alibabacloud-ak-leak-incident-response

• Outcome: Review
• Latest audit: Aug 24, 2026 · 3:49 AM UTC
• Version: 0.0.1

Overview

This is mostly a read-only Alibaba Cloud leak investigation skill, but it reaches broader account audit and identity data than the narrow leaked-key framing implies and can optionally install a dependency at runtime.

Review before installing in a sensitive account. Use a least-privilege read-only Alibaba Cloud policy, expect account-wide ActionTrail/RAM data to be queried, keep AK_LEAK_AUTO_INSTALL unset unless you explicitly approve a runtime pip install, and treat the generated report, stderr logs, and audit correlation session ID as sensitive investigation artifacts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

file=sys.stderr,
    )
    try:
        subprocess.run(
            [sys.executable, "-m", "pip", "install", "requests>=2.20.0"],
            check=True,
        )

• Confidence: 95% confidence
• Finding: The module can invoke `pip install requests>=2.20.0` at runtime in the current interpreter when an environment variable enables it. Even though the package name is hardcoded, this still changes the host environment, performs network/package execution, and contradicts the skill's read-only incident-response purpose, increasing supply-chain and unintended side-effect risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd += [f"--{key}", str(value)]

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
    except subprocess.TimeoutExpired:
        raise CliError(f"aliyun {product} {action} timed out after {timeout}s")

• Confidence: 75% confidence
• Finding: This subprocess call executes the external `aliyun` binary with user-influenced `product`, `action`, and parameter keys/values. It does not use a shell, so classic shell injection is mitigated, but it still allows argument injection into a powerful cloud CLI and trusts whatever `aliyun` binary is found on `PATH`, which can lead to unintended operations or execution of a trojaned binary.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill exposes powerful capabilities (environment access, file write, network, and shell) without declaring permissions or constraining their use in the metadata. Even though the document repeatedly says the workflow is read-only, those undeclared capabilities increase the chance of unexpected credential access, local file inspection, or execution of broader commands than the user anticipates.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a targeted leaked-AK investigation tool, but the behavior described goes well beyond that scope into broad account enumeration and generic audit capability. This creates an over-collection/privacy risk and can surprise users by gathering unrelated account-wide security data, especially in a sensitive incident-response context where operators may trust the stated narrow purpose.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill advertises read-only investigation/reporting but contains code to modify the local environment by installing packages. That hidden side effect expands the trust boundary from cloud read operations to local code acquisition and execution, which is not justified by the stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: On-demand `pip` installation is unrelated to AK-leak investigation and introduces unnecessary attack surface through package retrieval and installation. In an incident-response context, investigators often run tooling in sensitive environments, so unexpected environment mutation is especially risky.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation states that every API call includes the leaked AccessKey identifier and a generated session identifier in the User-Agent, and that this value is also logged at startup. In an incident-response skill handling compromised credentials, transmitting and logging correlation metadata without an explicit privacy warning or minimization increases exposure of sensitive investigation data across Alibaba Cloud control-plane logs, proxies, shells, and CI/runtime logs.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The template includes destructive remediation actions such as disabling keys, deleting accounts, revoking assignments, and terminating instances, but it does not require any cautionary language, validation steps, or operator confirmation. In an incident-response skill, these actions may be appropriate, but presenting them as unconditional recommendations increases the risk that a user or downstream automation will perform irreversible changes without checking business ownership, evidentiary needs, or operational impact.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code can execute `pip` without a direct confirmation prompt at the time of execution, based solely on an environment variable. In practice, inherited environment settings or automation may trigger package installation unexpectedly, causing unreviewed code changes on the host during an investigation.

Unvalidated Output Injection

High

• Category: Output Handling

Content

cmd += [f"--{key}", str(value)]

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
    except subprocess.TimeoutExpired:
        raise CliError(f"aliyun {product} {action} timed out after {timeout}s")

• Confidence: 78% confidence
• Finding: The command line is assembled from unvalidated parameter names and values and passed directly to the `aliyun` CLI. Although `shell=False` prevents shell metacharacter injection, attacker-controlled keys like `--foo`-style options or unexpected action/product values can alter CLI behavior, potentially turning a nominally investigative tool into one that performs unintended cloud operations.

Static analysis

No suspicious patterns detected.