ClawHub
Back to skill

Security audit

Alibaba Cloud Observability PTS

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Alibaba Cloud PTS management helper, but users should treat its start/stop scripts as real cloud operations that can create load and cost.

Install only if you intend to manage Alibaba Cloud PTS. Use a least-privilege RAM user or temporary STS credentials, verify region and scene ID before running start/stop, run list/read-only checks first, and protect generated output files because they may contain cloud resource details.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly uses sensitive capabilities—environment variables for cloud credentials, network access to Alibaba Cloud APIs, and file writes for output artifacts—but does not declare any permissions or capability boundaries. This creates a trust and review gap: operators may invoke a skill that can access secrets, contact external services, and write local files without explicit disclosure or policy enforcement.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script directly invokes a remote state-changing API to start a PTS scene as soon as it is run, with no dry-run mode, interactive confirmation, or explicit safety gate. In a production performance-testing context, accidental execution can trigger load tests against live systems, causing unintended service impact, cost, or operational disruption.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.