Coding Plan Usage

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:19 AM UTC
• Version: 1.0.3

Overview

This skill appears intended to check Alibaba Cloud Coding Plan usage, but it uses authenticated browser automation with persistent session state, saved login screenshots, and a global third-party dependency that users should review before installing.

Install only if you are comfortable letting a third-party browser automation tool interact with an Alibaba Cloud login session. Prefer a pinned, locally installed agent-browser version, use a least-privileged Alibaba Cloud account, review any .env settings, and delete the saved login screenshot after scanning the QR code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:39

Finding

Unpinned Global Installation of a Third-Party npm Dependency

Content

View full analysis

Vulnerability Details

File Location: README.md:39-40
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

bash

npm install -g agent-browser
agent-browser -V

Technical Analysis

The documented recovery procedure installs agent-browser from the npm registry without specifying an audited version or verifying package integrity or provenance. npm therefore resolves the mutable latest release available at installation time.

The -g option installs the package into the user's global npm environment. During installation, npm may execute package lifecycle scripts with the privileges of the user running the command. Merely checking the installed version afterward does not verify the package's integrity or establish that its contents correspond to an audited release.

Although the README links to the expected upstream repository, the installation command does not bind the downloaded package to that repository, a source commit, an integrity digest, or a reviewed package version.

Attack Path

1. The local system does not have the required agent-browser executable.
2. The user or Agent follows the documented dependency installation procedure.
3. npm install -g agent-browser resolves the current package release from the npm registry.
4. An attacker who has compromised the package, a maintainer account, or a future release supplies malicious package contents or lifecycle scripts.
5. npm executes the malicious installation logic with the invoking user's privileges and installs attacker-controlled code globally.
6. The Skill subsequently invokes the installed executable while interacting with an authenticated Alibaba Cloud browser session.
7. The compromised dependency can misuse accessible local resources or browser-session data.

Impact Assessment

Successful exploitation provides code execution with the privileges of the user who performs the npm installation. The access ...[truncated 730 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin agent-browser to a specific reviewed version rather than resolving the latest release:

   bash

   npm install --save-exact agent-browser@0.17.1
   

2. Prefer a project-local installation over npm install -g and invoke the dependency through a package script or its explicit local path.

3. Commit package.json and the generated lockfile so dependency versions and integrity hashes are reproducible.

4. Review transitive dependencies and package lifecycle scripts before approving updates.

5. Use trusted registry configuration and verify package provenance, publisher identity, signatures, or published integrity data where supported.

6. In controlled environments, consider installing with lifecycle scripts disabled after confirming that the package does not require them:

   bash

   npm ci --ignore-scripts
   

7. Run browser automation in an isolated environment with minimal filesystem and environment-variable access.

8. Use a dedicated, least-privileged Alibaba Cloud account or session for this workflow.

9. Establish an explicit dependency-update process that reviews and tests each version before changing the pin.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description frames the skill as a simple usage query, but the body reveals browser automation, login-page navigation, QR-code screenshot capture, session handling, and possible dependency installation. This mismatch is dangerous because it hides materially sensitive behavior from reviewers and users, weakening informed consent and allowing account interaction and network activity under an understated description.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

1. 直接运行 Python 脚本 `scripts/aliyun.py`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

1. 直接运行 Python 脚本 `scripts/aliyun.py`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

1. 直接运行 Python 脚本 `scripts/aliyun.py`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/aliyun.py (reported line 49)May include surrounding context.

python

candidates = []
        try:
            script_dir = os.path.dirname(os.path.abspath(__file__))
            script_sibling_env_path = os.path.join(os.path.dirname(script_dir), ".env")
            if os.path.exists(script_sibling_env_path):
                candidates.append(script_sibling_env_path)
                return candidates

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/aliyun.py (reported line 58)May include surrounding context.

python

candidates = []
        try:
            script_dir = os.path.dirname(os.path.abspath(__file__))
            script_sibling_env_path = os.path.join(os.path.dirname(script_dir), ".env")
            if os.path.exists(script_sibling_env_path):
                candidates.append(script_sibling_env_path)
                return candidates

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The natural-language instructions in the README are entirely in Chinese, which can impose a language requirement on users without opt-in. The file does not indicate that the skill is intentionally region-specific or provide an alternative language option.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest says the skill queries remaining Alibaba Cloud Coding Plan hours using a command-line tool. However, the documentation states the tool depends on agent-browser, supports persistent browser sessions and UI mode, and instructs global installation of that browser automation utility, which is a materially broader capability than a straightforward usage query.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs execution of a Python script, dependency installation decisions, and file creation, but it does not declare any tool scope or permissions. This is dangerous because an agent may invoke shell, filesystem, and environment-dependent behavior without explicit policy boundaries or user-visible consent, increasing the chance of unintended command execution or data access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill automatically navigates to Alibaba Cloud login pages and interacts with an account session without clearly warning about external network access and account-affecting automation. This is dangerous because automated browsing can trigger unintended authentication flows, session persistence, or data disclosure, especially when users believe they are only requesting a read-only usage check.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill automatically navigates to Alibaba Cloud login pages and interacts with an account session without clearly warning about external network access and account-affecting automation. This is dangerous because automated browsing can trigger unintended authentication flows, session persistence, or data disclosure, especially when users believe they are only requesting a read-only usage check.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/aliyun.py (reported line 116)May include surrounding context.

python

print(f"DEBUG: PATH environment variable: {os.environ.get('PATH', '')}")

            # 使用utf-8编码避免UnicodeDecodeError
            result = subprocess.run(cmd, capture_output=True, text=True, encoding='utf-8', errors='replace', check=True)
            return result.stdout, None
        except subprocess.CalledProcessError as e:
            # 输出错误信息，无论是否在开发模式下

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill claims to query Coding Plan usage, but it also initiates an interactive login flow, navigates to login pages, waits for QR login, and captures a login screenshot to disk. This exceeds the stated purpose and creates unnecessary exposure of authentication state and user session artifacts in a security-sensitive cloud account context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill writes a login screenshot to disk during the authentication flow without prior user-facing warning or consent. Screenshots of login pages can capture QR codes, account details, or other sensitive authentication artifacts and persist them longer than necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The markdown directs the user/AI to run npm install -g agent-browser, which modifies the system's global Node.js environment. The description provides installation steps but does not include any warning that this changes the host system or may require appropriate permissions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Most operational instructions and output guidance are presented only in Chinese, which effectively forces a specific language for users of the skill. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

For a skill presented as querying Coding Plan usage, scanning local .env files and process environment variables is an additional capability not stated in the manifest. While used for configuration, this local secret/config discovery behavior is not obviously justified from the narrow user-facing description alone.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code executes an external local binary whose path can be influenced by .env content or PATH lookup via shutil.which. In an agent/skill context, this can result in execution of an unintended or trojaned binary if the environment or working directory is attacker-controlled.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.