Security audit

Bailian Subagent Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is review-worthy because it broadly delegates work to an external subagent while documenting cloud credential access and long-lived MaxCompute memory writes.

Install only after reviewing whether Bailian subagents should receive task content and whether Alibaba Cloud credentials are available in their environment. Use least-privilege, preferably short-lived credentials; switch MaxCompute examples to HTTPS; pin dependencies; and avoid writing user, account, financial, or confidential information into agent_memory unless retention, deletion, and approval rules are clear.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:18
Finding: Cloud Credentials Exposed to Over-Broad Subagent Workloads
Content: View full analysis
2000 tokens** - Offload to save main session ``` ```text ### Spawn Task Template 你是資料工程 subagent。 AK/SK 從環境變量讀取： - os.environ['ALICLOUD_ACCESS_KEY_ID'] - os.environ['ALICLOUD_ACCESS_KEY_SECRET'] 任務：[具體任務描述] ``` ### Technical Analysis The skill delegates a wide variety of workloads to a general-purpose subagent, including processing potentially attacker-controlled websites, documents, media, and other large inputs. The generic spawn template simultaneously tells that subagent how to retrieve Alibaba Cloud access credentials from the process environment. Credential access is not limited to the MaxCompute operations that legitimately require it. A parsing or summarization task consequently runs in a context where the delegated agent knows the credential variable names and may be able to read them. This violates least privilege and unnecessarily extends the cloud trust boundary to unrelated workloads. The instructions do not establish separate runtimes, environment allowlists, short-lived credentials, or an operation-specific proxy that would prevent a non-database subagent from accessing the secrets. ### Attack Path 1. An attacker supplies a document, website, article, or other large input that triggers subagent delegation. 2. The delegated workloa ...[truncated 1219 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/maxcompute-patterns.md:5
Finding: Unpinned Runtime Installation of PyODPS
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:82
Finding: MaxCompute Connections Use an Unencrypted HTTP Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/maxcompute-patterns.md:47
Finding: SQL Injection in the Batch Memory Insertion Example
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Context Leakage

High

Category: Data Exfiltration
Confidence: 85% confidence
Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
Content: Scanner excerpt · references/maxcompute-patterns.md (reported line 90)May include surrounding context.
md
tunnel = TableTunnel(o) table = o.get_table('agent_memory') # Create upload session for partition today = '2026-03-18' upload_session = tunnel.create_upload_session(table.name, partition_spec=f'dt={today}')

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly enables reading and writing long-term memory in a MaxCompute table but does not include any user-facing warning, consent flow, retention notice, or guidance on what data must not be persisted. Because this is persistent storage with a 3650-day lifecycle, users or operators may inadvertently store sensitive, personal, or confidential information without informed consent or data minimization controls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The delegation criteria are overly broad, especially the catch-all conditions like 'any task estimated >2000 tokens' and generic references to large content processing. In a skill that can access external services and long-term memory, this increases the chance that unrelated or sensitive tasks are routed to a subagent unnecessarily, expanding data exposure and reducing user/control-plane visibility over where data is sent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The template instructs the subagent in Chinese/traditional Chinese wording ('你是資料工程 subagent', '從環境變量讀取') with no indication that language should follow user preference. This creates a natural-language locale constraint that is not optional or justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file includes code that reads ALICLOUD_ACCESS_KEY_ID and ALICLOUD_ACCESS_KEY_SECRET from environment variables, which is a sensitive credential access pattern. The section describes how to connect and test the connection but does not warn users to protect, scope, or avoid exposing these credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The documentation provides ready-to-run examples that create a remote table and insert data into MaxCompute without an explicit warning that the operations are state-changing and affect a live cloud project. In this skill's context, which encourages delegating heavy workloads and agent memory CRUD, users may run examples directly against production resources, causing unintended writes, persistence of sensitive data, or cost/incidental data integrity issues.
Content: No source excerpt is available for this finding.