Security audit

Alibaba Cloud Network ESA

Security checks for vulnerabilities and agentic risk

Overview

This Alibaba Cloud ESA management skill is coherent, but it needs review because its examples can publish to production, expose local files during deployment, and persist sensitive analytics without strong safeguards.

Review before installing. Use least-privilege RAM credentials, prefer read-only actions first, avoid production deployment defaults, inspect deployment directories for symlinks and secrets, and treat analytics exports as sensitive data that may need restricted permissions and cleanup.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/pages.md:216
Finding: Symlink Following Can Upload Files Outside the Deployment Directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/query_analytics.py:445
Finding: Privacy-Sensitive Analytics Are Automatically Persisted with Default Filesystem Permissions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Python Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation
--hash=sha256: alibabacloud_tea_openapi== --hash=sha256: alibabacloud_credentials== --hash=sha256: ``` Install with: ```bash python -m pip install \ --require-hashes \ --only-binary=:all: \ -r requirements.lock ``` The actual versions and hashes must be generated from reviewed distributions rather than copied from an untrusted source. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/pages.md:106
Finding: Deployment Examples Automatically Promote Unreviewed Content to Production
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (28)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents capabilities that require environment access, file writing, and network access, but it does not declare any explicit tool/permission scope. That creates an authorization ambiguity where an agent may invoke powerful operations without clear sandbox boundaries or user-visible consent, which is especially risky for a cloud-management skill handling credentials and destructive infrastructure actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The invocation text is very broad ('use when managing Alibaba Cloud ESA' and many related topics), making it likely to trigger on loosely related requests. Over-broad routing increases the chance that the agent enters a high-privilege cloud-management skill unintentionally, exposing credentials, making network calls, or proposing destructive operations in contexts where the user did not clearly request them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill enumerates destructive operations such as deleting sites, records, routines, and KV entries without any embedded warning, confirmation requirement, or rollback guidance. In a cloud admin context, omission of these guardrails can lead to accidental service disruption, configuration loss, or irreversible deletion if the agent follows the documented workflows too readily.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The example deployment helper and documented workflow normalize publishing code directly to the production edge environment with no confirmation, staging gate, rollback guidance, or warning about live-traffic impact. In an ESA management skill, this increases the chance of accidental outage, bad code release, or immediate exposure of unsafe edge logic across routed domains.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file documents DeleteKvNamespace as a normal operation but does not warn that it removes a storage space and may cause irreversible data loss. Under the markdown-file criteria, destructive behaviors that can affect user data should include an explicit warning.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file lists DeleteKv without any accompanying caution that deleting a key-value pair can permanently remove stored data. For markdown documentation, destructive operations affecting user data should include explicit warnings.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: BatchDeleteKv and BatchDeleteKvWithHighCapacity are destructive bulk operations, yet the documentation provides no caution about irreversible deletion of many keys at once. This omission increases the risk of accidental mass data loss.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The markdown includes example code for delete_namespace that executes a destructive action but provides no surrounding warning or caution text. The same documentation pattern normalizes deletion without alerting users to irreversible effects on stored data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The batch_delete_kv example shows how to delete multiple keys but does not warn that this can remove large amounts of data irreversibly. For markdown documentation, this kind of destructive bulk action should be explicitly disclosed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The 'Data Cleanup' workflow culminates in BatchDeleteKv but does not include any explicit warning about the irreversible nature of deleting filtered keys. This is a user-data-affecting behavior that should be disclosed in markdown documentation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation and sample code publish directly to both staging and production by default, which can cause unintended live changes if a user is experimenting, testing, or deploying unreviewed content. In an infrastructure-management skill for ESA deployments, this is particularly risky because the examples normalize immediate production rollout without an explicit caution, approval step, or safer default.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The static directory deployment example recursively walks the entire target folder and uploads every file into the deployment archive, but the guidance does not prominently warn users that sensitive files, build artifacts, hidden files, or accidental inclusions may be exposed. In the context of a deployment skill, this increases the chance of unintentionally publishing secrets or internal resources to edge storage/hosting.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 431)May include surrounding context.
md
Query account-level or site-level traffic analysis Top-N ranking data. Official docs: https://api.aliyun.com/document/ESA/2024-09-10/DescribeSiteTopData ## Request Parameters

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api_overview.md (reported line 130)May include surrounding context.
md
Query account-level or site-level traffic analysis Top-N ranking data. Official docs: https://api.aliyun.com/document/ESA/2024-09-10/DescribeSiteTopData ## Request Parameters

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/sources.md (reported line 5)May include surrounding context.
md
Query account-level or site-level traffic analysis Top-N ranking data. Official docs: https://api.aliyun.com/document/ESA/2024-09-10/DescribeSiteTopData ## Request Parameters

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/sources.md (reported line 6)May include surrounding context.
md
Query account-level or site-level traffic analysis Top-N ranking data. Official docs: https://api.aliyun.com/document/ESA/2024-09-10/DescribeSiteTopData ## Request Parameters

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/time-series.md (reported line 5)May include surrounding context.
md
Query account-level or site-level traffic analysis Top-N ranking data. Official docs: https://api.aliyun.com/document/ESA/2024-09-10/DescribeSiteTopData ## Request Parameters

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/top-data.md (reported line 5)May include surrounding context.
md
Query account-level or site-level traffic analysis Top-N ranking data. Official docs: https://api.aliyun.com/document/ESA/2024-09-10/DescribeSiteTopData ## Request Parameters

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Natural-language strings in the module docstring and CLI help are presented only in Chinese, with no opt-in or alternative locale. Under the policy, forcing a specific language without user choice is a language/locale policy violation unless clearly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script automatically exports analytics query results to local JSON files, and the supported dimensions include sensitive fields such as ClientIP, request host, path, query, referer, and user-agent. In the context of an ESA analytics tool, this can create privacy and data-handling risk by persisting potentially sensitive traffic data to disk without minimization, redaction, access controls, or explicit operator warning.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The only cited API references point to help.aliyun.com/zh/..., which indicates a Chinese-language locale is being imposed in the documentation. The file does not offer an alternative language option or explain that the skill is intentionally region- or language-specific, which can violate language/locale policy guidance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Documenting DeleteRoutine as a standard operation without any caution about permanence can lead users or downstream agents to remove active edge functions unintentionally. In infrastructure-management context, even a single mistaken deletion can disable routes or services and cause availability loss.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Deletion APIs for code versions, routes, and related records are listed without warnings, making destructive operations appear routine and low-risk. In ESA, removing a route or related record can immediately break request matching or domain-triggered execution, while deleting code versions can complicate rollback and recovery.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The sample delete_kv function demonstrates destructive deletion of stored data without any warning in the surrounding markdown. Even in examples, documentation should call out irreversible operations that affect user data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The JavaScript example includes kv.delete("key1") as a routine step but provides no warning that it permanently removes data. Documentation examples should disclose destructive effects when they may impact user data.
Content: No source excerpt is available for this finding.