Security audit
Security checks for vulnerabilities and agentic risk
This read-only audit tool needs review because its credential handling can expose cloud secrets.
Review credential handling and require strict region validation before use. Until fixed, use an explicit CLI profile with verified region IDs and avoid environment credentials with the CLI backend. Use short-lived credentials limited to the two documented read-only APIs, keep queries narrow, and treat audit results as sensitive.
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
## Absolute Rules — read before doing anything
1. **Strictly READ-ONLY. Never write.** Under NO circumstances execute any command or API call that mutates state (`Create*`, `Update*`, `Modify*`, `Delete*`, `Disable*`, `Set*`, `Start*`, `Stop*`, …). This skill only queries ActionTrail audit events and the caller identity; any write-API attempt is a hard failure.
2. **Never output credentials.** Never print, cat, or quote credential files (`~/.aliyun/config.json`), environment variable values, AccessKey pairs, or STS tokens. Reference credential fields by name only; do not echo secrets into the conversation or the report.
3. **Ask before running when information is insufficient.** If a required input (region, time range, target product/event) is missing and cannot be safely defaulted, ask the user first — do NOT guess and run wide, unfiltered queries. UID is the only input that may always be auto-derived (see Information Completeness).
4. **Output must be based on real API returns. Nev
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Debug URL
https://api.aliyun.com/api/Actiontrail/2020-07-06/LookupEvents
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
file=sys.stderr,
)
try:
subprocess.run(
[sys.executable, "-m", "pip", "install", "requests>=2.20.0"],
check=True,
timeout=120,
Although the subprocess argument list prevents shell injection, its construction places the AccessKey secret and optional STS token directly in command-line arguments. Local processes with sufficient visibility, process-monitoring agents, or execution telemetry can capture those credentials and use their granted cloud permissions; read-only credentials would still expose sensitive audit information.
cmd += [f"--{key}", str(value)]
try:
result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
except subprocess.TimeoutExpired:
# A CLI-side timeout is treated as a network-level transient failure
# so call_with_retry can back off and retry it.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
cmd += [f"--{key}", str(value)]
try:
result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
except subprocess.TimeoutExpired:
# A CLI-side timeout is treated as a network-level transient failure
# so call_with_retry can back off and retry it.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
| Product / event target (`--lookup-attribute`) | YES in practice | Ask which cloud service, event name, resource, or user to focus on; avoid unfiltered account-wide scans. Keys and values are case-sensitive; at most 2 conditions, combined with AND. Rules in [lookup-attribute.md](references/lookup-attribute.md). |
| `--uid` | NO | Auto-derived via STS `GetCallerIdentity` when omitted (5-25 digits). If the provided `--uid` differs from the credential's UID, the script prints an ACCOUNT MISMATCH WARNING — surface it explicitly to the user. |
Missing a required item → restate what is known, ask the user, and wait. Never silently expand scope beyond the confirmed region/time/product.
## CLI Options
The docstring specifies that the user-facing Friendly Summary must be English, and the implementation uses fixed English report text. No language choice or opt-in is provided, and querying Alibaba Cloud audit events does not justify restricting the report's natural language.
The declared range permits historical Requests releases with known security vulnerabilities, and an already-installed vulnerable release can satisfy this requirement without being upgraded. This is a dependency-policy weakness in a credential-bearing HTTPS client, although the advisory count alone does not prove that the installed version or these specific request paths are exploitable.