AES EMR YARN Analyzer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:56 AM UTC
• Version: 1.0.0

Overview

The skill’s YARN analysis purpose is understandable, but it ships real-looking cloud and root SSH credentials and uses them in unsafe ways.

Do not install or run this skill as-is. Treat the included cloud key and root SSH password as exposed, rotate them, remove hard-coded secrets, require a non-root read-only account, enable SSH host-key verification, and replace the custom cloud authentication with the official provider SDK or signed requests.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: config/config.yaml:5
• Finding: Hard-coded cloud API and privileged SSH credentials<![CDATA[ ## Vulnerability Details **File Location**: `config/config.yaml:5-19` **Vulnerability Type**: Hard-coded secrets and excessive privileges **Risk Level**: Critical ### Vulnerable Code ```yaml access_key_id: "LTAI5t9CE8Dp4KrpyEBQCkLq" access_key_secret: "m6yMqoSMwt8UaiMZROjD3iVVUrlHn1" region_id: "cn-hangzhou" # Analysis time range time_range: "last_1d" # Data aggregation granularity granularity: "hourly" # SSH configuration ssh_host: "8.136.137.42" ssh_user: "root" ssh_password: "Aliyun2026@!" ``` ### Technical Analysis The distributed configuration contains a reusable Alibaba Cloud access key and password-based root credentials for a public IP address. Anyone able to read the project files can recover these secrets without authentication. Bundling root credentials violates least-privilege requirements because the analysis only needs read-only YARN status information. It also conflicts with the Skill documentation, which recommends placeholders, file permissions of `0600`, and read-only accounts. No file-permission enforcement or external secret-management mechanism is implemented. The audit cannot confirm whether the credentials remain active. Nevertheless, their plaintext inclusion constitutes credential disclosure and requires immediate incident response. ### Attack Path 1. An attacker obtains the Skill package, source archive, deployment image, backup, or repository history. 2. The attacker reads `config/config.yaml` and extracts the cloud access key, root password, username, and public SSH address. 3. If the credentials remain active and network access is available, the attacker attempts authentication against the Alibaba Cloud API and SSH host. 4. Successful SSH authentication grants a root shell. Successful cloud authentication grants whatever permissions are attached to the exposed access key. 5. The attacker can then access resources, collect data, alter systems, or move laterally within the limits of the compromised accounts. ### ...[truncated 500 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed Alibaba Cloud access key and SSH password immediately. 2. Review cloud audit logs and SSH authentication logs for unauthorized use. 3. Remove all secrets from the current source tree, version-control history, build artifacts, and backups where feasible. 4. Obtain secrets at runtime from a managed secret store, protected environment variables, or workload identity. 5. Replace the root account with a dedicated non-root account authorized only to run the required read-only YARN commands. 6. Replace password authentication with a passphrase-protected SSH key or short-lived SSH certificate. 7. Apply a narrowly scoped read-only policy to the cloud identity and prefer short-lived role credentials. 8. Enforce restrictive permissions such as `0600` for any local secret-bearing configuration. 9. Add secret scanning to commits and release pipelines to prevent recurrence. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/analyze_yarn.py:105
• Finding: Raw cloud secret transmitted through a nonstandard authorization header<![CDATA[ ## Vulnerability Details **File Location**: `scripts/analyze_yarn.py:105-119` **Vulnerability Type**: Unsafe authentication design and sensitive-data transmission **Risk Level**: High ### Vulnerable Code ```python url = f"https://emr.{config['region_id']}.aliyuncs.com/" headers = { "Content-Type": "application/json", "Authorization": f"Bearer {config['access_key_id']}:{config['access_key_secret']}" } payload = { "ClusterId": config["cluster_id"], "RegionId": config["region_id"], **params } try: logger.info(f"调用 API: {endpoint}") response = requests.post( url, json=payload, headers=headers, timeout=timeout ) ``` ### Technical Analysis The code places the reusable access-key secret directly into a bearer-style HTTP header. This is not a safe replacement for the cloud provider's signed-request authentication procedure. TLS protects data in transit under normal conditions, but it does not eliminate exposure to local debugging tools, HTTP middleware, reverse proxies, telemetry, crash diagnostics, process instrumentation, or a compromised trust store. Any component that records request headers could capture a reusable credential. The API hostname is also constructed from the configuration-controlled `region_id` without validating it against an allowlist of supported regions. This increases reliance on configuration integrity and DNS/TLS behavior. The `endpoint` argument is logged but is not used to select or sign an API action, while every call posts to the same root URL. This suggests the custom authentication mechanism may also be functionally incorrect. ### Attack Path 1. The Skill loads the plaintext cloud access key and secret. 2. `call_emr_api` concatenates both values into the `Authorization` header. 3. The request passes through the local networking stack and any configured proxy, instrumentation, or monitoring component. 4. A malicious or compromised component with visibilit ...[truncated 812 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the custom `Bearer access_key_id:access_key_secret` header. 2. Use the official Alibaba Cloud SDK or documented request-signing implementation. 3. Prefer short-lived role credentials or workload identity over long-lived access keys. 4. Validate `region_id` against an explicit allowlist of supported Alibaba Cloud regions. 5. Ensure authorization headers are redacted from application, proxy, tracing, and diagnostic logs. 6. Use an explicitly configured API action and validate response schemas. 7. Restrict outbound traffic to the required official EMR API endpoints. 8. Rotate the currently exposed credentials before deploying corrected code. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/analyze_yarn.py:150
