Bailian Subagent Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:48 AM UTC
• Version: 1.0.0

Overview

This skill is review-worthy because it broadly delegates work to an external subagent while documenting cloud credential access and long-lived MaxCompute memory writes.

Install only after reviewing whether Bailian subagents should receive task content and whether Alibaba Cloud credentials are available in their environment. Use least-privilege, preferably short-lived credentials; switch MaxCompute examples to HTTPS; pin dependencies; and avoid writing user, account, financial, or confidential information into agent_memory unless retention, deletion, and approval rules are clear.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:18
• Finding: Cloud Credentials Exposed to Over-Broad Subagent Workloads<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 18-25 and 41-52 **Vulnerability Type**: Excessive credential exposure and violation of least privilege **Risk Level**: High ### Vulnerable Code ```markdown Spawn a Bailian subagent when tasks involve: - **PDF parsing** - Extract text, tables, or structure from PDFs - **Article/Web reading & summarization** - Long articles, documentation pages - **Large skill content processing** - When skill files exceed normal context - **Video/Audio/Image analysis** - Multimodal content processing - **DataWorks / MaxCompute operations** - SQL execution, table management - **agent_memory table CRUD** - Read/write long-term memory - **Any task estimated >2000 tokens** - Offload to save main session ``` ```text ### Spawn Task Template 你是資料工程 subagent。 AK/SK 從環境變量讀取： - os.environ['ALICLOUD_ACCESS_KEY_ID'] - os.environ['ALICLOUD_ACCESS_KEY_SECRET'] 任務：[具體任務描述] ``` ### Technical Analysis The skill delegates a wide variety of workloads to a general-purpose subagent, including processing potentially attacker-controlled websites, documents, media, and other large inputs. The generic spawn template simultaneously tells that subagent how to retrieve Alibaba Cloud access credentials from the process environment. Credential access is not limited to the MaxCompute operations that legitimately require it. A parsing or summarization task consequently runs in a context where the delegated agent knows the credential variable names and may be able to read them. This violates least privilege and unnecessarily extends the cloud trust boundary to unrelated workloads. The instructions do not establish separate runtimes, environment allowlists, short-lived credentials, or an operation-specific proxy that would prevent a non-database subagent from accessing the secrets. ### Attack Path 1. An attacker supplies a document, website, article, or other large input that triggers subagent delegation. 2. The delegated workloa ...[truncated 1219 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not provide cloud credentials to general-purpose parsing, summarization, or multimodal subagents. 2. Separate MaxCompute operations into a dedicated worker with a minimal environment and narrowly scoped execution policy. 3. Remove `ALICLOUD_ACCESS_KEY_ID` and `ALICLOUD_ACCESS_KEY_SECRET` from all unrelated subagent environments using an explicit environment-variable allowlist. 4. Prefer short-lived Security Token Service credentials instead of long-lived access keys. 5. Apply an IAM policy that permits access only to the required project, table, and operations. 6. Expose database operations through a constrained interface with allowlisted queries rather than allowing arbitrary cloud SDK access. 7. Treat external documents and websites as untrusted input and prevent their contents from changing tool-use or credential-access policy. 8. Rotate the credentials if this skill has already run in an environment where untrusted delegated workloads could access them. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/maxcompute-patterns.md:5
• Finding: Unpinned Runtime Installation of PyODPS<![CDATA[ ## Vulnerability Details **File Location**: `references/maxcompute-patterns.md`, lines 5-9; also `SKILL.md`, line 112 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## A. Install Dependencies ```bash pip install pyodps ``` ``` The primary skill repeats the same instruction: ```markdown - Install: `pip install pyodps` ``` ### Technical Analysis The project instructs users or agents to install `pyodps` without specifying an exact version, validating an integrity hash, or using a reviewed lock file. Consequently, the installed code is resolved dynamically from the configured package index at execution time and may differ from the dependency that was reviewed during the skill audit. Package installation and later imports can execute third-party code with the privileges of the Python environment. Although the package name is not an evident typo and the repository contains no proof that the current package is malicious, the unpinned installation creates an avoidable supply-chain exposure. ### Attack Path 1. An operator or automated agent follows the documented `pip install pyodps` instruction. 2. `pip` resolves the most recent compatible package and transitive dependencies from its configured index. 3. A compromised package release, package-index account, mirror, or dependency is selected after the skill itself has been reviewed. 4. Package installation or import executes attacker-controlled Python code. 5. That code inherits the privileges and environment of the installer, which may include access to the Alibaba Cloud credential variables documented by this project. ### Impact Assessment The dependency executes with the privileges of the Python process. In the documented operating context, compromise could permit reading environment credentials, accessing MaxCompute data, modifying local files, executing arbitrary commands, and using network access available to the host ...[truncated 142 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `pyodps` and every transitive dependency to reviewed versions in a lock file. 2. Require cryptographic hashes during installation, such as with `pip install --require-hashes -r requirements.txt`. 3. Retrieve packages only from an approved and authenticated package repository. 4. Generate and review a software bill of materials for the resolved dependency set. 5. Run dependency vulnerability and provenance checks in CI before publishing the skill. 6. Install and execute dependencies inside a non-privileged, isolated virtual environment or container. 7. Do not expose cloud credentials to the installation process unless strictly necessary. 8. Establish an explicit dependency-update review process rather than automatically accepting the newest release. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:82
