Alibaba Cloud Skill Creator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:46 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a coherent skill-development helper, but it includes local process termination, untrusted packaging disclosure risks, and third-party model data sharing that deserve review before installation.

Use this only in trusted skill-development repositories. Review symlinks before packaging any imported skill, avoid running the eval viewer on ports used by other local services, and do not run the description-improvement tooling on confidential skill/eval data unless sending that content to Anthropic is acceptable.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/package_skill.py:93

Finding

Skill packaging follows symbolic links and may disclose files outside the skill directory

Content

View full analysis

/home/victim/.config/application/credentials.json ``` 3. The victim imports the skill and runs `scripts/package_skill.py` against it. 4. `rglob('*')` discovers the symbolic link. 5. `file_path.is_file()` follows the link and returns true if its ...[truncated 929 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: eval-viewer/generate_review.py:288

Finding

Review server startup terminates unrelated processes occupying the selected port

Content

View full analysis

None: """Kill any process listening on the given port.""" try: result = subprocess.run( ["lsof", "-ti", f":{port}"], capture_output=True, text=True, timeout=5, ) for pid_str in result.stdout.strip().split("\n"): if pid_str.strip(): try: os.kill(int(pid_str.strip()), signal.SIGTERM) except (ProcessLookupError, ValueError): pass if result.stdout.strip(): time.sleep(0.5) except subprocess.TimeoutExpired: pass except FileNotFoundError: print("Note: lsof not found, cannot check if port is in use", file=sys.stderr) ``` The function is invoked unconditionally before the server attempts to bind: ```python # Kill any existing process on the target port port = args.port _kill_port(port) handler = partial(ReviewHandler, workspace, skill_name, feedback_path, previous, benchmark_path) try: server = HTTPServer(("127.0.0.1", port), handler) except OSError: # Port still in use after kill attempt — find a free one server = HTTPServer(("127.0.0.1", 0), handler) port = server.server_address[1] ``` ### Technical Analysis Serving a local review page does not require control over unrelated processes. The program nevertheless performs a destructive action before determining whether the requested port is available. The implementation does not verify: - Whether the listener belongs to this review tool. - Whether the process was launched by the current invocation. - Whether the user intended to stop it. - Whether terminating it could cause ...[truncated 1975 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about repository-maintenance help for skills: adding/importing skills, refactoring structure, improving triggers, adding smoke tests, and benchmarking skill quality before merge. The supplied code does not implement those functions. Its primary purpose is an eval-results viewer and feedback server. It discovers runs in a workspace, reads prompts/outputs/grading data, embeds text/images/PDFs/binaries into HTML, serves the page over localhost, accepts POSTed feedback, and can terminate an existing process on the selected port. Those are materially different capabilities from skill creation/migration/refactoring/testing support. No declared permissions are listed, yet the code performs filesystem reads/writes, subprocess execution, signal-based process termination, and local network serving; these are significant undeclared behaviors rather than incidental implementation details. Therefore the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

There is a material description-to-behavior mismatch. The declared purpose presents a broad repository skill-engineering assistant used for adding/importing/refactoring skills, improving triggers, adding tests, or benchmarking before merge. The actual code chunk does not implement those capabilities. Instead, it specifically loads benchmark run artifacts from disk, calculates statistics, generates benchmark summaries, and writes JSON/Markdown reports. Benchmarking is mentioned in the description, but only as one of several broad use cases; this code supports only a narrow subtask of benchmark aggregation/reporting and does not represent the larger declared behavior. No suspicious extra permissions or hidden external access are evident beyond local filesystem I/O for reading run data and writing outputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a multi-purpose repository optimization skill covering creation, migration, imports, structural refactors, smoke tests, and benchmarking. The supplied code does not implement those broad repository-management capabilities. Its primary function is specifically to improve a skill description based on eval results using the Anthropic API. While this could be one small part of 'improving trigger descriptions,' the declared purpose is much broader and would lead a user to expect many unrelated capabilities that are absent here. The code also performs undeclared external model calls and optional transcript logging, which are concrete behaviors not reflected in the declaration. Therefore, the description does not accurately represent the actual code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broad repository-maintenance and skill-development utility for adding/importing/refactoring/improving/testing/benchmarking skills. The supplied code chunk instead implements a specific packaging tool: it checks that a skill directory exists, ensures SKILL.md is present, runs validate_skill, excludes certain files, and writes a .skill archive. Packaging/distribution is a materially different primary purpose from the declared creation/migration/optimization/testing functions, and this packaging capability is undeclared. The validation step is only supporting behavior, but the main behavior is clearly archive creation, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared purpose describes a broad repository-maintenance skill used to create, migrate, import, refactor, test, and benchmark skills. The supplied code instead performs a narrow, concrete function: validating SKILL.md frontmatter and specific metadata constraints in a target skill directory. This is a materially different primary purpose. While validation could be a supporting activity in skill development, the description does not mention validation or schema checking, and none of the listed triggers align with running a CLI metadata validator.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

- Every skill must include `SKILL.md` frontmatter with `name` and `description`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

- Every skill must include `SKILL.md` frontmatter with `name` and `description`.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/run_eval.py (reported line 23)May include surrounding context.

python

def find_project_root() -> Path:
    """Find the project root by walking up from cwd looking for .claude/.

