ClawHub
Back to skill

Security audit

Alibaba Cloud Platform OpenAPI Product API Discovery

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate Alibaba Cloud discovery skill, but it needs review because one script can write files using unvalidated metadata-derived path components while the skill also uses cloud credentials.

Install only if you are comfortable running Alibaba Cloud discovery scripts with explicit, least-privilege or short-lived credentials. Run it in a controlled workspace, keep endpoints on official Alibaba Cloud domains, review or sanitize generated product metadata before fetching per-product API docs, and avoid broad credentials because the scripts make authenticated API requests and write local reports.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill directs execution of Python scripts that use environment variables, read and write local files under output/, and make network calls to Alibaba Cloud APIs, yet it declares no permissions. This creates a capability/expectation mismatch: an agent or reviewer may treat the skill as low-risk while it can access credentials, contact external services, and persist data, increasing the chance of over-privileged or unreviewed execution.

VirusTotal

49/49 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.