Security audit

Alibaba Cloud AI Search OpenSearch

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it should be reviewed because it uses OpenSearch credentials with a hardcoded plaintext HTTP setting and can write sample data to a live datasource.

Install only if you are comfortable reviewing or changing the client configuration to use HTTPS, and run the quickstart only against a test or disposable OpenSearch datasource with narrowly scoped credentials. Pin the SDK version before relying on it in production.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/quickstart.py:25
Finding: OpenSearch Credentials and API Data Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:17
Finding: Unpinned Third-Party SDK Installation Creates Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs use of multiple sensitive environment variables, including service credentials, but does not declare any explicit tool scope or permissions boundary. In agentic environments, missing scope metadata can cause the runtime or reviewer to underestimate the skill's access to secrets and external network operations, increasing the chance of unintended credential exposure or unauthorized API use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This code reads OPENSEARCH_USERNAME and OPENSEARCH_PASSWORD to authenticate outbound requests, but it provides no disclosure that credentials will be consumed or used for network access. The existing stderr message only reports missing variables and does not warn the user about handling sensitive values.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The script pushes documents to the configured OpenSearch datasource, which is a remote write operation affecting stored data. Although it prints "Pushing docs...", that status message does not warn the user that running the quickstart will add documents to a live datasource.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.