ClawHub
Back to skill

Security audit

Alibaba Cloud OSS

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Alibaba Cloud OSS helper that uses OOMOL's oo CLI to list, upload, generate URLs for, and delete OSS objects with safety prompts for changes.

Install this only if you want OOMOL's oo CLI to operate on your Alibaba Cloud OSS account. Check the exact bucket, object key, payload, and effect before approving uploads, presigned URLs that allow upload/delete, or object deletion.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill description explicitly says to use this skill for ANY Alibaba Cloud OSS request, which is overly broad and can cause the agent to invoke this skill in situations where a narrower or safer tool choice would be more appropriate. Because the skill includes both read and destructive operations, broad auto-selection increases the chance of unintended data access, uploads, or deletions from loosely matched user prompts.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.