ClawHub
Back to skill

Security audit

Alibaba Cloud Media VOD

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Alibaba Cloud VOD management, but it gives agents high-impact cloud media authority and asks them to save sensitive operation evidence without enough deletion-confirmation or redaction guidance.

Install only if you are comfortable giving the agent access to an Alibaba Cloud identity scoped for the exact VOD task. Use least-privilege RAM or STS credentials, require explicit confirmation before DeleteVideo or other destructive changes, and redact or delete saved evidence that contains upload authorization, playback authorization, signed URLs, tokens, or sensitive media identifiers.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
references/templates.md:43
Finding

Unredacted Persistence of Authorization-Bearing API Responses

Content
View full analysis
` ## Evidence Checklist - Save request payloads and API responses under `output/aliyun-vod-manage/`. - Keep a mapping of input file names to returned media IDs. ``` The affected instruction is: ```markdown - Save request payloads and API responses under `output/aliyun-vod-manage/`. ``` ### Technical Analysis The evidence policy instructs the agent to persist complete request payloads and API responses without requiring secret-field redaction, restrictive file permissions, encryption, or retention limits. This workflow explicitly includes authorization-producing operations such as `CreateUploadVideo` and `GetVideoPlayAuth` in `references/templates.md:5-25`. Responses from these operations may contain temporary upload credentials, upload authorization data, playback authorization material, or signed resource information. Persisting complete responses can therefore place reusable authorization data in plaintext under the output directory. The risk is not caused by the metadata-download script, which only retrieves public OpenAPI metadata and does not access credentials. It arises when the broader Skill workflow applies the evidence instruction to authenticated VOD operations. ### Attack Path 1. A user invokes the Skill for an operation such as `CreateUploadVideo` or `GetVideoPlayAuth`. 2. Alibaba Cloud returns temporary upload or playback authorization material. 3. Following the evidence checklist, the agent saves the complete API response under `output/aliyun-vod-manage/`. 4. The generated file inherits default filesystem permissions and remains available without a defined deletion period. 5. Another local user, a ...[truncated 953 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Tainted flow: 'timeout' from os.getenv (line 30, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/list_openapi_meta_apis.py (reported line 19)May include surrounding context.

python
def fetch_json(url: str, timeout: int) -> dict:
    req = urllib.request.Request(url, headers={"User-Agent": "codex-skill"})
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        return json.loads(resp.read().decode("utf-8"))

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared purpose says the skill manages VOD resources and workflows, but the described executable behavior primarily performs API metadata discovery, external fetches, and local artifact generation rather than actual VOD operations. This mismatch can mislead users and higher-level agents about what the skill will do and what data it may access or transmit, undermining informed consent and safe orchestration.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill uses capabilities with security implications—environment credential access, outbound network access, and local file writes—without declaring an explicit tool scope or permission boundary. This makes the operational trust model unclear and can enable broader-than-expected access when the skill is invoked, especially because it handles cloud credentials and writes execution artifacts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Validation

bash
mkdir -p output/aliyun-vod-manage
python -m py_compile skills/media/vod/aliyun-vod-manage/scripts/list_openapi_meta_apis.py
echo "py_compile_ok" > output/aliyun-vod-manage/validate.txt

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly instructs operators to preserve region, media IDs, template IDs, and request parameters in evidence files, but provides no minimization, masking, retention, or privacy guidance. Those artifacts can contain sensitive operational metadata, identifiers, and request details that may expose customer assets or facilitate later abuse if logs are shared or retained insecurely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The template documents a permanent delete operation (DeleteVideo) with only raw parameter guidance and no warning, confirmation step, or mention of irreversibility. In an agent skill context, this increases the chance that an operator or autonomous workflow will execute destructive actions without adequate user intent verification, leading to accidental media loss.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 3)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 4)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 5)May include surrounding context.

md
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/list_openapi_meta_apis.py (reported line 35)May include surrounding context.

python
output_dir.mkdir(parents=True, exist_ok=True)

    url = (
        f"https://api.aliyun.com/meta/v1/products/{args.product_code}"
        f"/versions/{args.version}/api-docs.json"
    )
    payload = fetch_json(url, timeout)