aliyun-oss-upload

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:09 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Alibaba Cloud OSS upload helper, with expected cloud-transfer and credential risks that users should understand before use.

Install only if you intend to send chosen files to Alibaba Cloud OSS. Use a private bucket, short-lived signed URLs, least-privileged AccessKeys, and an HTTPS Aliyun OSS endpoint you verify yourself; avoid uploading sensitive files unless sharing through OSS is intended.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:25-29; references/config.md:65-68
Vulnerability Type: Unpinned dependency and insufficient package integrity controls
Risk Level: Medium

Vulnerable Code

SKILL.md:25-29:

bash

pip install oss2

references/config.md:65-68:

bash

pip install oss2

Technical Analysis

The installation instructions retrieve the latest available oss2 package without specifying a reviewed version or verifying an integrity hash. Consequently, the installed code can change independently of this project's reviewed contents.

If the package distribution channel, package publisher account, or a future release is compromised, installation can execute attacker-controlled package code. Python package installation may execute build-system components, while malicious runtime code could execute when oss2 is imported by scripts/oss-upload.py.

Attack Path

1. An attacker compromises the upstream package, publisher account, or another relevant dependency-distribution component.
2. A user follows the documented pip install oss2 command.
3. pip resolves and installs the attacker-controlled or compromised release because no version or hash is enforced.
4. Malicious code executes during installation or when the upload script imports oss2.
5. The code can access the user's process privileges, local files available to that user, and OSS credentials exported into the environment.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running pip or the upload script. The exposed scope may include local files, the four configured OSS environment variables, and OSS operations permitted by the associated AccessKey policy.

Remediation

View remediation

Remediation Suggestions

• Pin oss2 to a specifically reviewed version in a dependency manifest.
• Generate and commit a lock file that includes transitive dependency versions.
• Require verified package hashes, for example through pip install --require-hashes -r requirements.txt.
• Install packages only from an explicitly configured, trusted package index.
• Periodically scan pinned packages for known vulnerabilities and update them through a controlled review process.
• Run dependency installation and the upload utility under a minimally privileged account.
• Avoid exposing broad OSS credentials to package installation processes; use temporary, narrowly scoped credentials where possible.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/oss-upload.py:29

Finding

Unvalidated OSS Endpoint Allows Plaintext or Attacker-Controlled Destinations

Content

View full analysis

Vulnerability Details

File Location: scripts/oss-upload.py:29-34
Vulnerability Type: Insufficient validation of a security-sensitive network endpoint
Risk Level: Medium

Vulnerable Code

python

access_key_id = get_env_or_raise('ALIYUN_OSS_ACCESS_KEY_ID')
access_key_secret = get_env_or_raise('ALIYUN_OSS_ACCESS_KEY_SECRET')
endpoint = get_env_or_raise('ALIYUN_OSS_ENDPOINT')
bucket_name = get_env_or_raise('ALIYUN_OSS_BUCKET')

auth = oss2.Auth(access_key_id, access_key_secret)
bucket = oss2.Bucket(auth, endpoint, bucket_name)

Technical Analysis

The value of ALIYUN_OSS_ENDPOINT is passed directly to the OSS SDK without validating its URL scheme, hostname, port, embedded credentials, or relationship to an approved Aliyun OSS endpoint.

A plaintext http:// endpoint can expose uploaded data and signed request metadata to network observers. An attacker-controlled HTTPS endpoint can directly receive the selected file and authenticated request metadata. Although the AccessKey secret is used for request signing rather than normally being transmitted directly, authorization material and the AccessKey identifier may still be exposed to the destination.

Exploitation requires the attacker to influence the environment or configuration used to launch the utility. The documented examples use HTTPS Aliyun endpoints, but the executable code does not enforce that security property.

Attack Path

1. An attacker, compromised wrapper script, or unsafe deployment configuration changes ALIYUN_OSS_ENDPOINT to an attacker-controlled hostname or a plaintext HTTP endpoint.
2. The user invokes the upload command with a local file.
3. get_oss_bucket() constructs the SDK client using the unvalidated endpoint.
4. put_object_from_file() sends the selected file and authenticated request to that endpoint.
5. The attacker receives the uploaded content and associated request metadata; with HTTP, an on-pat ...[truncated 462 chars]

Remediation

View remediation

Remediation Suggestions

• Parse the configured endpoint with a standard URL parser before constructing the OSS client.
• Require the https scheme and reject plaintext HTTP.
• Reject URLs containing embedded credentials, fragments, unexpected paths, or unapproved ports.
• Restrict hostnames to approved Aliyun OSS endpoint patterns or, preferably, an explicit deployment-specific allowlist.
• Normalize the hostname before validation and account for case, trailing dots, internationalized names, and deceptive suffixes.
• Fail closed with a clear error when endpoint validation fails.
• Consider displaying the validated destination before sensitive uploads.
• Use narrowly scoped, temporary OSS credentials so that exposure of request metadata has limited value.
• Add tests covering HTTP endpoints, lookalike domains, embedded credentials, malformed URLs, and unexpected ports.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documents use of sensitive environment variables for OSS access but does not declare any tool scope or permission boundary in the skill metadata. This increases the risk that an agent or user invokes the skill without clear visibility that credentialed operations and external network access are involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to upload local files to Alibaba Cloud OSS and generate signed shareable links, but it does not prominently warn that this sends local data off-host to a third-party cloud service. Users may inadvertently expose sensitive files or distribute temporary access URLs without understanding the data-transfer and sharing implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code uploads a local file to Alibaba Cloud OSS and then automatically generates a temporary access URL, which can expose user data outside the local system. Although the script prints success messages, it does not provide any explicit warning or confirmation that local content will be transmitted to a remote cloud service and made accessible via a signed link.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The natural-language instructions and description are entirely in Chinese, and the file does not indicate that the skill is region- or locale-specific or provide an opt-in language choice. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file is entirely in Chinese and does not indicate that the skill is region-specific or provide an alternative language option. Under the policy rules, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's docstrings, CLI description, help text, and runtime messages are all written in Chinese, which effectively forces a specific language for users. There is no opt-in, alternative locale support, or documented justification for a Chinese-only interface.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.