Alibabacloud Elasticsearch Instance Diagnose

• Outcome: Review
• Latest audit: May 29, 2026 at 9:36 PM UTC
• Version:
  0.0.1

Overview

The skill is mostly a coherent Elasticsearch troubleshooting guide, but it includes high-impact credential setup and destructive operational commands without consistent safety gates.

Install only if you are comfortable using it as an expert-assisted runbook, not an automatic repair tool. Use short-lived or scoped Alibaba Cloud credentials where possible, avoid pasting secrets into chat or shell history, and treat all DELETE, PUT, POST remediation examples as manual change-control actions requiring backups, exact target review, and explicit approval before execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide instructs users to configure long-lived Access Key credentials directly in CLI config and shell environment variables without any warning about secret exposure, persistence, shell history, or use of safer alternatives such as short-lived credentials/RAM roles. In a troubleshooting skill for cloud Elasticsearch, operators are likely to run these commands on admin workstations or shared bastions, which increases the chance of credential leakage and subsequent compromise of cloud resources.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The SOP explicitly references destructive remediation such as deleting an index and changing allocation-related settings, but it does not require an explicit data-loss warning, operator confirmation, backup verification, or approval gate before those actions. In an Elasticsearch diagnosis skill, operators may follow the runbook during an outage and execute irreversible steps under pressure, causing avoidable data loss or service disruption.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The SOP includes a destructive `DELETE /old_index` step immediately after reindex and alias swap, but it does not explicitly warn operators to verify reindex completeness, alias cutover success, snapshot availability, and rollback readiness before deletion. In an operational troubleshooting skill, users may copy commands verbatim under pressure, so omission of a clear caution materially increases the chance of accidental data loss.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The SOP instructs operators to cancel Elasticsearch tasks as part of emergency response without an explicit warning that cancellation can interrupt production searches, terminate legitimate long-running jobs, and create user-visible errors. In an agent skill context, this is dangerous because the model may present the action as a routine next step and execute or recommend it prematurely without confirming business impact or obtaining approval.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document recommends manual shard movement via `_cluster/reroute` but does not clearly warn that rerouting triggers shard relocation, consumes network/disk/CPU resources, can worsen an already degraded cluster, and may conflict with allocator decisions. In a troubleshooting skill, this omission is risky because an automated or hurried operator could apply it during instability and amplify load or prolong recovery.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The SOP suggests `forcemerge` as a mitigation for load skew with only a light off-peak note, but force-merge is a heavy, often irreversible maintenance operation that can generate substantial IO/CPU load, increase operational risk, and is frequently inappropriate for actively written indices. In an agent skill for incident diagnosis, presenting it without a strong guardrail can lead to harmful remediation during production pressure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The SOP includes a destructive wildcard deletion example (`DELETE old_index_*`) without an adjacent, explicit warning that it permanently removes data and should only be used after validating backups, retention requirements, and the exact index pattern. In an operational troubleshooting skill, users may copy commands directly during an incident, so an unguarded deletion example materially increases the chance of accidental data loss.

VirusTotal

66/66 vendors flagged this skill as clean.