ClawHub
Back to skill

Security audit

Alibaba Cloud Platform DevOps

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Alibaba Cloud DevOps helper that uses expected cloud credentials and official APIs, with some install and mutation-safety cautions but no evidence of hidden or malicious behavior.

Install and run this only with a least-privilege Alibaba Cloud identity, preferably read-only for inventory work. Pin SDK versions or use a controlled package mirror if supply-chain assurance matters, and require explicit owner approval plus a rollback plan before using any mutating DevOps API.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:28
Finding

Unpinned Runtime Dependencies Permit Supply-Chain Code Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 28
Vulnerability Type: Unpinned third-party dependencies installed from a mutable package source
Risk Level: Medium

Vulnerable Code Snippet:

bash
python -m pip install -U alibabacloud_devops20210625 alibabacloud_tea_openapi

Technical Analysis

The documented installation command installs or upgrades the Alibaba Cloud SDK packages without version constraints, integrity hashes, or a lockfile. Consequently, the code installed at runtime can differ from the code originally reviewed with this Skill.

Python package installation can execute package build and installation logic. The installed SDK is then imported by scripts/_devops_client.py and receives Alibaba Cloud access-key credentials and an optional security token. A compromised, malicious, or unexpectedly incompatible future package release could therefore execute locally and access those credentials.

The package names are consistent with the declared Alibaba Cloud functionality, and the audit found no evidence that they are intentionally malicious. The risk arises from mutable and unverified dependency resolution.

Attack Path

  1. An attacker compromises a package publisher account, package registry, release pipeline, or future dependency release.
  2. The attacker publishes a malicious version under one of the documented package names.
  3. A user follows the Skill instructions and runs the unpinned command with -U.
  4. pip resolves and installs the attacker-controlled release.
  5. Malicious installation logic may execute immediately. Malicious runtime logic may also execute when _devops_client.py imports the SDK.
  6. The altered SDK can read process-accessible credentials and intercept credentials assigned to the SDK configuration.
  7. The attacker may exfiltrate credentials or issue Alibaba Cloud API requests within the permissions of the configured identity.

Impact Assess

...[truncated 649 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed exact version:

    bash
    python -m pip install \
  alibabacloud_devops20210625==<reviewed-version> \
  alibabacloud_tea_openapi==<reviewed-version>

  2. Generate a fully resolved lock or requirements file that also pins transitive dependencies.

  3. Require package hashes and install with pip install --require-hashes -r requirements.txt.

  4. Remove -U from normal setup instructions so installation does not silently move to unreviewed releases.

  5. Use an approved package index or internal artifact mirror and explicitly configure the trusted index.

  6. Review dependency provenance, release signatures or attestations, and vulnerability scan results before updating pins.

  7. Run installation and scripts in a dedicated virtual environment under a non-privileged account.

  8. Continue using a least-privilege, preferably short-lived, cloud identity limited to required read-only DevOps APIs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tainted flow: 'timeout' from os.getenv (line 47, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/list_openapi_meta_apis.py (reported line 19)May include surrounding context.

python
def fetch_json(url: str, timeout: int) -> dict:
    req = urllib.request.Request(url, headers={"User-Agent": "codex-skill"})
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        return json.loads(resp.read().decode("utf-8"))

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs use of environment credentials, local file writes, and outbound network access, but it does not declare any explicit tool scope such as allowed-tools or permissions. That omission weakens guardrails and makes it easier for an agent to use broader capabilities than reviewers or operators expect, especially in a credentialed cloud-management context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The quick map prominently documents many mutating DevOps operations such as project creation, membership changes, repository writes, and pipeline execution, which exceeds the stated skill scope of read-only inspection and safe change planning. In an agent setting, exposing these actions as a compact reference increases the chance that the agent will perform unauthorized or unsafe state-changing operations, especially if other controls are weak or ambiguous.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_quick_map.md (reported line 3)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 4)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 6)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 8)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 10)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/list_openapi_meta_apis.py (reported line 52)May include surrounding context.

python
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The note telling users to prefer read-only APIs is undermined by the document's heavy emphasis on mutating endpoints, creating mixed guidance. This inconsistency can mislead an agent or operator into treating destructive operations as in-scope or routine, weakening safety boundaries around cloud DevOps changes.

Content

No source excerpt is available for this finding.