Alibabacloud Cfw Internet Firewall Protect

• Outcome: Review
• Latest audit: Jun 1, 2026, 11:28 AM
• Version:
  0.0.1

Overview

This skill is for legitimate cloud firewall administration, but its instructions can broaden a narrow request into account-wide firewall changes without clear renewed user approval.

Install only if you are comfortable reviewing every proposed firewall change before it runs. Do not allow this skill to use enable-all, disable-all, or broaden a failed name/tag search unless you explicitly requested that exact account-wide or broader scope. Use least-privilege RAM permissions and avoid granting all-public-IP switch permissions unless the operator truly needs them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The documented fallback explicitly says that when zero assets match a narrow condition, the agent should broaden scope to region/type filters or even call `enable-all --yes` if no broader dimension exists. This can transform a precise user request into a global firewall change affecting unrelated assets, which is a severe scope-escalation flaw.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The skill first states that explicit user confirmation is required before execution, but later overrides this by instructing agents in non-interactive mode to proceed unconditionally. This contradiction is dangerous because it normalizes executing security-sensitive firewall changes without contemporaneous user approval.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The fallback logic permits a much broader and potentially destructive change when a narrow condition yields no matches, yet it does not require a proportional warning and renewed consent for the widened blast radius. In this firewall-management context, that could enable protection changes across an entire region, resource class, or all public IPs unexpectedly.

VirusTotal

65/65 vendors flagged this skill as clean.