ClawHub
Back to skill

Security audit

Alibaba Cloud Observability PTS

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Alibaba Cloud PTS management helper that needs cloud credentials and can start or stop tests, so users should use least-privilege credentials and review dependency installation.

Install only in a dedicated virtual environment, prefer pinned SDK versions, and provide least-privilege Alibaba Cloud credentials scoped to the intended PTS resources. Treat start/stop and any lifecycle APIs as production-impacting actions: confirm region, scene ID, owner, change window, and rollback before running them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:24
Finding

Unpinned Third-Party Alibaba Cloud SDK Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:24-27
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
python3 -m venv .venv
. .venv/bin/activate
python -m pip install -U alibabacloud_pts20201020 alibabacloud_tea_openapi

A matching installation recommendation is also embedded in the runtime error at scripts/_pts_client.py:28-30:

python
raise RuntimeError(
    "Missing SDK dependencies. Install with: "
    "python -m pip install -U alibabacloud_pts20201020 alibabacloud_tea_openapi"
) from exc

Technical Analysis

The installation command uses -U and does not pin reviewed package versions, constrain transitive dependencies, verify artifact hashes, or use a lock file. Consequently, the code installed by this instruction can change after the Skill has been audited.

This does not establish that the named Alibaba Cloud packages are malicious. The vulnerability is the mutable and insufficiently verified supply-chain trust boundary. If one of the packages, its transitive dependencies, or the package distribution account were compromised, a user following the documented command could install attacker-controlled code.

The imported SDK executes in the same Python process as the Skill scripts. It can therefore access the Alibaba Cloud access key, secret, and optional security token read from the environment by scripts/_pts_client.py.

Attack Path

  1. An attacker compromises an upstream package release, maintainer account, distribution pipeline, or transitive dependency.
  2. A malicious release is published under a package name used by the documented installation command.
  3. A user follows the command containing pip install -U, causing pip to select the latest compatible release.
  4. Attacker-controlled code executes during package installation or when the SDK is imported.
  5. The malicious code reads process environment variabl ...[truncated 791 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace floating dependency installation with exact, reviewed versions.

  2. Pin all transitive dependencies in a lock file or fully resolved requirements file.

  3. Record and enforce package hashes, for example:

    bash
    python -m pip install --require-hashes -r requirements.txt

  4. Remove -U from routine setup instructions so an already reviewed environment is not silently upgraded.

  5. Ensure the runtime error in scripts/_pts_client.py:28-30 points to the same locked installation procedure rather than recommending unconstrained packages.

  6. Obtain packages only from an approved index and document package provenance.

  7. Review dependency updates before regenerating hashes and releasing a new Skill version.

  8. Continue using a dedicated virtual environment and least-privilege, preferably short-lived Alibaba Cloud credentials.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tainted flow: 'timeout' from os.getenv (line 47, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/list_openapi_meta_apis.py (reported line 19)May include surrounding context.

python
def fetch_json(url: str, timeout: int) -> dict:
    req = urllib.request.Request(url, headers={"User-Agent": "codex-skill"})
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        return json.loads(resp.read().decode("utf-8"))

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill instructs use of environment variables, filesystem output, and external network access to Alibaba Cloud APIs, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may overreach its capabilities, making unintended credential access, file writes, or cloud mutations easier if the skill is invoked in a broader execution context.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_quick_map.md (reported line 3)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 4)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 6)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 8)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 10)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/list_openapi_meta_apis.py (reported line 52)May include surrounding context.

python
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)