Security audit

alibabacloud-spec-ops

Security checks for vulnerabilities and agentic risk

Overview

The plugin is mostly coherent for Alibaba Cloud infrastructure automation, but it needs Review because it can make real cloud and IAM changes, installs broad MCP and telemetry hooks, and includes under-scoped background/local processes.

Install only with a constrained Alibaba Cloud identity, ideally a dedicated RAM role for the project. Add an MCP safety policy before production use, review every Terraform plan and IAM repair carefully, disable telemetry/local trace if you do not want those records, and clean up any preview server or trace files after use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill clearly instructs the agent to read local files, write Terraform files, and invoke shell-like commands and an MCP CLI tool, yet it declares no permissions boundary. That mismatch can let a caller or platform assume the skill is passive when it actually has filesystem and command execution capabilities, increasing the chance of unauthorized file access or writes.

Session Persistence

Medium

Category: Rogue Agent
Content: LOG="${DESIGN_DIR}/.preview-server.log" PID_FILE="${DESIGN_DIR}/.preview-server.pid" ( cd "${DESIGN_DIR}" && nohup python3 -m http.server "${PORT}" --bind 127.0.0.1 > "${LOG}" 2>&1 & echo $! > "${PID_FILE}" ) disown $(cat "${PID_FILE}") 2>/dev/null || true URL="http://127.0.0.1:${PORT}/architecture.html"
Confidence: 97% confidence
Finding: `disown` deliberately detaches the spawned process from the session, making cleanup and accountability harder. In an agent setting, this is especially risky because it allows local side effects to persist after the user may believe the operation is complete.

Session Persistence

Medium

Category: Rogue Agent
Content: # Start background server, capture PID for cleanup LOG="${DESIGN_DIR}/.preview-server.log" PID_FILE="${DESIGN_DIR}/.preview-server.pid" ( cd "${DESIGN_DIR}" && nohup python3 -m http.server "${PORT}" --bind 127.0.0.1 > "${LOG}" 2>&1 & echo $! > "${PID_FILE}" ) disown $(cat "${PID_FILE}") 2>/dev/null || true URL="http://127.0.0.1:${PORT}/architecture.html"
Confidence: 98% confidence
Finding: Using `nohup` to leave a background HTTP server running beyond the immediate interaction introduces session persistence and a lingering local service. Even bound to localhost, this can expose generated content, consume resources, complicate cleanup, and establish a precedent for unattended agent-managed daemons.

