alibabacloud-agent-identity-agentrun-e2e

• Outcome: Review
• Latest audit: Aug 27, 2026 · 7:47 AM UTC
• Version: 0.0.1-beta.1

Overview

The skill matches its deployment purpose, but it automatically changes local tooling and Alibaba Cloud resources in ways users should review before installing.

Install only if you are comfortable with an agent-guided Alibaba Cloud deployment that can install local tools/packages, use your aliyun CLI profile, create and delete test cloud resources, and attach an OSS read policy to a runtime role. Prefer a test account or tightly scoped RAM policy, review each AUTO command before letting it run, protect ID tokens and DingTalk MCP URLs as secrets, and plan for manual console cleanup afterward.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly invokes shell commands, uses environment variables, and performs networked cloud operations, yet it declares no explicit permissions boundary. That mismatch weakens reviewability and consent because an operator cannot see, up front, that the skill can modify local configuration and create or alter cloud resources.

Natural-Language Policy Violations

Medium

• Confidence: 72% confidence
• Finding: Mandating Chinese-only output without user opt-in can impair informed consent and safe operation if the actual operator is not fluent in Chinese. In a deployment skill that changes cloud resources, reduced comprehension increases the chance of user error or accidental approval of impactful actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide instructs users to obtain and use a DingTalk MCP URL containing a personal `?key=` parameter, but the warning is brief and easy to miss in a long procedural section. Because that URL functions like a bearer secret, users may paste, store, or expose it in logs or chat transcripts, leading to unauthorized use of the MCP service.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The checklist instructs use of a fresh ID token in authenticated requests to the AgentRun endpoint but does not explicitly warn the user that this bearer credential is being transmitted and must only be used against the expected trusted endpoint. In this context, the endpoint is central to the e2e test, so the behavior is expected, but omission of a clear warning increases the risk of credential misuse, replay against the wrong host, or accidental disclosure during copy/paste, logging, or shell history.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script modifies the user's global aliyun CLI configuration and attempts plugin installation automatically, without an explicit consent gate at execution time. While not credential-stealing or overtly malicious, this changes host state and can trigger network downloads or trust changes in a non-interactive context, which is risky for an agent skill expected to minimize side effects.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The helper installs Python packages automatically into the current environment when imports fail. This is a supply-chain and environment-integrity risk because it performs network-backed package installation without an explicit confirmation step and may alter a user's runtime unexpectedly.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The function installs SDK packages into the active conda environment on demand, which mutates the user's selected environment and trusts remote package sources implicitly. In an agent-executed workflow, undisclosed environment changes can create persistence, break reproducibility, or expose the user to package-supply-chain risk.

Hidden Instructions

High

• Category: Prompt Injection

Content

## Execution Rules

1. Blocks marked `<!-- AGENT:AUTO -->` — execute directly in the terminal, no user confirmation needed.
2. Blocks marked `<!-- AGENT:WAIT:description -->` — STOP and wait for the user's response before proceeding.
3. Cloud credentials come from the aliyun CLI profile (never a secrets file, and never read or exported by any script). If the CLI is not configured, guide the user through `aliyun configure`; verify with `aliyun sts get-caller-identity` before any cloud call. Python SDKs resolve the same profile through the credential chain's `cli_profile` provider — never pass, print or export an AccessKey pair.
4. On command failure, stop and report the error (with logs) to the user. Do NOT retry automatically; retry only after the user confirms. Match errors against `references/troubleshooting.md` first.

• Confidence: 89% confidence
• Finding: The skill embeds hidden control directives that tell an agent to execute terminal commands without user confirmation. In this context, those commands can clone code, alter local CLI settings, create cloud resources, and attach IAM/RAM policies, so concealed execution semantics materially increase the risk of unreviewed or insufficiently consented actions.

Hidden Instructions

High

• Category: Prompt Injection

Content

## Phase 3: Build & Deploy

<!-- AGENT:AUTO -->
Build the deployment zip (cross-platform dependency vendoring — the exact
pip invocation matters, see `references/packaging.md`):

• Confidence: 87% confidence
• Finding: This hidden AUTO block initiates a build script automatically, and the surrounding workflow includes additional unattended shell execution tied to deployment. Auto-running scripts from a cloned repository or local project can execute arbitrary code paths, access the network, and prepare artifacts that are later deployed to cloud infrastructure without a fresh approval checkpoint.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# --- zip ---------------------------------------------------------------------------
ZIP="${E2E_ZIP:-$STATE_DIR/agentrun-e2e-sample.zip}"
rm -f "$ZIP"
/usr/bin/zip -qr "$ZIP" . -x "*__pycache__*"
save_kv E2E_ZIP "$ZIP"
log_ok "built: $ZIP ($(du -h "$ZIP" | cut -f1))"

• Confidence: 84% confidence
• Finding: `ZIP` is taken from `E2E_ZIP` if set, and the script unconditionally runs `rm -f "$ZIP"` before creating the archive. If an attacker or unsafe caller can influence that environment variable, they can cause deletion of an arbitrary file writable by the current user, which is especially relevant in a deployment/build skill that encourages operator execution in real environments.

Static analysis

No suspicious patterns detected.