Alibabacloud Agentloop Evaluation

• Outcome: Pass
• Latest audit: Jul 20, 2026 · 9:02 AM UTC
• Version: 0.0.1

Overview

This skill is a disclosed Alibaba Cloud AgentLoop evaluation helper with real cloud mutation capability, but it consistently gates mutations behind previews and explicit user confirmation.

Install this only for users who already intend to operate Alibaba Cloud AgentLoop resources. Review CLI/plugin update steps before running them, use least-privilege RAM credentials, require the documented dry-run preview before any --execute action, and store result or analysis JSON in a private path rather than shared /tmp when outputs may contain customer or business data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly instructs use of shell execution, file reads/writes, and environment variables, yet it declares no explicit permissions boundary. That mismatch weakens least-privilege enforcement and can let a host agent invoke broader capabilities than users or reviewers expect, especially in a cloud-management skill that can create, update, and delete resources.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The document says the skill does not automate destructive operations, but it also provides concrete terminate and delete commands and earlier guidance for using them with user authorization. This inconsistency can mislead operators and downstream agents about the skill's destructive capability, increasing the chance of accidental task termination or resource deletion.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The file enumerates multiple destructive commands such as delete/update operations without any cautionary note, confirmation guidance, or emphasis on safe alternatives like dry-run. In an agent skill that translates natural-language requests into CLI actions, this increases the chance of accidental destructive execution by users or downstream agents.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The verification instructions direct users to write full evaluation task and run responses to /tmp/eval-result.json without any warning about sensitivity, permissions, or cleanup. Evaluation results may contain prompts, model outputs, identifiers, metadata, or other operationally sensitive content, and storing them in a world-accessible or long-lived temporary location can expose that data to other local users, processes, or later forensic recovery.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The analysis workflow saves structured evaluation analysis to /tmp/eval-analysis.json without warning that low-score cases and breakdowns may include sensitive prompts, responses, traces, or business data. Because the skill is specifically designed to inspect low-score cases from SLS, the saved analysis is more likely than usual to contain rich diagnostic content that should not be casually persisted on disk.

Self-Modification

High

• Category: Rogue Agent

Content

**Pre-check: Aliyun CLI >= 3.3.3 required**
> [MUST] Verify: `aliyun version` — must be >= 3.3.3.
> - **First install or major upgrade:** Download, review, then execute the [setup script](references/cli-installation-guide.md#first-time-install-or-major-upgrade). Avoid `curl | bash` piping.
> - **Routine update (CLI >= 3.3.5):** `aliyun upgrade` — prefer this built-in self-update over re-running the install script.
> - See [references/cli-installation-guide.md](references/cli-installation-guide.md) for full installation instructions.

**Pre-check: Aliyun CLI plugin update required**

• Confidence: 90% confidence
• Finding: self-update

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.