ClawHub
Back to skill

Security audit

dataworks-diagnoser

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Alibaba Cloud DataWorks troubleshooting skill that needs careful credential and log handling but does not show hidden, destructive, or unrelated behavior.

Install only if you need to diagnose Alibaba Cloud DataWorks failures. Use a least-privilege RAM AccessKey limited to the documented read operations, prefer environment variables or a protected Aliyun profile over command-line secrets, set restrictive permissions on any credentials file, and treat fetched logs and saved reports as sensitive because they may contain SQL, endpoints, stack traces, or secrets.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Content
```

**Option B: Config File**
Create `~/.alibabacloud/credentials`:
```json
{
  "access_key_id": "your_access_key",
Confidence
83% confidence
Finding
The skill recommends storing long-lived cloud access keys in a local credentials file under the user's home directory. Persistent credential storage increases the chance of credential theft from disk, accidental backup/sync exposure, overly broad file permissions, or reuse beyond the immediate task; this is more sensitive here because the skill explicitly handles Alibaba Cloud API access.

Static analysis

No suspicious patterns detected.