alibabacloud-alb-ingress-doctor

• Outcome: Review
• Latest audit: Jul 28, 2026 · 8:52 AM UTC
• Version: 0.0.1

Overview

This diagnostic skill is mostly purpose-aligned, but it can fetch and persist kubeconfig credentials for every running ACK cluster without tight scoping or explicit per-cluster approval.

Review before installing. Use the core read-only diagnostic flow with an existing kubeconfig when possible. Avoid running cluster_connect.sh unless you intentionally want this skill to fetch and store kubeconfigs for all running ACK clusters in the account, and clean up generated ~/.kube/ack-*.yaml files when finished.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares only `allowed-tools: Bash Read`, yet its documented workflow includes shell-driven access to local files, cluster state, and companion scripts that can read sensitive kubeconfig data and invoke external CLIs. This mismatch weakens reviewability and policy enforcement because operators may underestimate the real execution and data-access surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The stated purpose is diagnostics, but the workflow also enumerates ACK clusters, retrieves kubeconfigs, writes them into `~/.kube`, and manages multi-cluster access. Those behaviors materially expand privilege and persistence beyond narrow troubleshooting, increasing the chance of unintended credential exposure or access to clusters the user did not intend to inspect.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script explicitly allows any command that is not recognized as a kubectl or aliyun CLI invocation, which creates a broad bypass of the write-approval control. In a diagnostic skill, this means an agent could execute arbitrary shell commands such as file writes, package installs, curl|sh, or indirect mutation via other tools without triggering user confirmation.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This hook is designed to make permission decisions for generic shell command strings rather than a narrowly constrained set of diagnostic operations. That broader control surface is risky because command classification is regex-based and incomplete, so the skill can be used to approve or pass through actions unrelated to ALB ingress diagnosis.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script’s documented behavior is to enumerate all ACK clusters, fetch kubeconfigs for each, and verify access, which materially exceeds the stated ALB Ingress diagnostic purpose. In a troubleshooting skill, broad cluster discovery plus credential acquisition expands access scope and enables lateral access across environments without clear necessity.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code requests kubeconfig credentials for every running cluster and writes them to disk, creating durable access artifacts for multiple clusters. Persisting broad administrative access tokens/configs is especially dangerous because compromise of the workstation, logs, backups, or subsequent tooling can expose credentials far beyond the original ALB troubleshooting task.

Credential Access

High

• Category: Privilege Escalation

Content

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

• Confidence: 95% confidence
• Finding: The script header explicitly describes automated fetching of kubeconfig for multiple clusters, indicating built-in credential acquisition capability. In the context of an ALB Ingress diagnostic skill, that capability is over-scoped and increases the chance of unnecessary credential collection and misuse.

Credential Access

High

• Category: Privilege Escalation

Content

# ============================================================
KUBE_DIR="$HOME/.kube"
KUBECONFIG_PREFIX="ack-"
TEMP_DURATION=4320  # kubeconfig validity (minutes), 3 days
SESSION_ID="$(openssl rand -hex 16)"

# Runtime Variables

• Confidence: 96% confidence
• Finding: Setting a temporary kubeconfig validity of 4320 minutes creates credentials that remain usable for up to three days, which is longer than typically needed for a diagnostic action. Longer-lived credentials widen the window for theft or accidental reuse if the generated kubeconfigs are exposed.

Credential Access

High

• Category: Privilege Escalation

Content

local kubeconfig_file="${KUBE_DIR}/${KUBECONFIG_PREFIX}${cluster_id}.yaml"

        # Fetch kubeconfig
        local private_flag="false"
        [[ "$PRIVATE_IP" == "true" ]] && private_flag="true"

• Confidence: 99% confidence
• Finding: This section initiates fetching kubeconfig material from the ACK API, which is direct credential acquisition. Because it is done in a loop over discovered clusters, it can harvest access for all running clusters rather than only the cluster relevant to the reported ALB problem.

Credential Access

High

• Category: Privilege Escalation

Content

continue
        fi

        # Save kubeconfig
        echo "$config_content" > "$kubeconfig_file"
        chmod 600 "$kubeconfig_file"
        echo "  kubeconfig saved: ${kubeconfig_file}"

• Confidence: 99% confidence
• Finding: This line writes the returned kubeconfig content to disk, creating a persistent credential artifact under the user’s home directory. Stored kubeconfigs can be exfiltrated by other local processes, backups, shell history follow-on commands, or later user mistakes, expanding the blast radius beyond transient diagnostics.

Credential Access

High

• Category: Privilege Escalation

Content

# Save kubeconfig
        echo "$config_content" > "$kubeconfig_file"
        chmod 600 "$kubeconfig_file"
        echo "  kubeconfig saved: ${kubeconfig_file}"

        # Verify connection
        if kubectl --kubeconfig "$kubeconfig_file" cluster-info &>/dev/null; then

• Confidence: 97% confidence
• Finding: This repeated use of the saved kubeconfig in kubectl confirms and operationalizes access using generated credentials. The danger is amplified by the script’s multi-cluster workflow, which can mass-test and normalize access across environments unrelated to the ALB troubleshooting request.

Credential Access

High

• Category: Privilege Escalation

Content

# Save kubeconfig
        echo "$config_content" > "$kubeconfig_file"
        chmod 600 "$kubeconfig_file"
        echo "  kubeconfig saved: ${kubeconfig_file}"

        # Verify connection
        if kubectl --kubeconfig "$kubeconfig_file" cluster-info &>/dev/null; then

• Confidence: 97% confidence
• Finding: This repeated use of the saved kubeconfig in kubectl confirms and operationalizes access using generated credentials. The danger is amplified by the script’s multi-cluster workflow, which can mass-test and normalize access across environments unrelated to the ALB troubleshooting request.

Static analysis

No suspicious patterns detected.