Alibaba Cloud AI Search Milvus

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:32 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims for Milvus search, but it handles database credentials in a way that can expose them over plaintext HTTP.

Review before installing. Use this only with a TLS-protected Milvus endpoint, avoid the documented http:// form except for isolated local testing, pin PyMilvus in your own environment, and use a narrowly scoped Milvus token because the quickstart creates a collection and inserts records.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18
• Finding: Unpinned PyMilvus Installation Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 18 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash python -m pip install --upgrade pymilvus ``` ### Technical Analysis The installation instructions retrieve and install the latest available `pymilvus` package without a version constraint, lock file, or cryptographic hash. The `--upgrade` option further causes an existing reviewed version to be replaced by whatever release is currently available from the configured Python package index. Consequently, the dependency installed at execution time may differ from the version that was present during the skill audit. Python packages can execute code during installation and whenever imported. The quickstart script imports this dependency directly: ```python from pymilvus import MilvusClient ``` This does not establish that the current PyMilvus package is malicious. It creates a conditional supply-chain attack path if the package, a maintainer account, the package index, or the user's configured index is compromised. ### Attack Path 1. An attacker compromises a PyMilvus release channel, maintainer account, package repository, or package-index configuration accessible to the user. 2. The attacker publishes or serves a malicious package version under the expected package name. 3. A user follows the documented command using `--upgrade` and no version or hash verification. 4. `pip` installs the attacker-controlled version. 5. Malicious code executes during package installation or when `quickstart.py` imports `pymilvus`. ### Impact Assessment Successful exploitation can execute arbitrary Python code with the privileges of the user running `pip` or the quickstart script. Depending on those privileges, the attacker may access local files, environment variables—including `MILVUS_TOKEN`—and network resources available to that user. The scope is the installation environment and ...[truncated 51 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin PyMilvus to a specifically reviewed version, for example: ```bash python -m pip install "pymilvus==<reviewed-version>" ``` - Maintain a lock or requirements file containing cryptographic hashes, and install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` - Remove `--upgrade` from routine setup instructions so that reviewed installations are not silently replaced. - Use a trusted, explicitly configured package index and disable unintended fallback indexes where practical. - Run dependency vulnerability and provenance checks before updating the pinned version. - Install and execute the package in an isolated virtual environment with minimal filesystem and network privileges. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/quickstart.py:28
• Finding: Milvus Credentials Can Be Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/quickstart.py`, lines 28-32; insecure HTTP usage is documented in `SKILL.md`, lines 20-23 **Vulnerability Type**: Plaintext transmission of authentication credentials **Risk Level**: High ### Vulnerable Code The documentation explicitly presents a plaintext HTTP endpoint while requiring a username-and-password token: ```markdown - Provide connection via environment variables: - `MILVUS_URI` (e.g. `http://<host>:19530`) - `MILVUS_TOKEN` (`<username>:<password>`) - `MILVUS_DB` (default: `default`) ``` The script passes the supplied URI and token directly to the client without validating that transport encryption is enabled: ```python client = MilvusClient( uri=get_env("MILVUS_URI"), token=get_env("MILVUS_TOKEN"), db_name=get_env("MILVUS_DB", "default"), ) ``` ### Technical Analysis The script accepts an arbitrary `MILVUS_URI` and does not reject plaintext `http://` endpoints. The documented example actively encourages that configuration. When the client authenticates to such an endpoint, the supplied `MILVUS_TOKEN` and subsequent database traffic may cross the network without TLS protection. Environment-variable storage alone does not protect a secret after it is placed into an unencrypted network protocol. A network-positioned attacker may observe or manipulate traffic between the client and Milvus. The precise wire-level exposure depends on the SDK and server authentication protocol, but the code provides no transport-level assurance for the credentials or data. ### Attack Path 1. A user follows the documentation and configures `MILVUS_URI` with an `http://` endpoint. 2. The user places Milvus credentials in `MILVUS_TOKEN` and launches `quickstart.py`. 3. The script passes the plaintext endpoint and token to `MilvusClient` without validation or warning. 4. An attacker with visibility or control over the network path intercepts the connection or performs a man-in-the-midd ...[truncated 929 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require a TLS-protected URI such as `https://` for remote Milvus endpoints. - Reject plaintext remote endpoints before constructing the client. For example, parse `MILVUS_URI` and terminate with a clear error if its scheme is `http`. - If plaintext connections must be supported for local development, restrict them explicitly to verified loopback addresses and require a deliberate opt-in flag. - Replace the documentation's `http://` example with the provider's supported secure endpoint format. - Ensure server certificates and hostnames are validated. Do not disable certificate verification. - Use a narrowly scoped Milvus account that grants only the collection and data operations required by the task. - Rotate `MILVUS_TOKEN` immediately if it may previously have been used over an untrusted plaintext connection. - Prefer private network connectivity in addition to TLS, but do not treat a private network as a replacement for encrypted and authenticated transport. ]]>

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs use of sensitive environment variables such as MILVUS_URI, MILVUS_TOKEN, and MILVUS_DB and executes Python scripts, but it does not declare an explicit tool scope or permissions boundary. In an agent setting, that omission can allow broader-than-expected access to environment secrets or script execution pathways, making credential exposure or unintended external operations harder to control and audit.

Static analysis

No suspicious patterns detected.