alibaba devops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:22 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Alibaba Cloud DevOps integration, but it combines broad DevOps mutation authority with unpinned runtime package execution and unsafe token-handling examples.

Review before installing. Use only reviewed and pinned versions of `mcporter` and `alibabacloud-devops-mcp-server`, avoid pasting real tokens directly into commands, prefer a secret manager or protected environment injection, and use short-lived least-privilege Yunxiao tokens. Treat write, delete, pipeline, deployment, ownership, and variable-management tools as production-impacting actions that should require explicit user confirmation and rollback planning.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:19

Finding

Unpinned npm Packages Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 19; the same unsafe pattern is repeated on lines 24, 32, 37, and throughout the workflow examples.
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code:

bash

npx -y mcporter list --stdio "npx -y alibabacloud-devops-mcp-server" --schema

Technical Analysis

The documented command uses npx -y to download and immediately execute mcporter and alibabacloud-devops-mcp-server without specifying exact versions. The project contains no lockfile, integrity hash, vendored source, or other mechanism that constrains which package contents will execute.

Because the -y option automatically accepts package installation, following the documented instructions can execute whatever package version the npm registry resolves at that time. The effective executable payload can therefore change after this Skill has been reviewed.

This is especially sensitive because the nested MCP server is intended to receive YUNXIAO_ACCESS_TOKEN and expose operations that can modify repositories, execute pipelines, manage deployments, alter variables, and delete resources.

Attack Path

1. An attacker compromises the npm publisher account, package registry path, or a future package release.
2. The attacker publishes altered code under either package name.
3. A user or agent follows the Skill instructions and invokes the unpinned npx -y command.
4. npm downloads and executes the attacker-controlled release without an interactive confirmation.
5. The malicious package reads accessible credentials, including the Yunxiao token when configured.
6. The package exfiltrates credentials or directly invokes DevOps operations using the victim's privileges.

Impact Assessment

Successful exploitation provides arbitrary code execution under the account running npx. Local files, environment variables, process-accessible creden ...[truncated 469 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin both packages to exact, reviewed versions, for example mcporter@X.Y.Z and alibabacloud-devops-mcp-server@A.B.C.
2. Install dependencies through a committed lockfile using a reproducible command such as npm ci.
3. Verify package integrity through lockfile integrity values, trusted provenance, signatures, or independently recorded checksums.
4. Document the expected package publisher and source repository so package identity can be verified before installation.
5. Avoid runtime installation for production or privileged use. Prefer a reviewed, prebuilt artifact or vendored dependency set.
6. Run the MCP server in a restricted container or sandbox with minimal filesystem and network access.
7. Supply a short-lived, least-privilege token that permits only the operations required for the current task.
8. Apply the pinned-version pattern to every repeated npx command in SKILL.md.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:47

Finding

Cloud Access Token Is Passed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 47
Vulnerability Type: Sensitive credential exposure through process arguments and command history
Risk Level: Medium

Vulnerable Code:

bash

npx -y mcporter call --stdio "npx -y alibabacloud-devops-mcp-server" --env YUNXIAO_ACCESS_TOKEN=your-token <tool_name> ...

Technical Analysis

The instructions recommend replacing your-token with a Yunxiao access token directly in the command line. A real token supplied this way may be retained in shell history, terminal transcripts, debugging output, CI job logs, audit telemetry, or command invocation records.

Depending on operating-system and process-isolation controls, command-line arguments may also be observable through process inspection while the command is running. The exposure is not caused by the placeholder itself, but by the documented method users are instructed to use when substituting an actual credential.

Attack Path

1. A user replaces your-token with a valid Yunxiao access token.
2. The user executes the documented command in a shell, CI runner, or automated environment.
3. The complete command is recorded in shell history, logs, terminal capture, or process metadata.
4. Another local user, administrator, compromised process, or log reader retrieves the token.
5. The attacker authenticates to the Yunxiao APIs or MCP tooling with the recovered token.
6. The attacker performs any DevOps operation authorized by the token until it expires or is revoked.

Impact Assessment

The attacker can impersonate the token holder within the token's granted scope. Potential access includes organization and member information, source repositories, work items, pipelines, deployment records, application configuration, variable groups, artifacts, and test-management data.

