T09 · Insecure Skill Coding Practices
Error
- Location
scripts/products_from_ticket_system.py:37- Finding
Ticket System signed requests can be redirected to an untrusted endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Alibaba Cloud Platform OpenAPI Product API Discovery
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its stated Alibaba Cloud discovery purpose, but it can send signed credentialed requests to unvalidated endpoints from environment variables.
Install only if you are comfortable running local Python scripts with Alibaba Cloud credentials. Use short-lived, least-privilege credentials, verify every endpoint environment variable before execution, avoid untrusted product metadata files, and run the skill from a workspace where output writes cannot affect sensitive files.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/products_from_support_service.py:58- Finding
Support Service signed requests can be redirected to an untrusted endpoint
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/products_from_bssopenapi.py:42- Finding
BSS OpenAPI endpoint override permits redirection of signed requests
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/apis_from_openapi_meta.py:74- Finding
Untrusted product metadata can escape the configured output directory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Tainted flow: 'url' from os.getenv (line 34, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python def fetch_json(url: str) -> dict: try: with urllib.request.urlopen(url, timeout=60) as resp: payload = resp.read().decode("utf-8") except urllib.error.URLError as exc: print(f"Failed to fetch {url}: {exc}", file=sys.stderr)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code’s primary function is a local comparison step: it loads merged_products.json, scans existing skill markdown files, matches products by name/code substring, and generates skill gap reports. This only partially aligns with the final part of the description about coverage/gap reporting for skill generation, but it does not implement the major declared capabilities of discovering/reconciling product catalogs from external Alibaba Cloud sources or fetching OpenAPI metadata. The actual behavior is narrower and materially different from the broader declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The implementation is materially narrower than the declared description. It performs a single task: fetching paginated product data from the BSS OpenAPI QueryProductList endpoint and saving it locally. None of the broader declared behaviors—multi-source catalog discovery/reconciliation, OpenAPI metadata retrieval, or coverage/gap summarization—are present in this code chunk. This is a description-behavior mismatch because the declared primary purpose describes a larger workflow and set of capabilities than the code actually implements.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a broader catalog discovery and reconciliation workflow across several Alibaba Cloud sources, plus API metadata collection and coverage analysis for skill planning. The supplied code performs only one narrow part of that: downloading products.json from api.aliyun.com, extracting product codes and versions, and saving raw and normalized JSON files. There is no evidence of querying Ticket System, Support & Service, or BSS OpenAPI, no product-to-API mapping, and no reporting or summarization of coverage gaps. This is therefore a material underimplementation relative to the declared purpose.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs execution of local Python scripts that inherently require file access, environment variable access, and network connectivity, but it declares no explicit tool scope or permission boundaries. In an agent environment, this can lead to over-broad execution authority and makes it harder to enforce least privilege or review what the skill is allowed to do.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script hard-codes Chinese headings and column labels in the generated markdown report, which imposes a specific language choice on users. There is no option to select locale or explanation that this is a region-specific tool, so this is a natural-language policy concern.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md """Fetch Alibaba Cloud product list from OpenAPI metadata endpoints. Downloads: https://api.aliyun.com/meta/v1/products.json?language=EN_US Optional env vars: - OPENAPI_META_LANGUAGE (default: EN_US)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md """Fetch Alibaba Cloud product list from OpenAPI metadata endpoints. Downloads: https://api.aliyun.com/meta/v1/products.json?language=EN_US Optional env vars: - OPENAPI_META_LANGUAGE (default: EN_US)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md """Fetch Alibaba Cloud product list from OpenAPI metadata endpoints. Downloads: https://api.aliyun.com/meta/v1/products.json?language=EN_US Optional env vars: - OPENAPI_META_LANGUAGE (default: EN_US)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python """Fetch Alibaba Cloud product list from OpenAPI metadata endpoints. Downloads: https://api.aliyun.com/meta/v1/products.json?language=EN_US Optional env vars: - OPENAPI_META_LANGUAGE (default: EN_US)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python """Fetch Alibaba Cloud product list from OpenAPI metadata endpoints. Downloads: https://api.aliyun.com/meta/v1/products.json?language=EN_US Optional env vars: - OPENAPI_META_LANGUAGE (default: EN_US)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python """Fetch Alibaba Cloud product list from OpenAPI metadata endpoints. Downloads: https://api.aliyun.com/meta/v1/products.json?language=EN_US Optional env vars: - OPENAPI_META_LANGUAGE (default: EN_US)
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The manifest and workflow consistently describe fetching, merging, and summarizing Alibaba Cloud product and OpenAPI metadata, with outputs written locally under
output/. Line L100 introduces 'mutating operations', which contradicts the apparent read-only intent of the skill and suggests capabilities not otherwise described in the file.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The generated report headers and labels are hard-coded in Chinese, which imposes a specific language choice on users of the skill. There is no option to select another language and no documentation in the file indicating that the skill is intentionally region-specific.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This code performs an HTTP API request to the Support service using environment-supplied credentials, but the runtime behavior is only implied by the module docstring and there is no explicit user-facing notice at the point of execution about contacting a remote service. For code files, outbound network activity that may transmit user or system data should have some visible disclosure such as a print/log statement, confirmation, or clearly stated warning.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The generated markdown uses fixed Chinese headers and labels such as "产品Code", "产品名", and "OpenAPI 产品分类汇总". This imposes a specific language/locale in user-facing output without opt-in or documentation justifying a Chinese-only audience, matching the language policy violation criteria.
- Content