• Finding: MaxCompute Connections Use an Unencrypted HTTP Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 82-88; repeated in `references/maxcompute-patterns.md`, lines 16-22, 79-85, and 115-121 **Vulnerability Type**: Cleartext transport for sensitive cloud operations **Risk Level**: High ### Vulnerable Code ```python o = odps.ODPS( access_id=os.environ['ALICLOUD_ACCESS_KEY_ID'], secret_access_key=os.environ['ALICLOUD_ACCESS_KEY_SECRET'], project='samuelhsin', endpoint='http://service.cn-hangzhou.maxcompute.aliyun.com/api' ) ``` The same cleartext endpoint is repeated in the connection examples in the reference file: ```python endpoint='http://service.cn-hangzhou.maxcompute.aliyun.com/api' ``` ### Technical Analysis The connection examples explicitly configure MaxCompute with an `http://` endpoint instead of an HTTPS endpoint. This omits TLS transport encryption and server authentication at the configured application endpoint. Even if the service SDK signs requests, signing is not a replacement for TLS confidentiality. Sensitive query data, stored memory content, metadata, and returned records may be observable to network intermediaries. Depending on the protocol's signing and response-verification behavior, an active intermediary may also be able to manipulate responses, redirect traffic, or conduct replay-related attacks. The affected data includes the long-term `agent_memory` table, whose `title`, `summary`, `tags`, and other fields may contain sensitive user or operational information. ### Attack Path 1. The agent initializes PyODPS using the documented HTTP endpoint. 2. Requests traverse a network controlled or observed by an attacker, such as a hostile Wi-Fi network, compromised proxy, malicious gateway, or affected internal network segment. 3. Because TLS is not configured, the attacker observes cleartext application traffic and MaxCompute records. 4. An active intermediary may attempt to modify service responses or network routing. 5. Exposed memory records or m ...[truncated 653 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace every MaxCompute endpoint with the official HTTPS endpoint: ```python endpoint='https://service.cn-hangzhou.maxcompute.aliyun.com/api' ``` 2. Confirm that the installed SDK validates the server certificate and hostname using a trusted certificate store. 3. Fail closed rather than falling back to HTTP when TLS negotiation fails. 4. Search all documentation and examples for the cleartext endpoint and update every occurrence consistently. 5. Where possible, enforce outbound policy that blocks cleartext HTTP access to MaxCompute. 6. Avoid logging complete requests, responses, authorization headers, or sensitive memory records. 7. Rotate credentials and review potentially sensitive records if prior use occurred across an untrusted network. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/maxcompute-patterns.md:47
• Finding: SQL Injection in the Batch Memory Insertion Example<![CDATA[ ## Vulnerability Details **File Location**: `references/maxcompute-patterns.md`, lines 47-66 **Vulnerability Type**: SQL injection through direct string interpolation **Risk Level**: High ### Vulnerable Code ```python from datetime import datetime # Prepare data memories = [ ('config', 'API Key Setup', 'Configured Binance API keys for trading', 'binance,api,config', '2026-03-18T10:00:00+08:00'), ('decision', 'Use PyODPS over DataWorks API', 'DataWorks API gets rate limited frequently, use PyODPS for better reliability', 'maxcompute,architecture', '2026-03-18T11:00:00+08:00'), ('learning', 'OpenClaw Skill Pattern', 'Skills use SKILL.md with YAML frontmatter, references/ folder for detailed docs', 'openclaw,skill,pattern', '2026-03-18T12:00:00+08:00'), ] today = datetime.now().strftime('%Y-%m-%d') # Batch insert for category, title, summary, tags, created_at in memories: sql = f""" INSERT INTO agent_memory PARTITION (dt='{today}') (category, title, summary, tags, created_at) VALUES ('{category}', '{title}', '{summary.replace("'", "\\'")}', '{tags}', '{created_at}') """ o.execute_sql(sql) ``` ### Technical Analysis The example constructs a MaxCompute SQL statement by directly interpolating `today`, `category`, `title`, `summary`, `tags`, and `created_at` into SQL literals. Most values receive no escaping at all. The `summary` field only replaces a single quote with a backslash-prefixed quote, which is not a robust or necessarily dialect-correct SQL encoding mechanism. If these values are derived from user input, delegated web content, parsed documents, or generated model output, an attacker can include quote characters and SQL syntax that terminate the intended literal and alter the statement. Because the resulting text is sent to `o.execute_sql`, injected syntax is executed with the permissions of the configured Alibaba Cloud identity. The repository also documents long-term memory storage as a primary use cas ...[truncated 1431 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use the documented MaxCompute Tunnel record API for inserts instead of generating SQL text: ```python record = table.new_record() record['category'] = category record['title'] = title record['summary'] = summary record['tags'] = tags record['created_at'] = created_at writer.write(record) ``` 2. If the SDK supports parameterized MaxCompute SQL, bind every value through the official parameter interface. 3. Do not use f-strings, `%` formatting, or string concatenation to build SQL from external values. 4. Validate constrained fields with allowlists. For example, restrict `category` to approved values and parse timestamps using a strict date-time parser. 5. Apply length limits and reject control characters or unexpected encodings before persistence. 6. Use a database identity that can insert only into the required table and partitions and cannot perform schema administration. 7. Add tests containing quotes, comment markers, separators, Unicode edge cases, and other SQL metacharacters. 8. Remove the unsafe batch-insertion example or replace it entirely with the existing structured Tunnel example. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Context Leakage