    Mimics how Claude Code discovers its project root, so the command file
    we create ends up where claude -p will look for it.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/run_eval.py (reported line 83)May include surrounding context.

python

# Remove CLAUDECODE env var to allow nesting claude -p inside a
        # Claude Code session. The guard is for interactive terminal conflicts;
        # programmatic subprocess usage is safe.
        env = {k: v for k, v in os.environ.items() if k != "CLAUDECODE"}

        process = subprocess.Popen(
            cmd,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill describes actions that invoke local scripts, read and write repository files, and run shell commands, but it does not declare any explicit tool scope such as allowed-tools or permissions. In a repository-modifying skill, that omission weakens operator visibility and policy enforcement, increasing the chance of unintended filesystem or command execution beyond what users expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction states that all skills/**/SKILL.md content must stay English-only. This is a natural-language locale restriction, and the file does not offer a user choice or explain a justified region-specific requirement for enforcing English.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Lines L189-L190 state that for benchmark results the analyzer's purpose is to surface patterns and anomalies, not suggest skill improvements. Earlier in the same file, the analyzer is explicitly instructed to identify loser weaknesses and generate actionable improvement suggestions, creating contradictory documentation about what this analyzer does.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The grader is instructed to verify claims against external sources, even though its primary role is to assess expectations using the transcript and produced outputs. This expands trust boundaries and can introduce nondeterminism, data exfiltration risk, or prompt-injection influence from untrusted external content, causing grading decisions to depend on information outside the evaluated run.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The viewer kills any process bound to the requested port before starting, regardless of ownership, purpose, or whether the user explicitly approved terminating it. In a local developer environment this can disrupt unrelated services, destroy active sessions, or interfere with security tooling, which exceeds the stated purpose of merely serving a review page.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · eval-viewer/generate_review.py (reported line 291)May include surrounding context.

python

def _kill_port(port: int) -> None:
    """Kill any process listening on the given port."""
    try:
        result = subprocess.run(
            ["lsof", "-ti", f":{port}"],
            capture_output=True, text=True, timeout=5,
        )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The main flow invokes the kill helper automatically on startup, with no warning or confirmation at the point of action, so a normal launch can terminate unrelated local processes unexpectedly. In this skill context, a review-page generator has little justification for destructive system-wide side effects, making the behavior more dangerous than in an admin utility explicitly designed for port management.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends full skill content, eval queries/results, and prior attempt history to Anthropic, which can expose proprietary or sensitive repository data to a third-party service. In this repository-maintenance context, external model use may be functionally intended, but the broad prompt payload is still a real data-exposure risk if skills or eval data contain secrets, internal prompts, or user-derived content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The model call transmits skill content plus eval/query data to an external API without any disclosure or gating in this file, creating a confidentiality and privacy risk. If eval queries or skill files contain customer data, secrets, or internal instructions, they may be unnecessarily exposed outside the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The CLI advertises --verbose as 'Print thinking to stderr', and the function captures detailed model thinking derived from prompts containing skill content, history, and eval queries. This creates a disclosure risk because sensitive or proprietary material may be echoed to terminal logs without any warning in the file.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_eval.py (reported line 85)May include surrounding context.

python

# programmatic subprocess usage is safe.
        env = {k: v for k, v in os.environ.items() if k != "CLAUDECODE"}

        process = subprocess.Popen(
            cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.DEVNULL,

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown skill instructs the agent to save structured analysis to output_path, which is a file-writing operation that can affect user data or the filesystem. The document does not include any warning, confirmation, or disclosure about overwriting or creating files when performing this action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The benchmark-analysis section tells the agent to save notes to output_path as a JSON array, which is another file write affecting the user's filesystem. The markdown does not warn the user that this skill writes output files or clarify overwrite behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to write a JSON results file to a specified path or a default filename, but it does not require confirming the destination, checking for existing files, or warning about overwriting local data. In an agent setting where paths may come from upstream inputs, this can lead to unintended file modification or overwrite of user workspace artifacts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The top-level documentation frames the behavior narrowly as using eval results, while the prompt construction additionally includes complete skill content and prior optimization history before invoking the model. This is not just omitted detail in implementation flow; it changes the actual inputs the script relies on when producing output.

Content

No source excerpt is available for this finding.