ClawHub
Back to skill

Security audit

Alicloud DataWorks Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it gives an agent broad Alibaba Cloud DataWorks control through cloud access keys, an unpinned MCP server, and weak default scoping.

Review before installing. Use a dedicated least-privilege Alibaba Cloud RAM identity, prefer temporary credentials, pin and review the MCP server package/version, restrict TOOL_NAMES or TOOL_CATEGORIES to the specific task, avoid committing access keys, and require explicit confirmation for every state-changing or privilege-affecting API call.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:46
Finding

Unpinned npm Package Executes with Alibaba Cloud Credentials

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:46-61; references/mcp_server.md:8-25
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

SKILL.md:46-61:

bash
npm install -g alibabacloud-dataworks-mcp-server
json
{
  "mcpServers": {
    "alibabacloud-dataworks-mcp-server": {
      "command": "npx",
      "args": ["alibabacloud-dataworks-mcp-server"],
      "env": {
        "REGION": "cn-shanghai",
        "ALIBABA_CLOUD_ACCESS_KEY_ID": "your_access_key_id",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "your_access_key_secret"
      }
    }
  }
}

references/mcp_server.md:8-25 repeats the same unpinned installation and execution pattern:

bash
npm install -g alibabacloud-dataworks-mcp-server
json
{
  "mcpServers": {
    "alibabacloud-dataworks-mcp-server": {
      "command": "npx",
      "args": ["alibabacloud-dataworks-mcp-server"],
      "env": {
        "REGION": "cn-shanghai",
        "ALIBABA_CLOUD_ACCESS_KEY_ID": "your_access_key_id",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "your_access_key_secret"
      }
    }
  }
}

Technical Analysis

The Skill instructs users to globally install and subsequently execute an npm package without specifying an exact version, lockfile, or package integrity digest. The external package is not included in this repository, so its implementation and security properties cannot be verified as part of this audit.

The package is launched with an Alibaba Cloud Access Key ID and Access Key Secret in its process environment. Any code executed by that package can read these values. Because no version is pinned, the effective executable can change after the Skill itself has been reviewed. A compromised maintainer account, npm registry incident, malicious dependency update, or unexpectedly unsafe future release could therefore gain access to the credentials.

...[truncated 1615 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the MCP package to a reviewed, exact version rather than using an unconstrained package name.
  2. Use a lockfile and verify npm package integrity hashes in the installation workflow.
  3. Avoid combining a global installation with ambiguous npx resolution. Execute a verified local dependency using an explicit path.
  4. Review the selected release and its transitive dependencies before deployment.
  5. Prefer short-lived Alibaba Cloud credentials obtained through RAM roles, STS, workload identity, or another temporary credential mechanism.
  6. Assign a dedicated RAM identity with only the DataWorks permissions required for the current operation.
  7. Do not place long-lived secrets directly in committed MCP configuration files.
  8. Run the MCP server in a restricted environment with controlled network egress, filesystem access, and process permissions.
  9. Establish dependency monitoring and require manual approval before package upgrades.
  10. Rotate credentials immediately if an executed package version is later found to be compromised.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/mcp_server.md:40
Finding

MCP Configuration Exposes the Full DataWorks API Surface by Default

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:28-33,76-110; references/mcp_server.md:40-63
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Vulnerable Configuration

SKILL.md:28-33:

text
The MCP Server supports dynamic tool filtering via environment variables:
- `TOOL_CATEGORIES`: Comma-separated category filter (e.g. `DATA_DEVELOP,OPS_CENTER,DATA_QUALITY`)
- `TOOL_NAMES`: Comma-separated API name filter (e.g. `ListProjects,GetProject,CreateNode`)

references/mcp_server.md:40-63:

text
### Tool Categories

Filter tools by category using `TOOL_CATEGORIES`:

- `DATA_DEVELOP` — Data development (nodes, resources, workflows)
- `OPS_CENTER` — Operations center (task instances, alerts)
- `DATA_QUALITY` — Data quality rules and evaluation
- `DATA_MAP` — Metadata, lineage, catalogs
- `WORKSPACE` — Project and member management
- `DATA_INTEGRATION` — DI jobs
- `DATA_SOURCE` — Data source management
- `RESOURCE_GROUP` — Resource groups and networks
- `SERVER_IDE_DEFAULT` — Default IDE tool set

## Architecture

The MCP Server dynamically fetches tool definitions from:
- `https://dataworks.data.aliyun.com/pop-mcp-tools` (production)
- `https://pre-dataworks.data.aliyun.com/pop-mcp-tools` (pre-release, when `NODE_ENV=development`)

This means the tool list always reflects the latest available DataWorks APIs.

