Security audit

Alibaba Cloud AI Search Milvus

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Milvus vector search, but it handles database credentials and shows an insecure plaintext HTTP connection pattern without safeguards.

Review this before installing if you plan to use real Milvus credentials. Prefer HTTPS/TLS endpoints, use a low-privilege Milvus account, avoid admin tokens, pin PyMilvus in a virtual environment, and run the quickstart only against a disposable collection or test database because it creates a collection and inserts records.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Unpinned PyMilvus Dependency Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
" ``` 2. Maintain dependencies in a lock file with cryptographic hashes. 3. Install with hash verification, for example: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Document and enforce a trusted package index instead of relying on arbitrary pip configuration. 5. Periodically review and deliberately update the pinned version after checking release provenance, security advisories, and compatibility. 6. Perform installation in an isolated virtual environment under a non-privileged account. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:23
Finding: Milvus Authentication Token Can Be Sent over Plaintext HTTP
Content: View full analysis
:19530`) - `MILVUS_TOKEN` (`:`) - `MILVUS_DB` (default: `default`) ``` The quickstart passes the endpoint and authentication token directly to `MilvusClient` without checking whether encrypted transport is enabled: ```python client = MilvusClient( uri=get_env("MILVUS_URI"), token=get_env("MILVUS_TOKEN"), db_name=get_env("MILVUS_DB", "default"), ) ``` ### Technical Analysis `MILVUS_TOKEN` contains authentication material in the documented `:` form. The Skill recommends an `http://` URI and the quickstart accepts it without validation or an explicit insecure-transport warning. When plaintext HTTP is used across an untrusted or shared network, transport confidentiality and server authentication are not provided. An on-path party may be able to observe authentication traffic or alter requests and responses. The exact wire-level handling depends on the PyMilvus client and server configuration, but the Skill does not enforce a secure transport boundary before supplying the credential to the client. ### Attack Path 1. A user follows the documented example and configures `MILVUS_URI` with an `http://` endpoint. 2. The user stores a valid username and password in `MILVUS_TOKEN`. 3. The quickstart constructs `MilvusClient` using the plaintext endpoint and the token without rejecting the configuration. 4. An attacker positioned on the same network path captures or manipulates traffic between the client and the Milvus service. 5. If the authentication material is exposed through the unen ...[truncated 913 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs use of environment variables containing sensitive credentials (MILVUS_TOKEN, MILVUS_URI) and includes executable examples, but it does not declare any explicit tool scope or permissions boundary. In agent environments, missing permissions or allowed-tools metadata can cause overly broad default access, making credential exposure or unintended command execution more likely than necessary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The code reads MILVUS_URI, MILVUS_TOKEN, and MILVUS_DB from environment variables to establish a remote client connection. While missing-variable errors are printed, there is no disclosure that the script consumes connection credentials or uses them to connect to an external service.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.