Security audit

阿里云云效创建MR+发布+通知（全可配置）

Security checks across malware telemetry and agentic risk

Overview

This skill is coherent and not deceptive, but it can create merge requests and trigger deployment pipelines from broad natural-language prompts without a built-in confirmation step.

Install only if you control the Aliyun Yunxiao token and webhook destination, and treat this as requiring review before use in production. Use a least-privileged token, point the webhook only to an approved internal bot, remove or constrain default write-action fallbacks, and add explicit confirmation or allowlists before MR creation or deployment triggers.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tainted flow: 'CONFIG' from os.environ.get (line 13, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Content: "text": {"content": f"【云效通知】\n{content}"} } try: requests.post(CONFIG["WECOM_WEBHOOK"], json=data, timeout=5) except: pass
Confidence: 92% confidence
Finding: requests.post(CONFIG["WECOM_WEBHOOK"], json=data, timeout=5)

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill can trigger a production-affecting deployment pipeline immediately after a single natural-language request, with no confirmation, approval gate, or role check. Because intent is parsed by an LLM, prompt misunderstanding or prompt injection can cause unintended write actions that alter live systems.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The skill creates merge requests as a write action directly from natural-language input without a confirmation step. In this context the risk is lower than deployment, but an LLM parsing error or ambiguous request can still create unwanted code-review artifacts or target the wrong repository/branch.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: 该技能面向自然语言解析，并且描述中明确支持由大模型自动识别意图，但没有要求使用明确的命令前缀、确认步骤或用户身份校验。对创建 MR、触发发布这类会改变代码与环境状态的高风险操作来说，宽泛触发语义会增加误识别和误执行概率。

Vague Triggers

Medium

Confidence: 85% confidence
Finding: 这些示例包含较口语化、上下文依赖强的短语，容易与普通协作对话混淆，而技能又会自动将自然语言映射为实际 MR 或发布操作。由于该技能直接连接云效与通知系统，误触发可能导致错误合并请求创建、错误环境部署或运维噪声。

Vague Triggers

High

Confidence: 96% confidence
Finding: “线上发布”是一个极其宽泛且高敏感的触发短语，并且文档说明在未指定关键信息时可使用默认流水线。生产发布属于高风险变更操作，若模型将普通讨论、测试语句或不完整请求误判为执行命令，可能直接触发错误的线上部署。

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: 技能声明会将所有操作结果自动推送到指定 URL，包括企业通信机器人，但没有说明推送内容边界、脱敏策略、允许的目标域名或用户告知机制。MR 详情、仓库名、分支名、审核状态、部署结果等信息可能构成内部开发与发布元数据，自动外发会带来信息泄露和错误通知扩散风险。

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrases include very broad everyday terms like "发布", "上线", and especially "线上", which can easily appear in normal conversation and unintentionally invoke a skill that performs sensitive actions such as creating merge requests or triggering deployments. In this skill’s context, accidental activation is more dangerous than usual because the described capabilities affect source control, CI/CD, and notifications, potentially causing unauthorized or unintended operational changes.

Ssd 1

High

Confidence: 98% confidence
Finding: Raw user input is interpolated directly into an LLM prompt that determines whether to create MRs, query status, or trigger deployments. An attacker can craft input that semantically manipulates the parser to output a different action, repo, branch, MR ID, or flow ID than intended, which is especially dangerous because the parsed result drives real write operations.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.