qwencloud-deploy

• Outcome: Review
• Latest audit: Jul 29, 2026 · 4:01 PM UTC
• Version: 1.0.0

Overview

This is a coherent cloud deployment skill, but it can automatically change a cloud account state and perform broad, high-impact deployment/domain actions that deserve Review before installation.

Install only if you are comfortable giving the agent configured Alibaba Cloud CLI credentials for provisioning, updating, deleting, and troubleshooting cloud resources. Before use, confirm the target account/region, review the project for secrets, avoid generic deploy prompts unless you intend Alibaba Cloud, and require explicit approval before OSS activation, paid domain registration, DNS changes, and deletion.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (44)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""
    print("[bucket] OSS service not activated — activating automatically "
          "(activation is free; usage is billed)...", file=sys.stderr)
    r = subprocess.run(["aliyun", "ossadmin", "OpenOssService"],
                       capture_output=True, text=True)
    out = (r.stderr + r.stdout).lower()
    if r.returncode == 0 or any(k in out for k in ("already", "opened", "order.process", "success")):

• Confidence: 91% confidence
• Finding: r = subprocess.run(["aliyun", "ossadmin", "OpenOssService"], capture_output=True, text=True)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill directs execution of shell commands, network operations, and file reads/writes, yet declares no explicit permissions or capability boundaries. In a deployment skill that provisions public cloud infrastructure and writes state locally, this creates a dangerous mismatch: the agent may perform high-impact actions without transparent scoping, user-reviewable authorization, or least-privilege constraints.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill metadata says it targets Alibaba Cloud International, but the reference is explicitly framed as 'aliyun CLI' and documents China-site style tooling/API usage. In a deployment skill that provisions public-facing infrastructure, this mismatch can cause users or the agent to operate against the wrong control plane, account environment, or compliance boundary, leading to unintended resource creation, billing, credential misuse, or deployment into an incorrect jurisdiction.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The reference includes stack and bucket deletion flows that remove all resources and artifacts, while the skill description emphasizes deployment/update rather than destructive teardown. In an automation context, undocumented destructive capability increases the risk of accidental data loss or operator surprise, especially if cleanup is triggered during rollback, update, or troubleshooting without explicit user awareness.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation repeatedly references Aliyun China-specific tooling, consoles, permissions, and services in a skill explicitly scoped to Alibaba Cloud International. This can misdirect operators into using the wrong control plane or credentials, causing failed deployments, accidental use of the wrong account/region, or exposure of infrastructure and secrets in an unintended environment. In a deployment skill that provisions public-facing services and cloud resources, that ambiguity materially increases operational and security risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This documentation expands the skill from cloud deployment into domain brokerage and paid domain registration workflows, including account/profile creation and purchase execution. That scope expansion increases the chance of unintended financial actions and user confusion about what the skill is authorized to do, especially because the skill can move from deployment assistance to initiating a paid purchase flow.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill collects a full set of registrant PII including name, email, phone, address, city, province, country, and postal code, and indicates it will be saved for future use. For a deployment skill, this is sensitive data collection beyond the core deployment function and creates privacy, retention, and misuse risk if the data is logged, stored insecurely, or reused without strong controls.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The instructions are internally inconsistent: they prohibit obtaining or reporting a numeric price, then later require confirmation using the 'real price obtained in step H2a.' In a paid workflow, this ambiguity can lead the agent to present incomplete purchase consent, confuse the user, or mishandle financial authorization.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script collects and emits source-code excerpts and environment-template contents into JSON output, which exceeds the minimum metadata needed for deployment detection. In an agent skill context, this broad collection can expose proprietary code, internal URLs, placeholder secrets, or misconfigured real credentials to downstream components or logs.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The script is labeled and structured as a pre-flight environment check, but it performs an account-side state change by attempting to activate OSS automatically. This violates user expectations for a validation step and can alter billing-enabled cloud service posture without explicit consent, which is dangerous in an automation context.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: Describing the script as a pre-flight check is misleading because the code can modify the user's cloud account by enabling OSS. Misleading semantics around side effects are security-relevant because operators may run validation steps in trusted pipelines assuming they are read-only.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The script defaults to `domain.aliyuncs.com` and uses `aliyun/alidns` APIs, which are Aliyun China-oriented endpoints, while the skill advertises deployment for Alibaba Cloud International (`alibabacloud.com`). This mismatch can route domain-management actions to the wrong control plane, causing failed operations, unexpected account/region behavior, or accidental execution against a different tenancy/environment than the user intended.