If the token has write or deployment privileges, the attacker may also modify source files, run pipelines, trigg ...[truncated 223 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not place the token value directly in command-line arguments.
2. Load the token into the process environment from a protected secret manager, credential helper, or permission-restricted environment file.
3. If shell export is required, obtain the value through a non-echoing prompt or secret-manager command rather than writing it as a literal command.
4. Ensure CI systems inject the token through masked secret variables and disable command echoing for credential-handling steps.
5. Prevent child processes and diagnostic output from printing the environment or token.
6. Use short-lived, narrowly scoped tokens and separate read-only credentials from credentials capable of modification or deployment.
7. Rotate the token immediately if it has appeared in shell history or logs, and remove retained copies where operationally possible.
8. Add explicit documentation warning users not to paste real credentials into commands, tickets, prompts, source files, or logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (36)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The MCP server package is invoked directly through unpinned npx, so the actual code executed can change over time without review. Because this server is designed to operate against Alibaba Cloud DevOps resources using an access token, supply-chain compromise could lead to token theft or unauthorized DevOps actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The MCP server package is invoked directly through unpinned npx, so the actual code executed can change over time without review. Because this server is designed to operate against Alibaba Cloud DevOps resources using an access token, supply-chain compromise could lead to token theft or unauthorized DevOps actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This example again uses unpinned npx -y mcporter, which trusts the latest registry version at runtime. Even though this instance lists schema information, the same package-execution supply-chain risk applies because arbitrary package code runs before any tool interaction occurs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The MCP server package is executed without a pinned version in an example intended for operational use. Because this package mediates access to repositories, pipelines, and deployment actions, any malicious upstream update could obtain the access token and perform high-impact changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The MCP server package is executed without a pinned version in an example intended for operational use. Because this package mediates access to repositories, pipelines, and deployment actions, any malicious upstream update could obtain the access token and perform high-impact changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The server package is also unpinned here, making the exact executed code non-deterministic and dependent on the current registry state. Because the skill requires an access token and supports state-changing operations, the blast radius of a supply-chain compromise is substantial.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The server package is also unpinned here, making the exact executed code non-deterministic and dependent on the current registry state. Because the skill requires an access token and supports state-changing operations, the blast radius of a supply-chain compromise is substantial.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation instructs users to provide a required YUNXIAO_ACCESS_TOKEN and even shows inline passing of the token value, but it does not warn about secret handling, shell history exposure, process-list leakage, or least-privilege scoping. In a DevOps integration with broad organizational capabilities, poor token handling can lead directly to unauthorized access and platform-wide actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This is the most dangerous unpinned invocation because it directly combines npx execution of the MCP server with an access token provided through the command. A compromised package version could immediately capture the token and abuse broad DevOps capabilities such as code modification, pipeline execution, or deployment actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This is the most dangerous unpinned invocation because it directly combines npx execution of the MCP server with an access token provided through the command. A compromised package version could immediately capture the token and abuse broad DevOps capabilities such as code modification, pipeline execution, or deployment actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill lists many destructive or state-changing capabilities such as deleting branches/files, updating pipelines, creating deployment changes, executing release stages, and modifying resource ownership, but it provides no caution about side effects, approvals, rollback, or production impact. That omission increases the chance that users invoke high-impact operations unintentionally or without adequate change controls.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The unpinned MCP server package is used in a common workflow example, making it likely to be copied verbatim. If the package is compromised, it could harvest repository metadata and credentials or manipulate code review operations under the user's authority.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The unpinned MCP server package is used in a common workflow example, making it likely to be copied verbatim. If the package is compromised, it could harvest repository metadata and credentials or manipulate code review operations under the user's authority.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The server package remains unpinned in an example that interacts with repository review data. In this context, package compromise could expose organizational information and facilitate unauthorized review or code-management actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The server package remains unpinned in an example that interacts with repository review data. In this context, package compromise could expose organizational information and facilitate unauthorized review or code-management actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The corresponding MCP server package is unpinned while being used to access code review details. That leaves users exposed to supply-chain attacks that can pivot from token access into repository and organizational actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The corresponding MCP server package is unpinned while being used to access code review details. That leaves users exposed to supply-chain attacks that can pivot from token access into repository and organizational actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The unpinned MCP server package here could be replaced upstream and would then run with the user's DevOps token while creating review comments. The broader danger is not the comment action itself but the package's privileged execution context and access to organizational DevOps APIs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The unpinned MCP server package here could be replaced upstream and would then run with the user's DevOps token while creating review comments. The broader danger is not the comment action itself but the package's privileged execution context and access to organizational DevOps APIs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The server package is unpinned in a pipeline-oriented workflow, increasing the seriousness because pipeline metadata and execution paths are particularly sensitive. A malicious update could inspect or alter CI/CD behavior, steal credentials, or trigger unauthorized operational actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The server package is unpinned in a pipeline-oriented workflow, increasing the seriousness because pipeline metadata and execution paths are particularly sensitive. A malicious update could inspect or alter CI/CD behavior, steal credentials, or trigger unauthorized operational actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The unpinned MCP server package is used to start pipeline runs, giving any malicious upstream change a path to both token theft and immediate operational abuse. In DevOps contexts, unauthorized pipeline execution can alter builds, deployments, and artifact production.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The unpinned MCP server package is used to start pipeline runs, giving any malicious upstream change a path to both token theft and immediate operational abuse. In DevOps contexts, unauthorized pipeline execution can alter builds, deployments, and artifact production.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The server package is unpinned while accessing pipeline run information. In a CI/CD setting, a malicious package update could use available credentials and contextual data to pivot into broader compromise or manipulate operational telemetry.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The server package is unpinned while accessing pipeline run information. In a CI/CD setting, a malicious package update could use available credentials and contextual data to pivot into broader compromise or manipulate operational telemetry.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.