• Finding: SSH host identity verification is disabled<![CDATA[ ## Vulnerability Details **File Location**: `scripts/analyze_yarn.py:150-151` **Vulnerability Type**: Insecure SSH host-key validation **Risk Level**: High ### Vulnerable Code ```python ssh = paramiko.SSHClient() ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()) ``` ### Technical Analysis `paramiko.AutoAddPolicy()` automatically accepts an unknown SSH server host key. The client therefore does not establish that it is communicating with the intended server before sending credentials. Because the connection uses a reusable root password, a machine-in-the-middle server can present an arbitrary host key that the client accepts. The attacker-controlled endpoint can then capture authentication material or provide fabricated command output. This compromises both credential confidentiality and the integrity of the generated YARN report. ### Attack Path 1. An attacker gains a position capable of influencing DNS, routing, ARP, network gateways, or the destination host. 2. The attacker redirects the SSH connection to an attacker-controlled SSH service. 3. The malicious service presents an unrecognized host key. 4. `AutoAddPolicy` accepts the key without warning or fingerprint verification. 5. The client attempts password authentication, exposing the configured root credential to the malicious endpoint. 6. The attacker reuses the captured credential against the real host and can also return fabricated YARN results to the Skill. ### Impact Assessment If the exposed password is accepted by the real host, exploitation may result in root-level host compromise. Even without successful credential reuse, the attacker can falsify resource statistics and influence operational or capacity-planning decisions based on the generated report. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Load a trusted `known_hosts` file using `SSHClient.load_host_keys()` or `load_system_host_keys()`. 2. Replace `AutoAddPolicy` with `paramiko.RejectPolicy()`. 3. Provision and pin the expected server host key or fingerprint out of band. 4. Fail closed when the host key is missing, changed, or invalid. 5. Replace root password authentication with a restricted non-root account and key-based authentication. 6. Limit the SSH account through authorized-key command restrictions and server-side access controls. 7. Alert on host-key changes rather than silently accepting them. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/analyze_yarn.py:229
• Finding: SSH collection exceeds the minimum privileges required for YARN analysis<![CDATA[ ## Vulnerability Details **File Location**: `scripts/analyze_yarn.py:229-237` **Vulnerability Type**: Excessive system reconnaissance and unnecessary privileged access **Risk Level**: Medium ### Vulnerable Code ```python commands = { "yarn_cluster": "yarn cluster -status 2>/dev/null || echo 'N/A'", "yarn_nodes": "yarn node -list -all 2>/dev/null || echo 'N/A'", "yarn_apps": "yarn application -list -appStates ALL 2>/dev/null | head -200", "system_mem": "free -h", "system_cpu": "lscpu | grep -E 'CPU\\(s\\)|Model name'", "system_load": "uptime", "hdfs_report": "hdfs dfsadmin -report 2>/dev/null | grep -E 'Configured|Present|DFS Remaining|DFS Used' | head -10" } ``` ### Technical Analysis The declared purpose is analysis of YARN resource consumption. The command set additionally gathers host CPU details, host memory and load, and HDFS capacity information. Some host memory and load data appears in the report, but CPU-model data is collected and not used. The HDFS report is also collected but is not consumed by `generate_report`. These unused commands are not necessary for the stated output and expand the information available to the process. Running this collection through a root SSH account makes the privilege boundary substantially broader than required. Although these specific commands are primarily read-only, the credentials and execution mechanism can support unrestricted root commands if the code or runtime is later altered. ### Attack Path 1. The Skill authenticates to the configured public host with root credentials. 2. It executes YARN commands alongside host-inventory and HDFS-capacity commands. 3. The process obtains infrastructure information outside the minimum data required for YARN utilization reporting. 4. Anyone who compromises the Skill process, configuration, dependency chain, or credentials can reuse the unrestricted root channel for broader discovery or arbitrary administration. 5. The collected to ...[truncated 478 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the unused `system_cpu` and `hdfs_report` commands. 2. Retain only commands whose output is necessary for the documented report. 3. Replace root access with a dedicated read-only service account. 4. Restrict the account to an allowlist of exact YARN commands through `authorized_keys`, `sudoers`, or a server-side wrapper. 5. Separate optional host-health collection from YARN analysis and require explicit user authorization before enabling it. 6. Document each collected field, its purpose, retention period, and access controls. 7. Apply network restrictions so the monitoring account is usable only from approved execution environments. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is YARN resource analysis, but the skill behavior includes sensitive remote access via SSH, use of cloud access keys for direct API calls, local cookie/log persistence, and host-level/HDFS data collection beyond the stated scope. This mismatch is dangerous because operators may authorize the skill for a narrow diagnostic task while it actually performs broader privileged actions and handles secrets, creating risk of credential leakage, excessive collection, and trust bypass.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents capabilities that require file access, local persistence, SSH, and external API/network use, but it declares no explicit tool scope or permission boundaries. This is dangerous because an agent/runtime may grant broader access than users expect, increasing the chance of over-privileged execution and unintended data exposure.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: L023 明确写明“禁止读取外部文件或依赖外部脚本”，属于对实现边界的主动声明。但后文 L080 和 L090 使用 `~/.openclaw/workspace/...` 的外部绝对路径来执行脚本和读取日志，且 L062/L083 也表明脚本会读取配置文件，因此该文档表述与实际预期运行方式相矛盾。