High

• Category: Data Exfiltration

Content

tunnel = TableTunnel(o)
table = o.get_table('agent_memory')

# Create upload session for partition
today = '2026-03-18'
upload_session = tunnel.create_upload_session(table.name, partition_spec=f'dt={today}')

• Confidence: 85% confidence
• Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly enables reading and writing long-term memory in a MaxCompute table but does not include any user-facing warning, consent flow, retention notice, or guidance on what data must not be persisted. Because this is persistent storage with a 3650-day lifecycle, users or operators may inadvertently store sensitive, personal, or confidential information without informed consent or data minimization controls.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The delegation criteria are overly broad, especially the catch-all conditions like 'any task estimated >2000 tokens' and generic references to large content processing. In a skill that can access external services and long-term memory, this increases the chance that unrelated or sensitive tasks are routed to a subagent unnecessarily, expanding data exposure and reducing user/control-plane visibility over where data is sent.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The template instructs the subagent in Chinese/traditional Chinese wording ('你是資料工程 subagent', '從環境變量讀取') with no indication that language should follow user preference. This creates a natural-language locale constraint that is not optional or justified as region-specific.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This markdown file includes code that reads ALICLOUD_ACCESS_KEY_ID and ALICLOUD_ACCESS_KEY_SECRET from environment variables, which is a sensitive credential access pattern. The section describes how to connect and test the connection but does not warn users to protect, scope, or avoid exposing these credentials.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The documentation provides ready-to-run examples that create a remote table and insert data into MaxCompute without an explicit warning that the operations are state-changing and affect a live cloud project. In this skill's context, which encourages delegating heavy workloads and agent memory CRUD, users may run examples directly against production resources, causing unintended writes, persistence of sensitive data, or cost/incidental data integrity issues.

Static analysis

No suspicious patterns detected.