Intent-Code Divergence

High

• Confidence: 90% confidence
• Finding: The comments assert international-site behavior and rationale, but the implementation still targets Aliyun China-style domain endpoints. Misleading operational comments are dangerous in deployment automation because reviewers and users may authorize domain actions under false assumptions about which cloud/legal environment is being used.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The script intentionally auto-activates OSS service on the user's Alibaba Cloud account when it detects the service is not enabled. Even if activation itself is free, it is an account-level side effect that can lead to subsequent charges, unanticipated resource exposure, and policy violations because the user may not have explicitly authorized service enablement during artifact upload.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script invokes the `aliyun ros ValidateTemplate` CLI, which targets Aliyun/China APIs, even though the skill is explicitly scoped to Alibaba Cloud International. In a deployment skill, this cross-environment mismatch can send template metadata to the wrong control plane, fail validation unpredictably, or cause users to act on results from an unintended cloud environment, creating real confidentiality, compliance, and operational risk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script takes __BACKEND_ENTRY__ from deployment metadata, tokenizes it, and places it directly into systemd ExecStart as root. That means whoever controls deployment metadata can cause arbitrary commands or binaries from the extracted artifact to execute on the instance, turning a deployment helper into a general remote code execution mechanism.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger conditions are broad enough to match many generic 'deploy my app' or 'put this online' requests whenever no cloud platform is specified, causing this high-impact skill to activate by default. Because the skill can provision internet-accessible infrastructure and upload project artifacts, overbroad routing increases the chance of accidental invocation and unintended cloud actions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The description emphasizes convenience and outcomes but does not prominently warn that deployment uploads artifacts to Alibaba Cloud services and exposes the resulting service on a public IP. Users may therefore provide sensitive local projects or private repositories without understanding that code and configuration will be transmitted off-machine and made internet reachable.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Generating a signed OSS URL creates a bearer-style link that grants temporary access to deployment artifacts to anyone who obtains it. Without warnings or handling guidance, users may share, log, or embed the URL insecurely, exposing application packages, configuration, or proprietary code during deployment.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger condition allows the HTTPS/domain workflow to start from broad phrases like 'configure HTTPS' or 'bind domain' at any time after deployment exists. In context, that can pull the user into DNS changes, certificate issuance, or even domain-purchase-related steps without a narrowly scoped intent check, increasing the risk of accidental sensitive or paid operations.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation asks for highly sensitive registrant information but only reassures the user about WHOIS privacy, not about application-level handling of the collected data. That omission can cause users to disclose personal data without understanding storage, retention, sharing, or logging risks inside the skill ecosystem.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script reads and outputs env/template file contents without any warning, consent gate, or redaction. Even template or development env files often contain real endpoints, usernames, API key examples, or accidentally committed secrets, so exposing them through agent output increases the risk of credential and configuration leakage.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script dumps raw contents of many config files, including deployment, build, and package files, to stdout for agent consumption. Those files can contain tokens, private registry URLs, internal hostnames, and other sensitive operational details, making the broad output an unnecessary disclosure channel in a cloud-deployment skill.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The script auto-activates OSS immediately after detecting it is unavailable, without prior warning or confirmation from the user. In a deployment skill, this can cause unintended account changes and potential downstream charges, especially when users expect a non-destructive prerequisite check.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The script prints the full account ARN and account ID to stdout, which may expose sensitive cloud identity metadata in terminal logs, CI logs, or agent transcripts. While not a direct compromise, this unnecessarily broadens disclosure of account identifiers that can aid reconnaissance or leak into shared logs.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.generated_source_template_injection

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/estimate_cost.sh:10

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: reference/cli_https.md:56