alibabacloud-alb-ingress-doctor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 0.0.1

Overview

The skill is a real ALB Ingress diagnostic helper, but it can broadly create and retain cluster access credentials and may expose sensitive Kubernetes secret data during troubleshooting.

Install only if you are comfortable granting this skill access to Kubernetes and Alibaba Cloud diagnostic credentials. Prefer using an existing kubeconfig for one selected cluster, avoid running the all-cluster kubeconfig helper unless necessary, delete generated ~/.kube/ack-*.yaml files after use, and avoid commands that print full Kubernetes Secrets.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/cluster_connect.sh:12

Finding

Account-Wide Cluster Enumeration and Bulk Kubeconfig Acquisition

Content

View full analysis

&1; then : else echo "[FAIL] Failed to fetch cluster list" echo "$response" | head -5 exit 1 fi CLUSTER_DATA=$(echo "$response" | python3 -c " import sys, json data = json.load(sys.stdin) clusters = data if isinstance(data, list) else data.get('clusters', []) running = [c for c in clusters if c.get('state') == 'running'] if not running: print('No running clusters found', file=sys.stderr) sys.exit(1) print(f'Found {len(running)} running cluster(s):') for c in running: cid = c.get('cluster_id', 'N/A') name = c.get('name', 'N/A') region = c.get('region_id', 'N/A') version = c.get('current_version', 'N/A') print(f' {cid} {name} {region} {version}') print('---CLUSTER_IDS---') for c in running: print(f\"{c['cluster_id']}|{c.get('name','N/A')}|{c.get('region_id','N/A')}\") " 2>&1) } ``` ```bash while IFS='|' read -r cluster_id cluster_name cluster_region; do local kubeconfig_file="${KUBE_DIR}/${KUBECONFIG_PREFIX}${c ...[truncated 2997 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/error_classification.md:43

Finding

Certificate Diagnostic Command Exposes the Complete TLS Secret

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check-write-operation.sh:11

Finding

Write-Operation Confirmation Guard Can Be Bypassed

Content

View full analysis

/dev/null) if [ -z "$COMMAND" ]; then echo '{}' exit 0 fi ``` ```bash if echo "$COMMAND" | grep -q "kubectl"; then KUBECTL_WRITE_CMDS="edit patch apply delete create replace scale annotate label taint cordon drain uncordon" IS_WRITE=false for SUBCMD in $KUBECTL_WRITE_CMDS; do if echo "$COMMAND" | grep -qE "kubectl\s+$SUBCMD(\s|$)"; then IS_WRITE=true break fi done if [ "$IS_WRITE" = true ]; then # Confirmation response omitted exit 0 fi echo '{}' exit 0 fi ``` ```bash if echo "$COMMAND" | grep -q "^aliyun "; then ACTION=$(echo "$COMMAND" | awk '{print $3}') WRITE_PREFIXES="Create Delete Remove Modify Update Attach Detach Grant Revoke Start Stop Reboot Release Allocate Associate Disassociate Enable Disable Reset Resize" IS_WRITE=false for PREFIX in $WRITE_PREFIXES; do if echo "$ACTION" | grep -q "^${PREFIX}"; then IS_WRITE=true break fi done if [ "$IS_WRITE" = true ]; then # Confirmation response omitted exit 0 fi echo '{}' exit 0 fi echo '{}' ``` ### Technical Analysis The Skill promises that Kubernetes and Alibaba Cloud write operations require explicit user confirmation, but this hook recognizes only narrow textual command forms. The implementation fails open when JSON parsing fails or when the extracted command is empty. Kubernetes detection requires the write subcommand to immediately follow the literal `kubectl`, so standard global options can bypass it. For example, the following write does not match `kubectl\s+delete`: ```bash kubectl --context production delete ing ...[truncated 1695 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (56)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is diagnosis, but the documented workflow also retrieves cluster kubeconfigs for all ACK clusters and writes them to ~/.kube. That expands the skill from read-only troubleshooting into credential acquisition and persistence, which increases the attack surface and could expose access to multiple clusters if misused or if the local environment is compromised.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is diagnosis, but the documented workflow also retrieves cluster kubeconfigs for all ACK clusters and writes them to ~/.kube. That expands the skill from read-only troubleshooting into credential acquisition and persistence, which increases the attack surface and could expose access to multiple clusters if misused or if the local environment is compromised.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

This step instructs use of cluster_connect.sh to fetch kubeconfig for all ACK clusters when kubeconfig is absent. Pulling credentials for all clusters materially increases privilege exposure and could grant broad access beyond the immediate diagnostic need, especially on shared workstations or agent environments.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

If kubectl is unavailable or cluster unreachable, prompt user to configure environment first.

