Alibaba Cloud Platform OpenAPI Product API Discovery

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:41 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its stated Alibaba Cloud discovery purpose, but it can send signed credentialed requests to unvalidated endpoints from environment variables.

Install only if you are comfortable running local Python scripts with Alibaba Cloud credentials. Use short-lived, least-privilege credentials, verify every endpoint environment variable before execution, avoid untrusted product metadata files, and run the skill from a workspace where output writes cannot affect sensitive files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/products_from_ticket_system.py:37
• Finding: Ticket System signed requests can be redirected to an untrusted endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/products_from_ticket_system.py:37-47` and request execution at line 61 **Vulnerability Type**: Unvalidated destination for credentialed, signed requests **Risk Level**: High ### Vulnerable Code ```python access_key_id = get_env("ALICLOUD_ACCESS_KEY_ID") access_key_secret = get_env("ALICLOUD_ACCESS_KEY_SECRET") security_token = os.getenv("ALICLOUD_SECURITY_TOKEN") or os.getenv("ALIBABA_CLOUD_SECURITY_TOKEN") endpoint = get_env("TICKET_ENDPOINT") version = os.getenv("TICKET_VERSION", "2021-06-10") client = AcsClient(access_key_id, access_key_secret, "cn-hangzhou", security_token) request = CommonRequest() request.set_domain(endpoint) request.set_version(version) request.set_action_name("ListProducts") request.set_method("GET") ``` The request is subsequently transmitted without validating the destination: ```python response = client.do_action_with_exception(request) ``` ### Technical Analysis `TICKET_ENDPOINT` is accepted directly from the process environment and passed to `CommonRequest.set_domain()` without checking that it is an approved Alibaba Cloud hostname. The `AcsClient` signs the resulting request using the configured access-key credentials. An attacker who can influence environment configuration can redirect the signed request to an attacker-controlled server. Depending on the SDK authentication format, that server may receive the access-key identifier, request signature, timestamp, nonce, request parameters, and an optional STS security token. The code does not directly transmit the long-term access-key secret, but captured signed authorization material and temporary tokens remain sensitive. This behavior exceeds the minimum privilege required to query a known Alibaba Cloud Ticket System endpoint because arbitrary destinations do not need to receive credentialed requests. ### Attack Path 1. An attacker gains influence over deployment configuration, shell environment variables, ...[truncated 1135 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove arbitrary endpoint overrides when they are not operationally necessary. 2. Resolve the Ticket System endpoint from a fixed service and region mapping maintained by the application. 3. If endpoint customization is required: - Parse the value as a hostname rather than accepting an arbitrary URL. - Reject user information, paths, query strings, fragments, explicit ports, and IP literals. - Require an exact approved hostname or a carefully validated Alibaba Cloud suffix such as `.aliyuncs.com`. - Require HTTPS and reject redirects to non-approved origins. 4. Prefer short-lived STS credentials with permission limited to `ListProducts`. 5. Log the validated destination before execution without logging authorization headers, signatures, tokens, or secrets. 6. Add tests proving that attacker-controlled domains, deceptive suffixes, and absolute URLs are rejected. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/products_from_support_service.py:58
