ALab Skills

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:20 AM UTC
• Version: 0.1.9

Overview

This is a coherent ALab workflow skill with disclosed admin/project/worker powers, but users should handle its CLI install and launcher command prefix carefully.

Install in an isolated environment, pin or review the alab-cli version where reproducibility matters, keep root/admin/worktree credentials separated as documented, and only use launcher command prefixes from trusted launchers. Confirm destructive admin actions and project submissions before running them.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned ALab CLI Installation from a Mutable Package Registry

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:12-16
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

sh

Install it from PyPI:

```sh
python -m pip install alab-cli
alab help

text

The equivalent installation guidance also appears in `SKILL_cn.md:12-16`.

### Technical Analysis

The Skill instructs users to install `alab-cli` from PyPI without specifying a reviewed version or verifying an integrity hash. Consequently, the package resolved at installation time can differ from the package that existed when this Skill was audited.

Python packages can execute code during installation or when their console entry points and imported modules are used. If the package publisher account, release process, or registry distribution channel is compromised, a malicious future release could execute with the operating-system privileges of the user running `pip` or `alab`.

Installing the CLI is relevant to the Skill's declared functionality, but allowing an unrestricted latest release is broader and less reproducible than necessary.

### Attack Path

1. An attacker compromises the `alab-cli` publishing account, build pipeline, or another part of its package distribution channel.
2. The attacker publishes a malicious release under the expected package name.
3. A user or agent follows the Skill and runs `python -m pip install alab-cli`.
4. PyPI resolves the unpinned command to the malicious release.
5. Malicious behavior executes during installation or when the user invokes `alab help` or later ALab commands.
6. The package can access files, environment variables, credentials, and network resources available to the invoking user.

This finding does not establish that the current PyPI package is malicious; it identifies the absence of controls against a mutable or compromised future release.

### Impact Assessment

Successful exploitation could provide
...[truncated 345 chars]

Remediation

View remediation

Remediation Suggestions

• Pin alab-cli to a specifically reviewed version, for example alab-cli==X.Y.Z.
• Publish and verify expected package hashes using a requirements file and pip install --require-hashes.
• Record the trusted publisher, package index, reviewed version, and expected digest in the installation documentation.
• Prefer an isolated virtual environment rather than installation into a privileged or system-wide Python environment.
• Use a controlled internal mirror or signed release process where operational requirements permit.
• Require explicit review before updating the pinned package version.
• Add equivalent protections to both SKILL.md and SKILL_cn.md so the installation instructions remain synchronized.

T07 · Tool Hijacking and Spoofing

Warning

• Location: alab-experiment-worker/references/commands.md:3

Finding

Unvalidated Launcher-Controlled ALab Command Prefix

Content

View full analysis

Vulnerability Details

File Location: alab-experiment-worker/references/commands.md:3-5
Vulnerability Type: Externally controlled tool substitution
Risk Level: Medium

Vulnerable Code

text

## Invocation Prefix

Command snippets below use `alab`. If the launcher provides `ALAB_CMD_PREFIX`, invoke ALab through that prefix exactly as instructed instead of hard-coding `alab`. Do not print, inspect, or rewrite launcher-provided credential material. Use only the current worktree's token context; do not accept root keys, project admin keys, or tokens for other worktrees.

Equivalent guidance is present in the corresponding Chinese command reference.

Technical Analysis

The Skill tells the worker to replace the expected alab executable with the contents of a launcher-controlled ALAB_CMD_PREFIX and to use that prefix without inspection. It does not require the value to be an absolute executable path, validate executable ownership or integrity, restrict shell metacharacters, or define an argument-safe representation.

A compromised or incorrectly configured launcher can therefore supply a wrapper or substitute executable that appears to implement ALab while executing attacker-controlled behavior. If the prefix is interpolated into a shell command, shell syntax in the value may also create a command-injection path. Even when no shell is involved, a malicious wrapper can impersonate ALab, return fabricated output, and execute with the worker process's permissions.

The project-controller guidance correctly requires removal of root and project administrator credentials before worker launch. This reduces the maximum privilege available to a malicious prefix, but it does not protect the current worktree token, writable candidate source, visible experiment evidence, or the worker's run and submission authority.

