Security audit
Security checks for vulnerabilities and agentic risk
This Aliyun OSS skill mostly matches its storage-management purpose, but it persists cloud secrets in shell startup files and has unsafe deletion behavior that users should review before installing.
Review carefully before installing. Use a narrowly scoped Aliyun RAM/STS credential, avoid passing secrets in shell history, remove any generated exports from shell startup files, rotate credentials if already used, and do not rely on the documented delete confirmation unless the implementation is fixed.
scripts/setup.sh:237Long-Lived OSS Credentials Exposed Through Command Arguments and Shell Startup Files
scripts/oss_node.mjs:317Object Deletion Proceeds Without the Advertised Confirmation
docs/EXAMPLES.md:228Shell Command Injection in Documented Automation Examples
package.json:11Mutable and Unlocked Dependency Installation
The documented purpose focuses on OSS object operations, but the detected behavior includes credential persistence to shell profiles, local storage of AccessKey secrets, and environment/package installation. This mismatch is dangerous because users may grant trust for routine storage actions without realizing the skill also modifies the host environment and persists sensitive credentials.
Referenced artifact was not completely inspected
node scripts/oss_node.mjs test-connection
Referenced artifact was not completely inspected
node scripts/oss_node.mjs test-connection
Referenced artifact was not completely inspected
node scripts/oss_node.mjs test-connection
Referenced artifact was not completely inspected
node scripts/oss_node.mjs test-connection
Referenced artifact was not completely inspected
node scripts/oss_node.mjs test-connection
Referenced artifact was not completely inspected
node scripts/oss_node.mjs test-connection
Referenced artifact was not completely inspected
node scripts/oss_node.mjs test-connection
Appending cloud credentials to the user's shell startup file without explicit consent creates durable plaintext secret exposure and automatically re-loads those credentials into future shells. This broadens the blast radius because many unrelated programs and scripts may inherit the secrets, making accidental leakage and abuse more likely.
This markdown file documents object deletion as a feature and includes an example using delete --force, but it does not warn that the action may permanently remove remote data. For markdown files, destructive behaviours that can affect user data should include an explicit warning about impact and caution around use.
The skill advertises shell-based setup and execution commands but does not declare any tool scope such as permissions or allowed-tools. That omission weakens policy enforcement and makes it harder to constrain what the skill may execute, increasing the chance of unintended command execution during installation or operation.
The documentation instructs users to provide AccessKey ID and AccessKey Secret directly in commands and configuration examples without any warning about secret exposure. This is dangerous because command-line arguments may be captured in shell history or process listings, and plaintext config storage can leak long-lived cloud credentials.
The skill exposes delete functionality, including a force option, without warning that object removal may be irreversible or cause data loss. In a storage-management context, destructive operations are expected, but the absence of safety guidance increases the risk of accidental deletion by users or agents.
The file includes multiple natural-language placeholder values in Chinese, which imposes a specific language on users without any opt-in or documented locale justification. Per policy, forcing a specific language or locale without user choice is a natural-language policy violation.
The examples document includes destructive operations such as forced deletion and batch deletion without prominent warnings about irreversibility, dry-run guidance, or safeguards like confirmation for bulk actions. In a storage-management skill, users may copy-paste these commands directly, increasing the chance of accidental permanent data loss.
The automated backup script performs both local and cloud cleanup automatically, including force deletion of cloud objects based on computed age, without safety checks such as dry-run mode, prefix validation, logging review, or recovery guidance. Because this is automation in a storage skill, a logic error, time calculation mistake, or unexpected file metadata could lead to large-scale unintended deletion.
The delete command prints a warning implying an interactive confirmation, but the code performs the deletion immediately regardless of user response because no actual prompt is implemented. This can mislead users and automation into believing there is a safety gate, increasing the risk of accidental irreversible object deletion.
Batch deletion enables destructive multi-object removal from a user-supplied file with no warning, preview, or confirmation step. In the context of an OSS management skill, this materially increases the chance of large-scale accidental data loss from malformed input files, operator mistakes, or unsafe automation.
The script persists cloud credentials to a local JSON config file on disk without any warning, confirmation, or safer secret-handling option. Even with chmod 600, plaintext secrets at rest are vulnerable to endpoint compromise, insecure backups, accidental inclusion in archives, and later mishandling by other tools.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
EOF
# 设置权限
chmod 600 "$CONFIG_FILE"
log_info "✅ 配置文件已创建: $CONFIG_FILE"
}
The script writes OSS access credentials directly into the user's shell startup file as exported environment variables, causing long-lived secret persistence in plain text. This increases exposure to local compromise, accidental disclosure via dotfile backups or support bundles, and unintended inheritance by child processes.
A language or locale policy issue can arise when a skill effectively forces a specific language without offering user choice or documenting that constraint. This README presents all user-facing instructions in Chinese and does not indicate that the language is optional or region-specific.
The natural-language instructions and examples are presented only in Chinese, which may force a specific language on users without opt-in. The policy allows locale constraints when they are explicitly optional or clearly justified, but no such choice or justification is provided here.
The manifest description is written only in Chinese ("阿里云 OSS 对象存储技能"), which indicates a language-specific presentation without any indication of user opt-in or multilingual support. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation unless clearly justified as region-specific.
This is a manifest/config JSON file, so SQP-1 applies. The example values use natural-language placeholders in Chinese but provide no surrounding description of scope, usage context, or constraints, making the intended audience and activation context of this example unclear.
No suspicious patterns detected.