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 安全注意事项

1. **配置文件安全** - `config.yaml` 包含敏感信息，建议设置权限 `chmod 600 config/config.yaml`
2. **Cookie 存储** - `data/cookies.json` 仅 Skill 自身可读写
3. **日志脱敏** - 不记录完整的 AccessKey Secret
4. **最小权限** - 使用只读账号进行分析

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The natural-language comments in this file are entirely in Chinese, which imposes a specific language expectation on users without offering an alternative or documenting why the locale is required. This can violate language or locale policy when no user opt-in or region-specific justification is provided in the file.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s user-facing natural-language content, including the module description and all logs/comments, is written exclusively in Chinese, which imposes a specific language/locale choice. There is no indication that the user can select a language or that the skill is intended only for a Chinese-specific compliance or regional context.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script stores and reloads cookie data locally despite the stated YARN analysis workflow not requiring browser/session cookies. Unnecessary persistence of authentication artifacts increases the chance of credential leakage from disk, log correlation, or reuse by other local processes, especially because the file is kept for 24 hours and there is no protection, encryption, or scope validation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script sends sensitive cloud credentials and SSH credentials over the network without any user-facing disclosure, and the EMR API authentication is implemented as a custom Authorization header carrying access key ID and secret together. This is dangerous because it mishandles secrets, increases the blast radius of interception or logging, and deviates from standard cloud SDK signing practices that provide stronger request authentication controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

try:
        logger.info(f"调用 API: {endpoint}")
        response = requests.post(
            url,
            json=payload,
            headers=headers,

• Confidence: 83% confidence
• Finding: The external HTTP POST sends cluster identifiers and credentials-derived authentication material to a remote endpoint. External transmission is expected for an EMR-integrated skill, but it still represents a real data-exposure surface, especially here because the request construction appears custom and may send more sensitive material than necessary.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill performs remote shell command execution over SSH, including as root by default, without explicit warning or consent flow. Even if the current commands are read-oriented, this grants powerful remote access and materially increases risk if configuration is altered, the host is malicious, or command content later becomes user-influenced.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The data collection goes beyond YARN resource analysis and also gathers host memory, CPU, load, and HDFS report data. This violates least-privilege and data-minimization expectations for the advertised skill, potentially exposing unrelated system inventory and storage details that could aid reconnaissance if the output, logs, or downstream consumers are compromised.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: L136 将“本地存储”效果描述为“无网络依赖”，但技能描述 L003、L008 以及错误处理 L145-L146 都明确说明其通过 SSH 和 EMR API 工作，并会因网络问题失败。这不是简单遗漏，而是对技能依赖条件的直接反向表述。

Vague Triggers

Low

• Confidence: 77% confidence
• Finding: This YAML manifest says 'all parameters can be modified here' without clarifying which changes are safe, required, or out of scope. In a manifest file, this kind of broad instruction can create ambiguous trigger/scope expectations for how the skill should be configured and when particular settings should be changed.

Static analysis

No suspicious patterns detected.