Security audit

Alibaba Cloud AI Search OpenSearch

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Alibaba OpenSearch use, but it directs users to send credentials over plaintext HTTP and runs mutating push operations in its quickstart.

Review before installing. Use only least-privilege OpenSearch credentials, avoid production data until you intentionally approve writes, change the SDK configuration to HTTPS before use, and pin the SDK dependency in a reviewed requirements file.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/quickstart.py:24
Finding: OpenSearch credentials and data are transmitted over plaintext HTTP
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unpinned third-party SDK installation creates supply-chain exposure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill uses environment-based credentials and network-capable SDK examples, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, this can cause implicit access to sensitive environment variables and external services without clear user visibility, increasing the risk of unintended credential use or outbound actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The quickstart demonstrates mutating push operations and authenticated access using username/password, but it does not prominently warn that these actions can modify remote indexes or that credentials must be handled as secrets. In a real agent workflow, this could lead users to run write operations against production data or expose credentials in logs, transcripts, or shell history.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document content is entirely in Chinese, which imposes a specific language choice without offering any user language selection or documenting a justified locale restriction. This is a natural-language policy concern because the file presents instructions in a single language by default.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.