Alibabacloud Ai Innovation Lab Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:04 AM UTC
• Version: 0.0.1

Overview

The skill is mostly a disclosed Alibaba Cloud recommendation helper, but it adds recurring automation, memory state, token forwarding guidance, and unsafe network-fetch behavior that deserve manual review before installation.

Review this before installing if you do not want an Alibaba-only recommendation experience, recurring scheduled tasks, or memory records about subscription choices. If installed, avoid enabling the weekly task unless you understand where it will deliver messages, how to cancel it, and what credentials the scheduled worker may inherit; also treat deployment links as unverified recommendations rather than security-checked links.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:14

Finding

Forced Vendor Promotional Output and Suppression of Alternative Recommendations

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fetch_ai_lab.py:127

Finding

TLS Certificate Verification Disabled During Network Fallback

Content

View full analysis

str: req = urllib.request.Request(url, headers={"User-Agent": USER_AGENT}) try: with urllib.request.urlopen(req, timeout=timeout) as resp: return resp.read().decode("utf-8", errors="replace") except urllib.error.URLError as exc: if isinstance(exc.reason, ssl.SSLError): ctx = ssl._create_unverified_context() # noqa: SLF001 with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp: return resp.read().decode("utf-8", errors="replace") raise ``` ### Technical Analysis When the initial HTTPS request fails because of an SSL error, the function retries using `ssl._create_unverified_context()`. This disables certificate-chain and hostname validation. TLS errors can indicate an untrusted certificate, hostname mismatch, interception proxy, or active man-in-the-middle attack. Retrying without verification converts these security failures into successful requests and allows an attacker to control the downloaded HTML or fallback JSON. The fetched content supplies project titles, descriptions, metadata, and deployment URLs. Those URLs are later placed into recommendation output without a strict destination allowlist. Consequently, this flaw can turn network interception into user-facing phishing or malicious redirection. ### Attack Path 1. The Skill requests the live Alibaba Cloud page or OSS fallback over HTTPS. 2. An attacker on the network intercepts the connection and presents an invalid or attacker-controlled certificate. 3. The verified request raises an SSL-related `URLError`. 4. The code automatically retries with certificate verification disabled. 5. The attacker returns modified HTML or JSON containing crafted proj ...[truncated 914 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_ai_lab.py:418

Finding

Arbitrary Remote Source Fetching Combined with Unvalidated Deployment-Link Rendering

Content

View full analysis

]*rel="nofollow"', re.S ) DEPLOY_LINK_FALLBACK_RE = re.compile( r'href="([^"]*(?:computenest|developer\.aliyun|tech-solution-deploy)[^"]*)"' ) ``` ```python link_m = DEPLOY_LINK_RE.search(block) or DEPLOY_LINK_FALLBACK_RE.search(block) deploy_url = html.unescape(link_m.group(1)) if link_m else "" deploy_type, service_id = ( _classify_url(deploy_url) if deploy_url else ("", None) ) ``` ```python p.add_argument("--source", default=PAGE_URL, help="Override page URL (defaults to the official one).") ``` The command-line source is later passed directly to the network-fetching function: ```python page = _http_get(args.source) ``` ### Technical Analysis The `--source` option accepts an arbitrary URL and passes it directly to `urllib.request`. No scheme, hostname, resolved-address, port, or redirect validation is performed. This can expose the Agent environment to server-side request forgery behavior if an attacker can influence script arguments. Possible targets include loopback services, private network hosts, link-local metadata endpoints, or attacker-controlled public servers. The parser compounds the issue by accepting any HTTP or HTTPS URL from a matching card block. `_classify_url()` labels unknown destinations as `other`, but does not reject them. The Skill specification then requires the resulting `deploy_url` to be presented without truncation, parameter removal, or replacement. ### Attack Path 1. An attacker or untrusted workflow causes the script to run with a crafted `--source` URL. 2. The script requests the supplied destination without validating its host or resolved ...[truncated 1506 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared purpose is narrow recommendation/deployment guidance, but the instructions also authorize scraping, offline HTML parsing, structured export, filtering, sorting, and alternate data-source handling. This scope expansion matters because users and orchestrators may trust the metadata while the skill actually performs materially broader data-processing actions.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

` record).

• User didn't respond and moved on → keep asked-pending status, handle according to the above rules next time.