## API Invocation

The server uses Alibaba Cloud's generic OpenAPI client (RPC style) to invoke DataWorks APIs. Input parameters are validated against Zod schemas derived from the tool metadata.

The documented filters are optional, while the Skill lists sensitive operations such as:

text
- Lifecycle: `ResumeTaskInstances` / `SuspendTaskInstances` / `StopTaskInstances`
- Members: `ListProjectMembers` / `GetProjectMember` / `DeleteProjectMember`
- Roles: `ListProjectRoles` / `GetProjectRole` / `GrantMemberProjectRol
...[truncated 2833 chars]
Remediation
View remediation

Remediation Suggestions

  1. Make TOOL_NAMES mandatory and construct a per-task allowlist containing only the APIs required for the requested operation.
  2. If individual tool filtering is impractical, require the narrowest applicable TOOL_CATEGORIES value.
  3. Deny destructive and access-control APIs by default, including delete, stop, suspend, member-removal, and role-grant operations.
  4. Separate read-only discovery credentials from credentials used for state-changing operations.
  5. Use dedicated RAM roles with project-, region-, resource-, and action-level restrictions.
  6. Require explicit user confirmation for every state-changing or privilege-affecting operation, not only delete, stop, and suspend actions.
  7. Display the exact API name, target resource, region, project, and proposed parameters before confirmation.
  8. Cache and review tool metadata rather than automatically trusting an evolving remote tool inventory in sensitive environments.
  9. Disable pre-release metadata endpoints in production and prevent untrusted changes to NODE_ENV and TOOL_FILE_URI.
  10. Record API invocations in tamper-resistant audit logs and alert on destructive operations or access-control changes.
  11. Apply transactional safeguards where available, such as dry-run validation, change windows, and post-operation verification.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tainted flow: 'timeout' from os.getenv (line 34, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/list_openapi_meta_apis.py (reported line 23)May include surrounding context.

python
def fetch_json(url: str, timeout: int) -> dict:
    req = urllib.request.Request(url, headers={"User-Agent": "codex-skill"})
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        return json.loads(resp.read().decode("utf-8"))

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill claims broad DataWorks management capability, but the described executable behavior appears limited to metadata discovery and local artifact generation rather than actual resource management. This mismatch is dangerous because users or higher-level agents may authorize the skill under false assumptions, potentially exposing credentials or permitting actions based on an inaccurate trust model.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares capabilities that involve environment variables, file writing, and network access, but it does not define any explicit tool scope restrictions such as permissions or allowed-tools. In an agent setting, this increases the attack surface because the skill could access credentials, write artifacts, or reach external endpoints without a clear least-privilege boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file includes example configuration for ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET, but it does not warn users that these are sensitive credentials that should be stored securely and not committed or shared. Because the file directly instructs users to place secrets in config, a user-facing warning about credential sensitivity is expected.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
84% confidence
Finding

The server dynamically loads tool definitions from a remote endpoint and switches to a pre-release endpoint when NODE_ENV=development. This creates a trust-on-remote-metadata model where tool surface and schemas can change without pinning, and development mode may pull less stable definitions that could introduce unsafe or unexpected tool behavior for an agent consuming them.

Content

Scanner excerpt · references/mcp_server.md (reported line 60)May include surrounding context.

md
The MCP Server dynamically fetches tool definitions from:
- `https://dataworks.data.aliyun.com/pop-mcp-tools` (production)
- `https://pre-dataworks.data.aliyun.com/pop-mcp-tools` (pre-release, when `NODE_ENV=development`)

This means the tool list always reflects the latest available DataWorks APIs.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 3)May include surrounding context.

md
# Sources

- OpenAPI product page: `https://api.aliyun.com/product/dataworks-public`
- API list (metadata): `https://next.api.aliyun.com/meta/v1/products/dataworks-public/versions/2024-05-18/api-docs.json`
- API definition (single API): `https://next.api.aliyun.com/meta/v1/products/dataworks-public/versions/2024-05-18/apis/{ApiName}/api.json`
- MCP Server tools discovery: `https://dataworks.data.aliyun.com/pop-mcp-tools`

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The markdown includes multiple section headings and labels in Chinese, such as '数据开发', '运维中心', and similar terms, but does not state that language selection is optional or user-configurable. This can create a locale/language policy issue if the skill presents a specific language without explicit user opt-in.

Content

No source excerpt is available for this finding.