ClawHub
Back to skill

Security audit

Alibaba Cloud DataWorks

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its DataWorks purpose, but needs review because it can use cloud credentials for broad administrative actions and includes under-scoped package, metadata, and TLS trust choices.

Install only if you are comfortable letting an agent act on Alibaba Cloud DataWorks with the credentials you provide. Use a dedicated least-privilege RAM identity, avoid personal or root keys, pin and review the MCP server package before use, prefer local vetted tool metadata, and treat generated API metadata cautiously until the TLS fallback is fixed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_api_overview.py:48
Finding

Automatic Fallback to Unverified TLS for Documentation Retrieval

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/list_openapi_meta_apis.py:27
Finding

Automatic Fallback to Unverified TLS for OpenAPI Metadata Retrieval

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
references/mcp_server.md:8
Finding

Unpinned MCP Package Execution with Alibaba Cloud Credentials

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

There is a material description-to-behavior mismatch. The description presents a broad operational skill for interacting with Alibaba Cloud DataWorks through official SDKs and dynamic API discovery. In contrast, the code chunk only downloads and parses a documentation overview page to enumerate APIs and save the results locally. That discovery behavior is related to the description, but it is only a narrow subset and does not implement the primary claimed capability of operating DataWorks resources. No DataWorks API calls, SDK usage, authentication, resource management, workflow execution, or other service operations appear in the code. Therefore the code does not accurately represent the declared skill purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This is a clear description-behavior mismatch. The declared description presents a full operational DataWorks skill capable of interacting with many DataWorks domains through dynamic API discovery and official SDKs. The actual code chunk only downloads OpenAPI documentation metadata from a public Aliyun endpoint, parses out API names, and writes files under an output directory. While this supports the 'API discovery' part in a narrow sense, it does not implement the stated primary purpose of operating DataWorks, nor does it use official SDKs or demonstrate the broad functional coverage claimed. The network access to Aliyun metadata is consistent with the discovery theme, but the primary behavior is materially narrower than the declared capability set.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README instructs users to export long-lived cloud credentials directly into shell environment variables without any accompanying warning about secret handling, shell history, shared terminals, or least-privilege use. In a skill intended for AI agents and automation, this increases the chance that sensitive Alibaba Cloud credentials are exposed through logs, transcripts, debugging output, or reused in unsafe environments.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill explicitly instructs use of sensitive capabilities including environment variables for cloud credentials, shell commands, network access, and potential file access, yet declares no tool-scope restrictions. In an agent setting, this increases the blast radius: a user invoking the skill could trigger credentialed cloud operations or shell/network behavior without an explicit least-privilege boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document instructs users to supply long-lived cloud access keys to the MCP server but provides no warning about secret handling, least-privilege scoping, or the risk that an MCP-connected agent/server may access or misuse those credentials. In this context, the server is explicitly designed to expose many cloud management APIs to an AI tool layer, so omitted guidance materially increases the chance of credential overexposure or overprivileged deployment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill states that tool definitions are fetched dynamically from remote endpoints and that the available tool list can change at runtime, but it does not warn users about the trust boundary this creates. Because an AI agent will consume remotely supplied tool metadata to decide which actions are available, compromised, incorrect, or unexpectedly changed metadata could expand capabilities, alter parameter expectations, or introduce unsafe operations without an explicit user update.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
78% confidence
Finding

Using a pre-release metadata endpoint when NODE_ENV=development is an unsafe default for a system that drives cloud API exposure, because development environments are often less controlled and may still hold valid credentials. In this skill's context, development mode changes the remote source of tool definitions, increasing the risk of testing against unstable or less-vetted API metadata and unintentionally exposing agents to unexpected capabilities.

