ClawHub
Back to skill

Security audit

Alibaba Cloud Database RDS Supabase

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Alibaba Cloud RDS Supabase helper, but it covers powerful cloud changes and custom-agent APIs without enough explicit guardrails.

Review this skill before installing if the agent will have real Alibaba Cloud credentials. Use a least-privilege RAM role, require human confirmation for deletes, stops, password resets, public endpoint, SSL, whitelist, and custom-agent changes, and avoid saving raw credentials or sensitive API responses in the output directory.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly supports destructive and security-sensitive actions such as deleting instances, resetting passwords, and modifying IP whitelist or SSL settings, but it does not require confirmation or warn the operator before making impactful changes. In an agent setting, this increases the risk of accidental service disruption, credential rotation, or security weakening from a misunderstood or overly broad user request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file documents parameters such as DatabasePassword, DashboardUsername, and DashboardPassword but provides no accompanying warning about handling secrets safely. Under the markdown-file criteria, documentation should warn when described behaviour affects user data, privacy, or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

PublicNetworkAccessEnabled and PublicEndpointEnabled can materially change external exposure of an instance, but the reference provides no warning about the security impact. Markdown descriptions should alert users when documented options can affect system integrity or data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file documents AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as configuration values, which are highly sensitive credentials, but does not warn readers about secret exposure risks. For markdown guidance, this omission matters because misuse could affect privacy and system security.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

ResetInstancePassword is a security-sensitive operation that changes access credentials, yet the reference lists parameters without any note about operational impact or secure post-rotation handling. In markdown skill documentation, such actions should include a user warning when they affect access and potentially service continuity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The reference documents custom agent creation, update, listing, and deletion APIs that materially expand the skill's effective capability beyond the manifest description of Supabase instance management. This hidden capability can mislead users and downstream policy controls, increasing the risk that the skill is used to create prompt-bearing agents or invoke tools without informed consent or proper review.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 4)May include surrounding context.

md
官方文档来源（用于后续更新）
============================

- https://api.aliyun.com/document/RdsAi/2025-05-07/overview
- https://www.alibabacloud.com/help/zh/rds/apsaradb-rds-for-postgresql/api-rdsai-2025-05-07-overview-postgresql
- https://www.alibabacloud.com/help/zh/rds/apsaradb-rds-for-postgresql/api-rdsai-2025-05-07-dir-postgresql/
- https://www.alibabacloud.com/help/zh/rds/apsaradb-rds-for-postgresql/supabase/

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The output policy directs the agent to write results to a local directory without notifying the user or constraining what may be persisted. While not as severe as direct cloud mutations, silent file writes can expose credentials, API responses, instance metadata, or other sensitive operational data to local storage unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The file is entirely written in Chinese and does not indicate that other languages are supported or that the language choice is optional. Under the policy rule for natural-language violations, a fixed language presentation without user opt-in can be considered a locale/language constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The entire reference is written only in Chinese and does not indicate that language is optional or user-selectable. The policy requires flagging language or locale constraints when a skill forces a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The entire skill reference is written in Chinese and does not indicate that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the policy, natural-language instructions that impose a specific language without user opt-in can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This file contains natural-language content only in Chinese ('官方文档来源（用于后续更新）') and provides no indication that the skill supports other languages or that Chinese-only operation is required. Under the language/locale policy, forcing a specific language without user opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.