Security audit

Alibaba Cloud AI Search DashVector

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward DashVector quickstart that uses disclosed credentials and performs expected vector database operations, with some setup and endpoint-safety cautions.

Install in a virtual environment, use a DashVector API key scoped as narrowly as possible, verify DASHVECTOR_ENDPOINT comes from your Alibaba Cloud DashVector console, and run mutating quickstart operations only against a test collection or explicitly chosen collection.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:18
Finding: Unpinned DashVector Dependency Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
" ``` - Maintain dependencies in a lock file generated from reviewed inputs. - Record and verify package hashes, preferably using: ```bash python -m pip install --require-hashes -r requirements.txt ``` - Use a trusted package index explicitly and prevent unintended fallback to additional indexes. - Add automated dependency vulnerability and provenance checks to the release process. - Periodically review and deliberately update the pinned version rather than resolving the latest version at installation time. - Continue recommending an isolated virtual environment so compromise is constrained to the project environment where possible. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/quickstart.py:29
Finding: API Client Uses an Unvalidated Environment-Controlled Endpoint
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill instructs users to supply sensitive credentials through environment variables (DASHVECTOR_API_KEY, DASHVECTOR_ENDPOINT) and to run Python scripts, but it does not declare any explicit tool scope, permissions, or allowed-tools boundary. In an agent setting, this can cause overbroad ambient access to secrets or execution capabilities, making it easier for the skill to access environment data unexpectedly or for operators to misjudge its privilege requirements.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.