ClawHub
Back to skill

Security audit

Alibaba Cloud AI Recommend AIRec

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Alibaba Cloud AIRec management helper that uses expected OpenAPI discovery and credential-based cloud workflows, with no evidence of hidden exfiltration or persistence.

Install only if you intend to let an agent help with Alibaba Cloud AIRec administration. Use least-privilege Alibaba Cloud credentials, review any proposed Create/Update/Modify/Set call before it runs, and keep generated artifacts under the declared output directory.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Tainted flow: 'timeout' from os.getenv (line 34, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
def fetch_json(url: str, timeout: int) -> dict:
    req = urllib.request.Request(url, headers={"User-Agent": "codex-skill"})
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        return json.loads(resp.read().decode("utf-8"))
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill is presented as a management interface for live AIRec resources, but the described executable path centers on API metadata discovery rather than actual resource management or status inspection. This mismatch can mislead an agent or operator into trusting the skill for production actions it does not actually perform, resulting in incorrect operational decisions, missed validation, or unsafe follow-on actions based on incomplete evidence.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares operational behaviors that rely on environment variables, filesystem writes, and network/API access, but it does not declare any explicit tool scope or permission boundaries. This can cause an agent to invoke the skill with broader capabilities than the user expects, increasing the chance of unintended credential use, outbound requests, or artifact creation.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The invocation description is broad enough that an agent may select this skill for loosely related Alibaba Cloud tasks without strong trigger constraints. In a cloud-management context, overly broad routing increases the risk of the wrong skill being invoked, which can expose credentials, produce irrelevant API calls, or steer the workflow toward unintended infrastructure changes.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The instructions explicitly recommend mutating API families such as Create, Update, Modify, and Set, but they do not include a prominent warning that these operations may change or create billable cloud resources. In a cloud environment, omission of an explicit mutation warning and confirmation step can lead to accidental infrastructure changes, service disruption, or unexpected cost exposure if an agent follows the workflow automatically.

External Transmission

Medium
Category
Data Exfiltration
Content
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.