Security audit

Alibabacloud Agentloop Dataset

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Alibaba Cloud AgentLoop Dataset work, but several documented command templates can turn user-supplied descriptions, JSON rows, or search text into local shell execution if followed literally.

Review before installing. Use this only with trusted inputs and a least-privilege Aliyun identity, and prefer implementations that pass CLI arguments as an argument array with shell execution disabled or otherwise apply robust shell escaping and query literal encoding. Do not follow the placeholder command templates literally for arbitrary descriptions, row data, or search phrases.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: references/dataset-management.md:57
Finding: Shell Command Injection Through Dataset Description Interpolation
Content: View full analysis
\ --agent-space \ --dataset-name \ --description "" \ --schema '{ "question":{"type":"text","chn":true,"embedding":"agentloop-embedding-v4"}, "answer":{"type":"text","chn":true}, "score":{"type":"double"}, "metadata":{"type":"json","jsonKeys":{"source":{"type":"text"},"latency_ms":{"type":"long"}}} }' \ --client-token ``` The same unsafe pattern appears in the update example at `references/dataset-management.md:115-121`: ```bash aliyun agentloop update-dataset \ --region \ --agent-space \ --dataset-name \ --description "" \ --client-token ``` ### Technical Analysis The Skill directs the Agent to substitute confirmed or user-supplied values into a shell command. Placing a value inside double quotes does not suppress shell command substitution, backtick substitution, or parameter expansion. Consequently, a description containing shell syntax such as `$(...)` can be evaluated locally before `aliyun` receives the argument. The AgentSpace, region, Dataset name, and client token placeholders also lack consistent shell-safe encoding. Dataset names are constrained elsewhere, but the documented examples do not provide equivalent strict validation for every interpolated identifier. Parameter confirmation and `--cli-dry-run` do not mitigate this flaw because shell expansion occurs before the CLI starts. ### Attack Path 1. An attacker supplies or causes the Agent to process a Dataset description containing command-substitution syntax, such as `$(touch /tmp/agentloop-injection-test)`. 2. The A ...[truncated 1100 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/data-operations.md:44
Finding: Shell Command Injection Through Inline JSON Row Data
Content: View full analysis
\ --agent-space \ --dataset-name \ --data-array '' \ --client-token \ --cli-dry-run ``` The normal-write example at `references/data-operations.md:7-25` uses the same inline, single-quoted JSON transport pattern: ```bash aliyun agentloop add-dataset-data \ --region \ --agent-space \ --dataset-name \ --data-array '[ { "question":"How do I inspect an error?", "answer":"Start with the request ID.", "score":0.95, "metadata":{"source":"manual","latency_ms":120} }, { "question":"How do I retry safely?", "answer":"Reuse the same idempotency token.", "score":0.91, "metadata":{"source":"reviewed","latency_ms":85} } ]' \ --client-token ``` ### Technical Analysis Literal JSON examples are safe as written, but the generic workflow instructs the Agent to replace `` with user-approved row data inside a single-quoted shell argument. JSON strings may legitimately contain apostrophes. An apostrophe in substituted data terminates the shell's single-quoted context; subsequent characters can then be interpreted as shell syntax. JSON validation does not make a value safe for insertion into shell source code. Similarly, `--cli-dry-run` only prevents the cloud mutation; it does not prevent the local shell from expanding or executing injected syntax before launching the CLI. The Skill allows request bodies up to 100 MiB and may construct rows from files or other sources. This creates a broad input surface in which malicious shell characters could be embedded deeply inside ...[truncated 1296 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/query-syntax.md:110
Finding: Shell Command Injection Through Semantic Query Construction
Content: View full analysis
\ --agent-space \ --dataset-name \ --type SQL \ --query "similarity(question, '') < 0.3" # Top-K semantic retrieval. aliyun agentloop execute-query \ --region \ --agent-space \ --dataset-name \ --type SQL \ --query "topk(question, '') <= 10" ``` A similar pattern appears in the SQL semantic-distance example at `references/query-syntax.md:148-153`: ```bash aliyun agentloop execute-query \ --region \ --agent-space \ --dataset-name \ --type SQL \ --query "SELECT id, question, semantic_distance(question, '', 'l2') AS distance FROM ORDER BY distance ASC LIMIT 10" ``` ### Technical Analysis The query is enclosed in shell double quotes, while the semantic-search value is represented with SQL-style single quotes inside that double-quoted shell string. SQL single quotes have no protective effect on shell evaluation. If `` contains command substitution such as `$(...)` or backticks, the shell evaluates it before passing the query to `aliyun`. There is also a second injection boundary at the query language layer. The public API accepts raw query text and exposes no bind-parameter mechanism. An apostrophe or query operator in a semantic value can terminate or alter the intended SearchExpr or SQL literal. The Skill correctly warns elsewhere not to place user-provided text into SQL, but these semantic-query templates require precisely that behavior and do not define a safe encoding method. This is internally inconsistent. ...[truncated 1593 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
Security rules: - Never read, echo, print, or paste AccessKey IDs, AccessKey secrets, security tokens, or other credentials. - Never ask the user to pass literal credentials in a command or conversation. - Never run `aliyun configure set` with literal credential values. - Use only `aliyun configure list` to check whether a usable identity and region are configured.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.
md
| Wrong | Right | Reason | | --- | --- | --- | | `aliyun cms ... dataset ...` | `aliyun agentloop ...` | This skill uses the AgentLoop 2026-05-20 public API. | | `--type sql` without checking | `--type SQL` | The service currently requires `SQL`. | | Create with an empty schema | Supply at least one typed field | Empty schemas are rejected. | | Update an existing field type | Add a new top-level field or update description | Schema evolution is add-only. | | Put JSON in a `text` field | Declare/use a `json` field | Structured writes validate field types. |

Static analysis

No suspicious patterns detected.