ClawHub
Back to skill

Security audit

alibabacloud-actiontrail-diagnosis

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent read-only Alibaba Cloud audit-log query tool, with some expected privacy and dependency-installation cautions.

Install only if you need Alibaba Cloud ActionTrail diagnostics, use a RAM role limited to actiontrail:LookupEvents and sts:GetCallerIdentity, avoid ACTIONTRAIL_AUTO_INSTALL in controlled environments, and treat generated audit logs and JSON output as sensitive account activity data.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
file=sys.stderr,
    )
    try:
        subprocess.run(
            [sys.executable, "-m", "pip", "install", "requests>=2.20.0"],
            check=True,
            timeout=120,
Confidence
91% confidence
Finding
The skill can invoke `pip install` at runtime when `ACTIONTRAIL_AUTO_INSTALL` is enabled. Even though the package name is fixed, this still introduces code execution and supply-chain risk unrelated to a read-only audit-log skill, because it downloads and executes external package installation logic in the current interpreter environment.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares itself as a read-only diagnostic tool, but it clearly depends on environment access, network access, and shell execution to function. When these capabilities are undeclared, operators may grant or run the skill without understanding its true execution surface, which increases the risk of credential exposure, unintended external calls, or supply-chain behavior in supporting scripts.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose emphasizes read-only ActionTrail diagnosis, but the behavior also includes credential file access, STS identity calls, custom User-Agent tagging, and optional package installation via pip. The auto-install path is especially risky because it introduces code execution and supply-chain exposure beyond the stated audit-query function, while the undeclared credential handling broadens the trust boundary.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
A read-only diagnosis skill should not mutate the runtime environment by installing Python packages on demand. This expands the trust boundary to package repositories and allows unexpected code execution during what should be a passive audit workflow.

Session Persistence

Medium
Category
Rogue Agent
Content
## Output Specification

Default output is a Markdown table with exactly these 12 columns, in this order: `Event Time (Beijing) | Event Name | Event ID | Cloud Service | Event Source | Region | Operator (Type) | Read/Write | Event Type | Source IP | Role Session | Related Resources`. Failure events are marked in the Related Resources column with `❌` plus an error label (a non-empty `errorCode` yields that code; a non-empty `errorMessage` alone yields `Failed`). After the table (and any truncation warning), table mode always appends a **Friendly Summary** — plain English, plain text, at most 20 lines, computed from the actual result — with four fixed sections: `## Query Scope` (account UID with provided/derived source, regions checked, human-readable Beijing-time window, plain-language translation of the filters), `## Key Findings` (total events, read/write breakdown, top 3 operators, top 3 services, failed-operation count; for zero events it states that no matching events were found in this scope plus one likely reason), `## Points to Note` (only when applicable: truncation, partial region failures, account mismatch, unrecognized ServiceName, global-service pinning — each explained in non-technical terms), and `## Suggested Next Steps` (1–3 actionable recommendations derived from the actual result state). The Friendly Summary is written for non-technical readers and goes through the same masking as the table. With `--summary`, only the one-line summary is appended instead of the Friendly Summary; with `--json`, no Friendly Summary is emitted.

With `--json`, the top-level contract fields are: `success`, `partial`, `failed_regions`, `truncated`, `events`, `total_count`, `start_time`, `end_time`, `pages`, `regions`, `per_region`, `uid`, `uid_source`, `lookup_attributes`, `direction`. `uid` is the effective account UID and the only intentionally plaintext identifier in the JSON — UIDs embedded inside `events` (accountId / principalId / ARN) remain masked; `uid_source` 
...[truncated 25 chars]
Confidence
74% confidence
Finding
The output specification intentionally includes plaintext account UID and detailed event metadata in JSON so downstream agents can reproduce queries. Even if secrets are masked, retaining and propagating identifiers, operator activity, source IPs, and audit history can create privacy and correlation risks if outputs are logged, persisted, or forwarded to other systems without minimization controls.

Static analysis

No suspicious patterns detected.