Alibaba Cloud AI Misc Crawl And Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:02 PM UTC
• Version: 1.0.3

Overview

The skill is mostly a disclosed Alibaba Cloud model-list workflow, but it asks agents to run an unpinned third-party `npx` package and overstates its skill-generation behavior.

Review before installing. If used, pin and review the crawler package version, run it in a workspace without secrets or broad filesystem access, and treat the advertised skill-regeneration claim cautiously because the included script currently produces a coverage report rather than generating skills.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 19
Vulnerability Type: Supply-chain risk caused by unpinned remote package execution
Risk Level: Medium

Vulnerable Code:

bash

npx -y @just-every/crawl \"https://help.aliyun.com/zh/model-studio/models\" > alicloud-model-studio-models.md

Technical Analysis

The documented workflow invokes npx with the package name @just-every/crawl but does not specify an exact, reviewed version. It also provides no lockfile, package checksum, or other integrity-verification mechanism. Consequently, the code executed by this command can change after the Skill has been audited.

The -y option automatically accepts installation prompts, allowing the resolved package to be downloaded and executed without an explicit user confirmation step. This creates a supply-chain trust boundary: control of the package registry entry or its publication credentials can translate directly into local code execution when a user follows the workflow.

Attack Path

1. An attacker compromises the package publisher account, package registry entry, or another relevant dependency-distribution mechanism.
2. The attacker publishes a malicious version that can be selected by the unversioned package reference.
3. A user follows the workflow in SKILL.md.
4. npx -y resolves and downloads the attacker-controlled package version without interactive confirmation.
5. The malicious package executes with the operating-system identity and permissions of the user running the command.

Impact Assessment

A malicious resolved package could execute arbitrary code with the invoking user's privileges. The potential scope includes reading or modifying files accessible to that user, accessing environment variables and locally available credentials, making network requests, altering generated project artifacts, and compromising the working repository. This workflow does not itself request el ...[truncated 154 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version, for example:

   bash

   npx --yes @just-every/crawl@<reviewed-exact-version> "https://help.aliyun.com/zh/model-studio/models" > alicloud-model-studio-models.md
   

2. Record dependency resolution in a committed lockfile and install dependencies with a lockfile-enforcing command such as npm ci.
3. Verify package integrity through the package manager's integrity metadata or a separately maintained trusted checksum.
4. Review the pinned package and its transitive dependencies before updating the version.
5. Remove automatic confirmation suppression where practical so unexpected installation behavior remains visible.
6. Run the crawler in a restricted environment with minimal filesystem access, no unnecessary credentials, and constrained network permissions.
7. Establish a controlled dependency-update process that includes security review and automated vulnerability scanning.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description says this skill refreshes the models crawl and regenerates summaries and AI skills. The supplied code does not perform any crawling, refreshing, or skill generation. Instead, it requires a preexisting output/alicloud-model-studio-models.json file, analyzes model names with simple keyword matching, and emits output/alicloud-model-studio-skill-scan.md containing coverage suggestions and counts. This is a materially different primary purpose: reporting/analyzing coverage rather than refreshing data or regenerating skills.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code’s behavior is narrower than the declared description. It processes an already-existing markdown crawl file and produces two derived outputs: a markdown summary and a JSON listing. There is no code to initiate or refresh the crawl, and no code to regenerate any skills under skills/ai/**. While generating derived summaries is consistent with part of the description, the declared purpose materially overstates the functionality by claiming crawl refresh and skill regeneration capabilities that are absent from this code chunk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill performs network access, reads local files, and writes generated artifacts, but it declares no explicit tool scope or permissions boundaries. That increases the chance an agent will execute it with broader-than-necessary capabilities, making unintended file modification or data exposure more likely if the workflow is misused or the fetched content is untrusted.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using npx -y @just-every/crawl without a pinned version causes execution of whatever package version is current at runtime, creating a supply-chain risk. If the upstream package is compromised or changes behavior, the skill could run malicious code with the agent's local file and network access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated markdown title is fixed to Chinese text ("Model Studio 模型清单（简表）") and the script also uses Chinese terminology in its output. This enforces a specific locale in user-facing output without any opt-in or configuration, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.