.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill presents itself as a repository metadata query tool but actually performs a full local clone of the target repository. This mismatch increases risk because users may not expect disk writes, network transfer of full repository contents, or execution of local git tooling against untrusted repositories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Embedding the personal access token in the git URL creates a clear secret-exposure risk, especially since the tool gives no user-facing warning and may surface stderr from failed git operations. Tokens in URLs are historically prone to leakage through process lists, logs, shell history, diagnostics, and upstream tooling behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 77% confidence

Finding

Cloning an attacker-controlled repository causes the local git client to process untrusted remote content and metadata, which expands the attack surface beyond the stated metadata-query purpose. While this code avoids shell injection, invoking git on arbitrary repositories can expose the host to credential handling issues, resource exhaustion, and any client-side git/protocol weaknesses present in the environment.

Content

Scanner excerpt · codeup_cli.py (reported line 49)May include surrounding context.

python

# 克隆仓库（获取所有分支信息）
        git_url = f"https://oauth2:{token}@codeup.aliyun.com/{project_path}.git"
        print(f"📥 正在克隆项目 {repo_name}...")
        subprocess.run(
            ['git', 'clone', '--quiet', '--no-tags', git_url, repo_path],
            check=True,
            capture_output=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Executing local git subprocesses is a stronger capability than necessary for listing branches, commits, or stats, and it processes attacker-influenced repository data on the user's machine. In this skill context, that unnecessary capability expansion raises the danger because a simple query tool should not need to clone and inspect repositories locally.

Content

No source excerpt is available for this finding.

Tainted flow: 'git_url' from os.getenv (line 47, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 90% confidence

Finding

The personal access token is embedded directly into the clone URL and then passed to git, which can leak credentials via process inspection, logs, error output, crash reports, or git configuration side effects. Because the tool accepts arbitrary project URLs and clones them locally, the skill context makes this more dangerous than a normal metadata query utility.

Content

Scanner excerpt · codeup_cli.py (reported line 49)May include surrounding context.

python

# 克隆仓库（获取所有分支信息）
        git_url = f"https://oauth2:{token}@codeup.aliyun.com/{project_path}.git"
        print(f"📥 正在克隆项目 {repo_name}...")
        subprocess.run(
            ['git', 'clone', '--quiet', '--no-tags', git_url, repo_path],
            check=True,
            capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · codeup_cli.py (reported line 83)May include surrounding context.

python

def query_branches(repo_path, repo_name):
    """查询分支列表"""
    # 获取所有分支
    result = subprocess.run(
        ['git', 'branch', '-a', '--sort=-committerdate'],
        cwd=repo_path,
        capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · codeup_cli.py (reported line 120)May include surrounding context.

python

def query_commits(repo_path, repo_name):
    """查询最近提交"""
    result = subprocess.run(
        ['git', 'log', '--oneline', '-20', '--all'],
        cwd=repo_path,
        capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · codeup_cli.py (reported line 148)May include surrounding context.

python

def query_stats(repo_path, repo_name):
    """查询仓库统计"""
    # 分支数
    result = subprocess.run(
        ['git', 'branch', '-a'],
        cwd=repo_path,
        capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · codeup_cli.py (reported line 158)May include surrounding context.

python

branch_count = len([l for l in result.stdout.strip().split('\n') if l.strip() and 'HEAD' not in l])
    
    # 提交数
    result = subprocess.run(
        ['git', 'rev-list', '--count', '--all'],
        cwd=repo_path,
        capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · codeup_cli.py (reported line 168)May include surrounding context.

python

commit_count = int(result.stdout.strip())
    
    # 贡献者数
    result = subprocess.run(
        ['git', 'log', '--format=%aN', '--all'],
        cwd=repo_path,
        capture_output=True,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

文件标题及全文说明均以中文呈现，未说明这是面向特定中文用户群体的区域性技能，也未提供其他语言或用户选择。这可能构成对语言使用的隐性强制，属于自然语言层面的 locale/语言策略问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill description, headings, examples, and CLI output are entirely in Chinese, which effectively imposes a specific language/locale on users without stating that the skill is Chinese-only or offering alternatives. Under the policy, language constraints should be opt-in or clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Docstrings and all user-facing CLI messages are written only in Chinese, with no option to select another language. This is a natural-language locale constraint that is not presented as opt-in and has no documented region-specific justification in the file.

Content

No source excerpt is available for this finding.