• Finding: Support Service signed requests can be redirected to an untrusted endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/products_from_support_service.py:58-70` and request execution at line 75 **Vulnerability Type**: Unvalidated destination for credentialed, signed requests **Risk Level**: High ### Vulnerable Code ```python access_key_id = get_env("ALICLOUD_ACCESS_KEY_ID") access_key_secret = get_env("ALICLOUD_ACCESS_KEY_SECRET") security_token = os.getenv("ALICLOUD_SECURITY_TOKEN") or os.getenv("ALIBABA_CLOUD_SECURITY_TOKEN") endpoint = get_env("SUPPORT_ENDPOINT") version = get_env("SUPPORT_VERSION") group_id = get_env("SUPPORT_GROUP_ID") client = AcsClient(access_key_id, access_key_secret, "cn-hangzhou", security_token) request = CommonRequest() request.set_domain(endpoint) request.set_version(version) request.set_action_name("ListProductByGroup") request.set_method("GET") request.add_query_param("OpenGroupId", group_id) ``` The signed request is sent through the configured client: ```python response = client.do_action_with_exception(request) ``` ### Technical Analysis The script requires `SUPPORT_ENDPOINT` but does not validate it against an allowlist or an Alibaba Cloud domain suffix. It then signs a request with the configured access-key credentials and transmits it to that destination. A malicious endpoint can observe the access-key identifier, signature metadata, timestamp, nonce, request parameters, and optional STS security token used by the Alibaba Cloud SDK. The long-term secret is used to create the signature and is not shown as directly transmitted by this code. The `SUPPORT_GROUP_ID` parameter may also be disclosed to the untrusted destination, although it is not necessarily a secret. ### Attack Path 1. An attacker modifies or influences `SUPPORT_ENDPOINT`. 2. The script is launched with valid Alibaba Cloud credentials and, optionally, an STS token. 3. The SDK signs the `ListProductByGroup` request. 4. The signed request and `OpenGroupId` are sent to the attacker-controlled server. 5. The at ...[truncated 639 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Maintain an explicit allowlist of valid Support Service endpoints. 2. Validate the normalized hostname before placing credentials into the request. 3. Reject: - Non-HTTPS destinations. - IP literals and localhost. - User information, explicit ports, paths, fragments, and query components. - Hostnames outside the exact approved Alibaba Cloud domain set. 4. Revalidate every redirect destination or disable redirects for signed requests. 5. Use a dedicated, short-lived STS role that permits only the required product-list operation. 6. Do not log request authorization data or session tokens. 7. Add negative tests for attacker domains, suffix-confusion names such as `aliyuncs.com.example.org`, and malformed endpoint values. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/products_from_bssopenapi.py:42
• Finding: BSS OpenAPI endpoint override permits redirection of signed requests<![CDATA[ ## Vulnerability Details **File Location**: `scripts/products_from_bssopenapi.py:42-58` and request execution at line 73 **Vulnerability Type**: Unvalidated endpoint override for credentialed, signed requests **Risk Level**: High ### Vulnerable Code ```python access_key_id = os.getenv("ALICLOUD_ACCESS_KEY_ID") access_key_secret = os.getenv("ALICLOUD_ACCESS_KEY_SECRET") security_token = os.getenv("ALICLOUD_SECURITY_TOKEN") or os.getenv("ALIBABA_CLOUD_SECURITY_TOKEN") if not access_key_id or not access_key_secret: print("Missing ALICLOUD_ACCESS_KEY_ID or ALICLOUD_ACCESS_KEY_SECRET", file=sys.stderr) sys.exit(1) endpoint = os.getenv("BSS_ENDPOINT", "business.aliyuncs.com") version = os.getenv("BSS_VERSION", "2017-12-14") page_size = get_int("BSS_PAGE_SIZE", 50) client = AcsClient(access_key_id, access_key_secret, "cn-hangzhou", security_token) products: list[dict] = [] page_num = 1 total_count = None while True: request = CommonRequest() request.set_domain(endpoint) request.set_version(version) request.set_action_name("QueryProductList") request.set_method("GET") ``` The request is then sent using the credentialed client: ```python response = client.do_action_with_exception(request) ``` ### Technical Analysis The default endpoint, `business.aliyuncs.com`, is consistent with the documented BSS OpenAPI destination. However, `BSS_ENDPOINT` can replace that value with any environment-provided domain, and the replacement is not validated. Consequently, an attacker who controls the environment can redirect signed, paginated requests to another host. The attacker may receive the access-key identifier, signatures, timestamps, nonces, pagination parameters, and an optional STS security token. The loop may send multiple signed requests if the attacker returns crafted product-list responses that cause pagination to continue. The code does not directly expose the long-term access-key secret, and use of the official default is ...