Attack Path

1. An attacker compromises the launcher configuration or another source capable of s ...[truncated 1499 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the free-form prefix with a structured launcher setting containing an absolute executable path and a separately represented argument array.
• Do not evaluate or interpolate the value through a shell.
• Reject shell metacharacters, command substitutions, redirections, pipelines, and unexpected additional commands.
• Verify that the executable is owned by a trusted account and is not writable by untrusted users.
• Where feasible, verify the executable against an approved hash, signature, or immutable installation path.
• Resolve symbolic links and reject paths outside approved ALab installation directories.
• Document exactly which fixed wrapper forms are permitted and fail closed when validation cannot be completed.
• Preserve the existing requirement to clear root keys, project administrator keys, and unrelated tokens before worker launch.
• Run worker processes with restricted filesystem and network access so compromise of the allowed executable cannot reach unrelated credentials or project state.
• Apply the same validation requirements to both language variants of the command reference.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

- `SKILL.md`: This top-level ALab skill guide and subskill router.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

- `SKILL.md`: This top-level ALab skill guide and subskill router.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

- `SKILL.md`: This top-level ALab skill guide and subskill router.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

- `SKILL.md`: This top-level ALab skill guide and subskill router.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file description and all user-facing guidance are presented entirely in Chinese, and L48 explicitly identifies this as the Chinese version of the skill. There is no indication in this file that the user can choose language or that the Chinese-only presentation is required for a region-specific or compliance reason.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The default prompt authorizes a broad sequence of actions: inspect prior evidence, modify the current experiment worktree, run evaluations, and submit results whenever a passed run appears to support it. Because it lacks explicit trigger conditions, approval boundaries, and constraints on when submission is allowed, the agent could act implicitly in situations where human confirmation or narrower scoping is expected, increasing the risk of unintended code changes or premature submission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file explicitly identifies itself as the synchronized Chinese version, and the overall skill content is written in Chinese without any indication that the user can choose another language or locale. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The default prompt uses broad phrasing ('initialize or maintain an ALab home, manage root-level resources') that can cause the admin skill to be invoked for loosely related tasks. Because this is a high-privilege global admin skill and implicit invocation is enabled, accidental routing into this skill increases the chance of unnecessary exposure of root-level capabilities and least-privilege violations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · alab-global-admin/references/commands.md (reported line 83)May include surrounding context.

md

Notes: Root/admin may inspect project credentials; does not render raw admin keys.
- **`key revoke`**: Revoke a credential by id.
  Parameters: Required `<key_id>`; optional `--project <project_id>`.
  Notes: Root-only for revocation; do not revoke the wrong active key without checking audit and scope.
- **`context show`**: Inspect path context markers and registered ALab paths.
  Parameters: Optional `--path <dir>`; default `.`.
  Notes: Use before repair or when a command is running in an unexpected project/experiment/inspection context.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This file presents the skill description and operational instructions entirely in Chinese, which effectively imposes a language/locale choice on users reading or relying on this skill variant. The content does not state that Chinese is optional, user-selected, or limited to a region-specific context, so it can conflict with a policy requiring language choice or opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The agent skill enables allow_implicit_invocation without any visible constraints on when the controller may be auto-invoked. Because this is a top-level project controller that can create experiments and launch worker sessions, unintended activation could cause the agent to take orchestration actions in broader contexts than the user explicitly requested, increasing the risk of prompt-triggered misuse or overreach.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file contains user-facing operational instructions exclusively in Chinese, including command explanations, warnings, and workflow guidance. Because it does not offer an alternative language or indicate that the locale restriction is optional or region-specific, it may violate a language/locale policy requiring user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.