Aliyun Search 1.0.0

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:58 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Alibaba Cloud search helper with disclosed credential and network requirements, though users should install its dependencies carefully.

Before installing, use a virtual environment, pin reviewed dependency versions, remove the unused requests dependency if possible, and provide Alibaba Cloud keys with only the permissions needed for UnifiedSearch. Expect search queries and optional location parameters to be sent to Alibaba Cloud.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48
• Finding: Unpinned and Unnecessary Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:48` and `scripts/search.py:51` **Vulnerability Type**: Uncontrolled third-party dependency resolution and unnecessary dependency exposure **Risk Level**: Medium ### Vulnerable Code `SKILL.md:48`: ```bash pip install aliyun-python-sdk-core requests ``` Related unused import in `scripts/search.py:51`: ```python import requests ``` ### Technical Analysis The installation instructions request `aliyun-python-sdk-core` and `requests` without specifying reviewed versions or package hashes. Consequently, package resolution depends on whichever releases the configured Python package index serves at installation time. The effective installed code can therefore change after this Skill has been reviewed. A compromised upstream release, package-index compromise, or unsafe index configuration could cause malicious package installation or import-time code to execute with the privileges of the user installing or running the Skill. The `requests` package is imported but never used, meaning it expands the supply-chain and transitive-dependency attack surface without supporting the implemented Alibaba Cloud SDK request flow. This finding does not establish that the currently published packages are malicious. The vulnerability is the absence of dependency integrity controls and the inclusion of an unnecessary dependency. ### Attack Path 1. An attacker compromises an allowed dependency release or the package index used by the victim, or influences dependency resolution through an unsafe package-index configuration. 2. A user follows the documented command: ```bash pip install aliyun-python-sdk-core requests ``` 3. `pip` resolves and installs the attacker-controlled package version because no exact version or cryptographic hash is required. 4. Malicious installation hooks or package code execute with the installing user's privileges. 5. If malicious code remains in the installed package, it may execu ...[truncated 628 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `requests` from the installation instructions and delete its unused import from `scripts/search.py`. 2. Pin every required direct and transitive dependency to a reviewed version in a lock file. 3. Require cryptographic hashes during installation, for example by maintaining a hash-locked requirements file and installing it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Generate dependency locks from a trusted package index and review package names carefully to prevent typosquatting or dependency confusion. 5. Use an isolated virtual environment and avoid installing the Skill as a privileged or administrative user. 6. Add automated dependency vulnerability and provenance checks to the release process, and update pinned versions only after review and testing. ]]>

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation indicates capabilities involving environment variables and outbound network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates a mismatch between what the skill can do and what a reviewer or runtime policy may expect, increasing the risk of unintended secret access or unsanctioned external communication.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This code file contains natural-language docstrings and output strings exclusively in Chinese, including the module description and function documentation. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation.

Static analysis

No suspicious patterns detected.