External Script Fetching

High

Category: Supply Chain
Content: ### Pre-check: Aliyun CLI >= 3.3.3 required > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update, > or see `references/cli-installation-guide.md` for installation instructions. ### Pre-check: Aliyun CLI plugin update required
Confidence: 98% confidence
Finding: The skill instructs the agent to run a remote installation script via `curl ... | bash`, which executes code fetched from the network without prior verification. If the hosting endpoint, transport path, or served script is compromised, this grants immediate arbitrary code execution in the agent environment, and the skill context makes this more dangerous because it is framed as a mandatory pre-check likely to be executed before diagnosis.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This guide materially expands the skill from Terraform plan execution into topology generation, remote state parsing, file creation, and browser/server orchestration. In a skill whose declared purpose is executing validated Terraform plans with explicit confirmation, hidden adjacent capabilities increase attack surface and can cause unexpected data handling or side effects outside the user’s intent.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The manifest states that explicit user confirmation is required before any apply operation, but the body of the skill later instructs the agent to automatically proceed from plan to apply without a fresh confirmation in this skill. For a skill that creates real cloud resources and incurs cost, ambiguity around authorization can lead to unintended infrastructure deployment and billing if upstream assumptions are wrong or bypassed.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This planning skill exceeds its declared purpose by instructing the agent to start a local HTTP server and open the user's browser. That creates local side effects and host interaction unrelated to infrastructure planning, which can be abused for unexpected process execution, environment probing, or social engineering through browser-launched content.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is positioned as a diagnostic assistant but explicitly routes into repair actions that attach policies, create custom policies, append actions to existing policies, modify trust policies, and create service-linked roles. That creates a privilege-escalation path where an agent may transition from analyzing an access error to changing cloud IAM configuration, potentially granting broader permissions than intended without a clear authorization checkpoint.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill includes process-management behavior (`nohup`, background server launch, PID files, `disown`) that is not justified by its role as a cloud planning assistant. Persistent local processes expand the attack surface, can outlive the session, and normalize agent-controlled host operations beyond user-visible planning tasks.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The file mandates generating and writing a self-contained topology.html artifact, which is outside the manifest’s stated purpose of executing validated Terraform plans. Unscoped artifact generation can leak infrastructure metadata into local files and cause unexpected workspace modification in contexts where the user only intended a plan/apply action.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The workflow instructs starting a local HTTP server and opening the generated page in the default browser automatically. That introduces non-essential process execution and UI side effects for a Terraform execution skill, which could expose local artifacts over localhost, surprise the user, or be chained with other browser-based behaviors.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The flow instructs the agent to scan conversation context for a base directory and then read another local file from that discovered path. This is a cross-skill/local file access pattern that can break isolation boundaries, leak data from unrelated skills or workspaces, and let untrusted context influence security recommendations via prompt/file injection.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The skill contains conflicting instructions about confirmation requirements: it says to stop and ask if user confirmation is missing, but also says the plan→apply chain runs automatically and no second confirmation should be added. In a high-impact deployment skill, contradictory safety instructions increase the chance that an implementing agent chooses the less safe path and executes changes the user did not intend.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The document explicitly claims the phase only produces designs and not code or CLI scripts, yet elsewhere instructs running Bash commands and opening a browser. This contradiction weakens safety boundaries and makes it easier for downstream agents or users to accept unexpected command execution as normal.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The process asks the agent to confirm user intent and then present 'Proceed with terraform plan?' while elsewhere prohibiting a second confirmation before apply and requiring auto-apply after plan. This mismatch can cause unsafe execution sequencing, where consent for planning is mistakenly treated as consent for applying real infrastructure changes.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The guide directs writing topology.html into the project tree without an explicit warning or confirmation that local files will be modified. While not inherently severe, silent writes are risky in an infrastructure skill because they can alter repositories, pollute working trees, or persist sensitive architecture details unexpectedly.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The guidance includes a direct command to create a service-linked role, which is a write operation that changes cloud account configuration. In a permission-diagnosis context, presenting an actionable account-modification command without an explicit warning, confirmation step, or scope check increases the risk of unintended privilege changes or unauthorized environment modification.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document provides commands to delete policy versions and delete a custom policy without an explicit warning that these actions can immediately remove access for users, roles, or automation depending on that policy. In a permission-repair skill, users are likely to run commands quickly during incident response, so omission of safety guidance materially increases the risk of accidental denial of service or lockout.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Automatically launching a local server and opening a browser creates side effects beyond the user’s apparent request and without informed consent. In this skill context, that is especially problematic because the skill is supposed to be tightly controlled around Terraform execution, not autonomous local app orchestration.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation exposes a destructive `execute-terraform-destroy` operation without stating that explicit user confirmation is required before invoking it. In an agent skill that executes infrastructure changes remotely, omission of a confirmation gate materially increases the risk of accidental or prompt-induced deletion of live cloud resources, especially because destroy only needs a `state-id` and uses the same execution channel as plan/apply.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The trust policy repair section instructs operators to add caller principals and attach AssumeRole permissions, which directly changes authorization boundaries and can grant new cross-identity access if applied incorrectly. Without a strong warning, scope limitations, and validation steps, these commands can cause privilege escalation or unintended service access disruption.

Natural-Language Policy Violations

High

Confidence: 89% confidence
Finding: The deployment approval prompt hardcodes Chinese-language interaction for a high-stakes authorization step involving resource creation and costs. In this context, unclear language at the final execution gate can cause users to misunderstand what they are authorizing, weakening informed consent and increasing the risk of unintended deployment.

Static analysis

No suspicious patterns detected.