alibabacloud-alb-ingress-doctor

• Outcome: Review
• Latest audit: Jul 28, 2026 · 8:52 AM UTC
• Version: 0.0.1

Overview

This diagnostic skill is mostly purpose-aligned, but it can fetch and persist kubeconfig credentials for every running ACK cluster without tight scoping or explicit per-cluster approval.

Review before installing. Use the core read-only diagnostic flow with an existing kubeconfig when possible. Avoid running cluster_connect.sh unless you intentionally want this skill to fetch and store kubeconfigs for all running ACK clusters in the account, and clean up generated ~/.kube/ack-*.yaml files when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares only `allowed-tools: Bash Read`, yet its documented workflow includes shell-driven access to local files, cluster state, and companion scripts that can read sensitive kubeconfig data and invoke external CLIs. This mismatch weakens reviewability and policy enforcement because operators may underestimate the real execution and data-access surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The stated purpose is diagnostics, but the workflow also enumerates ACK clusters, retrieves kubeconfigs, writes them into `~/.kube`, and manages multi-cluster access. Those behaviors materially expand privilege and persistence beyond narrow troubleshooting, increasing the chance of unintended credential exposure or access to clusters the user did not intend to inspect.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script explicitly allows any command that is not recognized as a kubectl or aliyun CLI invocation, which creates a broad bypass of the write-approval control. In a diagnostic skill, this means an agent could execute arbitrary shell commands such as file writes, package installs, curl|sh, or indirect mutation via other tools without triggering user confirmation.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This hook is designed to make permission decisions for generic shell command strings rather than a narrowly constrained set of diagnostic operations. That broader control surface is risky because command classification is regex-based and incomplete, so the skill can be used to approve or pass through actions unrelated to ALB ingress diagnosis.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script’s documented behavior is to enumerate all ACK clusters, fetch kubeconfigs for each, and verify access, which materially exceeds the stated ALB Ingress diagnostic purpose. In a troubleshooting skill, broad cluster discovery plus credential acquisition expands access scope and enables lateral access across environments without clear necessity.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code requests kubeconfig credentials for every running cluster and writes them to disk, creating durable access artifacts for multiple clusters. Persisting broad administrative access tokens/configs is especially dangerous because compromise of the workstation, logs, backups, or subsequent tooling can expose credentials far beyond the original ALB troubleshooting task.

Credential Access

High

• Category: Privilege Escalation

Content

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

• Confidence: 95% confidence
• Finding: kubeconfig

Credential Access

High

• Category: Privilege Escalation

Content

# ============================================================
KUBE_DIR="$HOME/.kube"
KUBECONFIG_PREFIX="ack-"
TEMP_DURATION=4320  # kubeconfig validity (minutes), 3 days
SESSION_ID="$(openssl rand -hex 16)"

# Runtime Variables

• Confidence: 96% confidence
• Finding: kubeconfig

Credential Access

High

• Category: Privilege Escalation

Content

local kubeconfig_file="${KUBE_DIR}/${KUBECONFIG_PREFIX}${cluster_id}.yaml"

        # Fetch kubeconfig
        local private_flag="false"
        [[ "$PRIVATE_IP" == "true" ]] && private_flag="true"

• Confidence: 99% confidence
• Finding: kubeconfig

Credential Access

High

• Category: Privilege Escalation

Content

continue
        fi

        # Save kubeconfig
        echo "$config_content" > "$kubeconfig_file"
        chmod 600 "$kubeconfig_file"
        echo "  kubeconfig saved: ${kubeconfig_file}"

• Confidence: 99% confidence
• Finding: kubeconfig

Credential Access

High

• Category: Privilege Escalation

Content

# Save kubeconfig
        echo "$config_content" > "$kubeconfig_file"
        chmod 600 "$kubeconfig_file"
        echo "  kubeconfig saved: ${kubeconfig_file}"

        # Verify connection
        if kubectl --kubeconfig "$kubeconfig_file" cluster-info &>/dev/null; then

• Confidence: 97% confidence
• Finding: kubeconfig

Credential Access

High

• Category: Privilege Escalation

Content

# Save kubeconfig
        echo "$config_content" > "$kubeconfig_file"
        chmod 600 "$kubeconfig_file"
        echo "  kubeconfig saved: ${kubeconfig_file}"

        # Verify connection
        if kubectl --kubeconfig "$kubeconfig_file" cluster-info &>/dev/null; then

• Confidence: 97% confidence
• Finding: kubeconfig

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.