Content

Scanner excerpt · references/mcp_server.md (reported line 60)May include surrounding context.

md
The MCP Server dynamically fetches tool definitions from:
- `https://dataworks.data.aliyun.com/pop-mcp-tools` (production)
- `https://pre-dataworks.data.aliyun.com/pop-mcp-tools` (pre-release, when `NODE_ENV=development`)

This means the tool list always reflects the latest available DataWorks APIs.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

md
> Constants: **PRODUCT_CODE** = `dataworks-public`, **API_VERSION** = `2024-05-18` (defined in SKILL.md)

## API & metadata
- OpenAPI product page: `https://api.aliyun.com/product/{PRODUCT_CODE}`
- API overview (help docs): `https://help.aliyun.com/zh/dataworks/developer-reference/api-{PRODUCT_CODE}-{API_VERSION}-overview`
- API list (metadata JSON): `https://next.api.aliyun.com/meta/v1/products/{PRODUCT_CODE}/versions/{API_VERSION}/api-docs.json`
- Single API definition: `https://next.api.aliyun.com/meta/v1/products/{PRODUCT_CODE}/versions/{API_VERSION}/apis/{ApiName}/api.json`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 6)May include surrounding context.

md
> Constants: **PRODUCT_CODE** = `dataworks-public`, **API_VERSION** = `2024-05-18` (defined in SKILL.md)

## API & metadata
- OpenAPI product page: `https://api.aliyun.com/product/{PRODUCT_CODE}`
- API overview (help docs): `https://help.aliyun.com/zh/dataworks/developer-reference/api-{PRODUCT_CODE}-{API_VERSION}-overview`
- API list (metadata JSON): `https://next.api.aliyun.com/meta/v1/products/{PRODUCT_CODE}/versions/{API_VERSION}/api-docs.json`
- Single API definition: `https://next.api.aliyun.com/meta/v1/products/{PRODUCT_CODE}/versions/{API_VERSION}/apis/{ApiName}/api.json`

Tainted flow: 'timeout' from os.getenv (line 210, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/fetch_api_overview.py (reported line 63)May include surrounding context.

python
# Fallback: use curl
    print("urllib SSL failed, falling back to curl...")
    result = subprocess.run(
        ["curl", "-fsSL", "-H", f"User-Agent: {headers['User-Agent']}", url],
        capture_output=True, text=True, timeout=timeout,
    )

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The fetch logic explicitly falls back to ssl._create_unverified_context(), which disables certificate verification for content downloaded from a remote HTTPS endpoint. Because the script then trusts and persists the returned metadata as authoritative OpenAPI output, a man-in-the-middle attacker could tamper with API metadata, poisoning downstream automation or misleading users about available APIs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Disabling TLS verification undermines the authenticity and integrity guarantees of HTTPS during metadata retrieval. In the context of a skill whose purpose is dynamic API discovery from official sources, this is especially dangerous because consumers may rely on the fetched API list as trusted source material, amplifying the effect of any network-level tampering.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/fetch_api_overview.py (reported line 63)May include surrounding context.

python
# Fallback: use curl
    print("urllib SSL failed, falling back to curl...")
    result = subprocess.run(
        ["curl", "-fsSL", "-H", f"User-Agent: {headers['User-Agent']}", url],
        capture_output=True, text=True, timeout=timeout,
    )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/list_openapi_meta_apis.py (reported line 42)May include surrounding context.

python
# Fallback: use curl
    print("urllib SSL failed, falling back to curl...")
    result = subprocess.run(
        ["curl", "-fsSL", "-H", f"User-Agent: {headers['User-Agent']}", url],
        capture_output=True, text=True, timeout=timeout,
    )

Tainted flow: 'timeout' from os.getenv (line 58, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/list_openapi_meta_apis.py (reported line 42)May include surrounding context.

python
# Fallback: use curl
    print("urllib SSL failed, falling back to curl...")
    result = subprocess.run(
        ["curl", "-fsSL", "-H", f"User-Agent: {headers['User-Agent']}", url],
        capture_output=True, text=True, timeout=timeout,
    )

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation explicitly directs users to fetch https://help.aliyun.com/zh/..., which hardcodes the Chinese locale in a natural-language instruction. Because the skill does not offer an opt-in choice of language or explain that the Chinese locale is required, this can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.