Security audit

Alibaba Cloud AI Search Milvus

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims for Milvus search, but it handles database credentials in a way that can expose them over plaintext HTTP.

Review before installing. Use this only with a TLS-protected Milvus endpoint, avoid the documented http:// form except for isolated local testing, pin PyMilvus in your own environment, and use a narrowly scoped Milvus token because the quickstart creates a collection and inserts records.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:18
Finding: Unpinned PyMilvus Installation Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
" ``` - Maintain a lock or requirements file containing cryptographic hashes, and install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` - Remove `--upgrade` from routine setup instructions so that reviewed installations are not silently replaced. - Use a trusted, explicitly configured package index and disable unintended fallback indexes where practical. - Run dependency vulnerability and provenance checks before updating the pinned version. - Install and execute the package in an isolated virtual environment with minimal filesystem and network privileges. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/quickstart.py:28
Finding: Milvus Credentials Can Be Transmitted over Plaintext HTTP
Content: View full analysis
:19530`) - `MILVUS_TOKEN` (`:`) - `MILVUS_DB` (default: `default`) ``` The script passes the supplied URI and token directly to the client without validating that transport encryption is enabled: ```python client = MilvusClient( uri=get_env("MILVUS_URI"), token=get_env("MILVUS_TOKEN"), db_name=get_env("MILVUS_DB", "default"), ) ``` ### Technical Analysis The script accepts an arbitrary `MILVUS_URI` and does not reject plaintext `http://` endpoints. The documented example actively encourages that configuration. When the client authenticates to such an endpoint, the supplied `MILVUS_TOKEN` and subsequent database traffic may cross the network without TLS protection. Environment-variable storage alone does not protect a secret after it is placed into an unencrypted network protocol. A network-positioned attacker may observe or manipulate traffic between the client and Milvus. The precise wire-level exposure depends on the SDK and server authentication protocol, but the code provides no transport-level assurance for the credentials or data. ### Attack Path 1. A user follows the documentation and configures `MILVUS_URI` with an `http://` endpoint. 2. The user places Milvus credentials in `MILVUS_TOKEN` and launches `quickstart.py`. 3. The script passes the plaintext endpoint and token to `MilvusClient` without validation or warning. 4. An attacker with visibility or control over the network path intercepts the connection or performs a man-in-the-midd ...[truncated 929 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs use of sensitive environment variables such as MILVUS_URI, MILVUS_TOKEN, and MILVUS_DB and executes Python scripts, but it does not declare an explicit tool scope or permissions boundary. In an agent setting, that omission can allow broader-than-expected access to environment secrets or script execution pathways, making credential exposure or unintended external operations harder to control and audit.
Content: No source excerpt is available for this finding.