[truncated 1114 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `BSS_ENDPOINT` customization and use the fixed documented endpoint if overrides are unnecessary. 2. Otherwise, allow only an exact set of approved BSS endpoints after canonical hostname parsing. 3. Require HTTPS and reject IP literals, ports, credentials in URLs, paths, query strings, fragments, and deceptive domain suffixes. 4. Disable redirects or validate each redirect against the same allowlist. 5. Use short-lived credentials restricted to `QueryProductList`. 6. Add pagination safeguards: - Set a maximum page count. - Validate `TotalCount`. - Stop when a page repeats. - Enforce a reasonable page-size range. 7. Add automated tests confirming that arbitrary hosts cannot receive signed requests. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/apis_from_openapi_meta.py:74
• Finding: Untrusted product metadata can escape the configured output directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/apis_from_openapi_meta.py:50-57, 74-101` **Vulnerability Type**: Path traversal through unvalidated product and version values **Risk Level**: Medium ### Vulnerable Code The source metadata file and destination directory are environment-configurable: ```python products_file = Path( os.getenv( "OPENAPI_META_PRODUCTS_FILE", "output/product-scan/openapi-meta/products_normalized.json", ) ) if not products_file.exists(): print(f"Missing products file: {products_file}", file=sys.stderr) sys.exit(1) output_dir = Path( os.getenv("OPENAPI_META_OUTPUT_DIR", "output/product-scan/openapi-meta/apis") ) output_dir.mkdir(parents=True, exist_ok=True) ``` Values loaded from that file are used in both the request URL and filesystem path without validation: ```python for product in products: product_code = product.get("product_code") if not product_code: continue if include_products and product_code not in include_products: continue versions = product.get("versions") or [] if include_versions: versions = [v for v in versions if v in include_versions] for version in versions: url = ( "https://api.aliyun.com/meta/v1/products/" f"{product_code}/versions/{version}/api-docs.json" ) payload = fetch_json(url) if not payload: continue api_count = len(payload.get("apis") or []) product_dir = output_dir / product_code / version product_dir.mkdir(parents=True, exist_ok=True) out_file = product_dir / "api-docs.json" out_file.write_text(json.dumps(payload, ensure_ascii=False, indent=2), encoding="utf-8") ``` ### Technical Analysis `product_code` and `version` are loaded from a JSON file selected through `OPENAPI_META_PRODUCTS_FILE`. Neither field is constrained to the expected Alibaba Cloud product-code or API-version format. `pa ...[truncated 1773 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate `product_code` and `version` using strict allowlists appropriate to Alibaba Cloud metadata, for example permitting only expected ASCII letters, digits, underscores, and hyphens. 2. Explicitly reject: - Absolute paths. - `.` and `..` components. - Forward and backward slashes. - NUL bytes and platform-specific path separators. 3. URL-encode each value as an individual path segment rather than interpolating it directly. 4. Resolve and verify output containment before creating directories: ```python base = output_dir.resolve() target = (base / product_code / version / "api-docs.json").resolve() if target.parent != base and base not in target.parents: raise ValueError("Output path escapes configured directory") ``` 5. Apply the same containment validation to `OPENAPI_META_OUTPUT_DIR` if the Skill’s output discipline requires all artifacts to remain under `output/`. 6. Treat downloaded and locally supplied metadata as untrusted, even when it normally originates from an official endpoint. 7. Add regression tests using `../`, absolute paths, backslash traversal, and encoded separator variants. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tainted flow: 'url' from os.getenv (line 34, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