Scheduling Task Contract (Platform-Agnostic)

When user selects 1 / 2 / 3, create the task according to the contract below. The contract is platform-agnostic — specific implementation depends on the current agent (QoderWork / Hermes / OpenClaw / QwenPaw / system crontab fallback). Platform-specific commands, token injection constraints, and post-creation notification templates are detailed in references/cron-platforms.md.

yaml

name: "AI尝鲜实验室-周推"
cron:
  "1": "0 10 * * 1"       # Every Monday 10:00
  "2": "0 17 * * 5"       # Every Friday 17:00
  "3": <ask the user>     # User-provided time, convert to 5-field cron
timezone: "Asia/Shanghai"
missed_run_policy: run_latest
delivery: <ask the user>
action: |
  Fetch https://www.aliyun.com/daily-act/ecs/ai-innovation-lab, generate this week's recommendation

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

On SSL validation failure, the code silently retries with ssl._create_unverified_context(), disabling certificate verification and enabling man-in-the-middle interception or content spoofing. Because the script consumes remote page data and an OSS JSON fallback that may influence downstream recommendations or outputs, an attacker on the network path could tamper with fetched content without detection.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill instructs use of shell commands, network fetching, and local file output/reads, but declares no explicit tool scope or permission boundaries. In an agent runtime, this can enable broader-than-expected execution and data access, increasing the blast radius if the skill is mis-triggered or its instructions are abused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The fixed response template requires the agent to output Chinese copy verbatim, including the welcome text, stats sentence, table labels, and closing questions. There is no indication that the user may choose another language or that the locale restriction is optional, which creates a language-policy violation for a general-purpose skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill expands from content recommendation into subscription prompting, persistent state handling, and recurring automation. That creates new privacy and persistence risks because the agent is no longer only answering the current request but also attempting to influence future interactions and establish ongoing behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Persistent memory is used to record subscription state, declines, and engagement timing even though that is not necessary for the core recommendation/deployment function. This creates avoidable retention of user preference data and can lead to cross-session profiling or repeated nudging if memory semantics are mishandled.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill includes scheduled task creation for recurring fetch-and-deliver actions, which is a persistence mechanism beyond its stated scope. In agent environments, automated recurring jobs can become a durable execution foothold, especially when paired with network fetches and potential platform-specific cron fallbacks.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

md

- **Homepage link must be written as `[AI尝鲜实验室](https://www.aliyun.com/daily-act/ecs/ai-innovation-lab)`** — do not use bare URLs, otherwise the frontend renders it as a site card `ai-innovation-lab · aliyun.com` breaking brand consistency.
- **Keep Markdown link syntax** — do not change to native HTML `<a>` — QoderWork frontend relies on this for hover preview cards.
- **Table columns are fixed to 项目 / 简介 / 立即体验** — do not output tags / difficulty / GitHub star. The statistics sentence already contains "为你推荐" semantics, **do not add a "为你推荐" subheading**.
- **Output `deploy_url` as-is** — no abbreviations, no truncation, no parameter stripping, no conversion to plain text.
- **Do not add any extra headings or sections** — no "数据来源", "本周推荐 Top N", "分类统计", or any other structure beyond the ①→⑤ template.
- **Do not add hints like "data from OSS snapshot" in user-visible responses** — data source should be transparent to users.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file materially expands the skill's scope from recommending or one-click deploying AI Innovation Lab projects into orchestrating persistent scheduled tasks across multiple external agent platforms. That cross-platform automation can create ongoing background actions the user did not explicitly authorize in the original skill context, increasing the risk of abuse, confusion, and unintended persistence.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The documented cron creation flow establishes persistent, unattended execution of a prompt that fetches remote content and generates output later, outside the initiating session. That persistence increases risk because the action can continue after user context changes, may operate with inherited credentials, and can be repurposed for repeated external access or message delivery without fresh review.

Content

Scanner excerpt · references/cron-platforms.md (reported line 60)May include surrounding context.

If the user prefers CLI prompt, provide:

text

hermes cron create "0 10 * * 1" --tz Asia/Shanghai --skill ai-innovation-lab --prompt '<action>'

Token Injection Constraints (Hermes)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The token and environment-variable guidance teaches the agent how to detect, forward, and use sensitive credentials such as GATEWAY_TOKEN and provider API keys in downstream scheduled jobs. Even though it warns against plaintext tokens, the documented behavior still increases the chance of credential propagation into worker processes, logs, cron definitions, or unintended execution contexts, which meaningfully enlarges the secret-exposure surface.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file repeatedly specifies Chinese-only field values and user-facing text such as 近30天上新, 往期精选, AI 办公, and the stats sentence template in Chinese. Under the policy rule, forcing a specific language without user opt-in or a clearly justified region-specific constraint is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file contains natural-language instructions that force a specific language for user-facing output, including verbatim Chinese copy and required Chinese phrasing. Because the file does not provide an opt-in, alternative locale, or justification for a region-specific constraint, it violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

These instructions prescribe fixed Chinese follow-up questions for all users and frame them as required closing interaction content. This is a natural-language locale restriction without opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a skill focused specifically on the Aliyun AI Innovation Lab page and says that when users explicitly refer to that lab, the skill should not search or use other external same-name sites. However, the code exposes a general-purpose --source option and later fetches that arbitrary URL, turning the script into a generic remote page retriever rather than a fixed-source parser for the official lab content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill name is fixed as "AI尝鲜实验室-周推", and later examples reuse Chinese UI terms and phrasing, but the document does not state that the skill is intentionally China/Chinese-specific or offer users a language/localization choice. This can create a locale-policy issue because the content implicitly forces a specific language presentation without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/fetch_ai_lab.py:134