T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/list_openapi_meta_apis.py:28- Finding
Path Traversal Through Unvalidated Output Filename Components
- Content
View full analysis
- Remediation
View remediation
Security audit
Alibaba Cloud Backup BDRC
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed Alibaba Cloud BDRC management helper, but users should handle cloud credentials and mutating operations carefully.
Install only with least-privilege Alibaba Cloud credentials. Review planned BDRC mutations before execution, avoid saving secrets in logs or evidence files, and use safe product/version values or the defaults for the metadata script until filename validation is added.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Tainted flow: 'timeout' from os.getenv (line 34, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python def fetch_json(url: str, timeout: int) -> dict: req = urllib.request.Request(url, headers={"User-Agent": "codex-skill"}) with urllib.request.urlopen(req, timeout=timeout) as resp: return json.loads(resp.read().decode("utf-8"))
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented as a manager for Backup and Disaster Recovery Center operations, but the documented quickstart and behavior focus on OpenAPI metadata discovery and writing local artifacts rather than direct BDRC resource management. This mismatch can mislead operators and policy systems about what the skill actually does, which is dangerous because hidden or undocumented behavior can bypass expected review boundaries and lead to unanticipated network access or data collection.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises executable workflows that rely on environment access, filesystem writes, and network/API calls, but it does not declare any explicit tool scope such as permissions or allowed-tools. This increases the risk of overbroad execution because an agent may invoke capabilities beyond what a reviewer or user expects, especially when cloud credentials and remote API access are involved.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to source Alibaba Cloud credentials from environment variables and shared credential files, but it does not include a clear warning against exposing, logging, copying, or persisting those secrets. In a skill that performs networked cloud operations and writes artifacts to disk, missing secret-handling guidance raises the chance of accidental credential disclosure through logs, evidence files, or debugging output.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md output_dir.mkdir(parents=True, exist_ok=True) url = ( f"https://api.aliyun.com/meta/v1/products/{args.product_code}" f"/versions/{args.version}/api-docs.json" ) payload = fetch_json(url, timeout)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md output_dir.mkdir(parents=True, exist_ok=True) url = ( f"https://api.aliyun.com/meta/v1/products/{args.product_code}" f"/versions/{args.version}/api-docs.json" ) payload = fetch_json(url, timeout)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md output_dir.mkdir(parents=True, exist_ok=True) url = ( f"https://api.aliyun.com/meta/v1/products/{args.product_code}" f"/versions/{args.version}/api-docs.json" ) payload = fetch_json(url, timeout)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python output_dir.mkdir(parents=True, exist_ok=True) url = ( f"https://api.aliyun.com/meta/v1/products/{args.product_code}" f"/versions/{args.version}/api-docs.json" ) payload = fetch_json(url, timeout)
Static analysis
No suspicious patterns detected.