def fetch_json(url: str) -> dict:
    try:
        with urllib.request.urlopen(url, timeout=60) as resp:
            payload = resp.read().decode("utf-8")
    except urllib.error.URLError as exc:
        print(f"Failed to fetch {url}: {exc}", file=sys.stderr)

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code’s primary function is a local comparison step: it loads merged_products.json, scans existing skill markdown files, matches products by name/code substring, and generates skill gap reports. This only partially aligns with the final part of the description about coverage/gap reporting for skill generation, but it does not implement the major declared capabilities of discovering/reconciling product catalogs from external Alibaba Cloud sources or fetching OpenAPI metadata. The actual behavior is narrower and materially different from the broader declared purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The implementation is materially narrower than the declared description. It performs a single task: fetching paginated product data from the BSS OpenAPI QueryProductList endpoint and saving it locally. None of the broader declared behaviors—multi-source catalog discovery/reconciliation, OpenAPI metadata retrieval, or coverage/gap summarization—are present in this code chunk. This is a description-behavior mismatch because the declared primary purpose describes a larger workflow and set of capabilities than the code actually implements.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises a broader catalog discovery and reconciliation workflow across several Alibaba Cloud sources, plus API metadata collection and coverage analysis for skill planning. The supplied code performs only one narrow part of that: downloading products.json from api.aliyun.com, extracting product codes and versions, and saving raw and normalized JSON files. There is no evidence of querying Ticket System, Support & Service, or BSS OpenAPI, no product-to-API mapping, and no reporting or summarization of coverage gaps. This is therefore a material underimplementation relative to the declared purpose.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs execution of local Python scripts that inherently require file access, environment variable access, and network connectivity, but it declares no explicit tool scope or permission boundaries. In an agent environment, this can lead to over-broad execution authority and makes it harder to enforce least privilege or review what the skill is allowed to do.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The script hard-codes Chinese headings and column labels in the generated markdown report, which imposes a specific language choice on users. There is no option to select locale or explanation that this is a region-specific tool, so this is a natural-language policy concern.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""Fetch Alibaba Cloud product list from OpenAPI metadata endpoints.

Downloads:
  https://api.aliyun.com/meta/v1/products.json?language=EN_US

Optional env vars:
  - OPENAPI_META_LANGUAGE (default: EN_US)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""Fetch Alibaba Cloud product list from OpenAPI metadata endpoints.

Downloads:
  https://api.aliyun.com/meta/v1/products.json?language=EN_US

Optional env vars:
  - OPENAPI_META_LANGUAGE (default: EN_US)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""Fetch Alibaba Cloud product list from OpenAPI metadata endpoints.

Downloads:
  https://api.aliyun.com/meta/v1/products.json?language=EN_US

Optional env vars:
  - OPENAPI_META_LANGUAGE (default: EN_US)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""Fetch Alibaba Cloud product list from OpenAPI metadata endpoints.

Downloads:
  https://api.aliyun.com/meta/v1/products.json?language=EN_US

Optional env vars:
  - OPENAPI_META_LANGUAGE (default: EN_US)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""Fetch Alibaba Cloud product list from OpenAPI metadata endpoints.

Downloads:
  https://api.aliyun.com/meta/v1/products.json?language=EN_US

Optional env vars:
  - OPENAPI_META_LANGUAGE (default: EN_US)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""Fetch Alibaba Cloud product list from OpenAPI metadata endpoints.

Downloads:
  https://api.aliyun.com/meta/v1/products.json?language=EN_US

Optional env vars:
  - OPENAPI_META_LANGUAGE (default: EN_US)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Low

• Confidence: 78% confidence
• Finding: The manifest and workflow consistently describe fetching, merging, and summarizing Alibaba Cloud product and OpenAPI metadata, with outputs written locally under `output/`. Line L100 introduces 'mutating operations', which contradicts the apparent read-only intent of the skill and suggests capabilities not otherwise described in the file.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The generated report headers and labels are hard-coded in Chinese, which imposes a specific language choice on users of the skill. There is no option to select another language and no documentation in the file indicating that the skill is intentionally region-specific.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This code performs an HTTP API request to the Support service using environment-supplied credentials, but the runtime behavior is only implied by the module docstring and there is no explicit user-facing notice at the point of execution about contacting a remote service. For code files, outbound network activity that may transmit user or system data should have some visible disclosure such as a print/log statement, confirmation, or clearly stated warning.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The generated markdown uses fixed Chinese headers and labels such as "产品Code", "产品名", and "OpenAPI 产品分类汇总". This imposes a specific language/locale in user-facing output without opt-in or documentation justifying a Chinese-only audience, matching the language policy violation criteria.

Static analysis

No suspicious patterns detected.