Multi-cluster connection: If user needs to diagnose multiple clusters or kubeconfig is not configured, run cluster_connect.sh to fetch kubeconfig for all ACK clusters:

bash

bash cluster_connect.sh                # Public network

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Exporting KUBECONFIG to a file under ~/.kube points the session at persisted cluster credentials, which can be sensitive if those files are broadly accessible or retained indefinitely. In this skill's context it is operationally useful, but combined with multi-cluster retrieval it can leave behind durable access artifacts that an attacker or another process could reuse.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

Switch target cluster:

bash

export KUBECONFIG=~/.kube/ack-{cluster_id}.yaml

Step 2: Retrieve Reconcile Error Events

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

After retrieving Warning events, match error messages against `regex` patterns in [diagnostic_tree.json](references/diagnostic_tree.json).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md

After retrieving Warning events, match error messages against `regex` patterns in [diagnostic_tree.json](references/diagnostic_tree.json).

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

- **For RULE_PATH_ILLEGAL**: Must use `pathType: Prefix` (NOT `ImplementationSpecific`) and `alb.ingress.kubernetes.io/use-regex: "true"` annotation
- **For CLUSTER_SVC_ENI_MODE (Flannel/Terway)**: Must explain BOTH: Flannel supports NodePort/LoadBalancer only; Terway supports ClusterIP via ENI direct-connect. Must mention that after changing Service type, the Ingress controller will automatically reconcile (typically takes 30–60 seconds)
- **For INGRESSCLASS_BINDMISS**: Must output the full three-hop binding chain: `Ingress.spec.ingressClassName → IngressClass.metadata.name → IngressClass.spec.parameters.name → AlbConfig.metadata.name`. Must use `controller: ingress.k8s.alibabacloud.com/alb` (with `.com`) and include `spec.parameters` section in any IngressClass YAML
- **For ACTIONS_SVCNAME_MISMATCH / CONDITIONS_SVCNAME_MISMATCH**: Must state this is a silent failure with no Warning events, and root cause is that `actions.{svcname}` key must exactly match `spec.rules[].backend.service.name`

### Step 4: Review Resource Configuration

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md

- **For RULE_PATH_ILLEGAL**: Must use `pathType: Prefix` (NOT `ImplementationSpecific`) and `alb.ingress.kubernetes.io/use-regex: "true"` annotation
- **For CLUSTER_SVC_ENI_MODE (Flannel/Terway)**: Must explain BOTH: Flannel supports NodePort/LoadBalancer only; Terway supports ClusterIP via ENI direct-connect. Must mention that after changing Service type, the Ingress controller will automatically reconcile (typically takes 30–60 seconds)
- **For INGRESSCLASS_BINDMISS**: Must output the full three-hop binding chain: `Ingress.spec.ingressClassName → IngressClass.metadata.name → IngressClass.spec.parameters.name → AlbConfig.metadata.name`. Must use `controller: ingress.k8s.alibabacloud.com/alb` (with `.com`) and include `spec.parameters` section in any IngressClass YAML
- **For ACTIONS_SVCNAME_MISMATCH / CONDITIONS_SVCNAME_MISMATCH**: Must state this is a silent failure with no Warning events, and root cause is that `actions.{svcname}` key must exactly match `spec.rules[].backend.service.name`

### Step 4: Review Resource Configuration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/ram-policies.md (reported line 17)May include surrounding context.

md

`cs:DescribeClusters` — List all ACK clusters under the account
`cs:DescribeClusterDetail` — Get cluster detail information
`cs:DescribeClusterUserKubeconfig` — Get cluster kubeconfig file

## Recommended Custom Policy

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/ram-policies.md (reported line 30)May include surrounding context.

md

`cs:DescribeClusters` — List all ACK clusters under the account
`cs:DescribeClusterDetail` — Get cluster detail information
`cs:DescribeClusterUserKubeconfig` — Get cluster kubeconfig file

## Recommended Custom Policy

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/ram-policies.md (reported line 12)May include surrounding context.

md

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/ram-policies.md (reported line 17)May include surrounding context.

md

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cluster_connect.sh (reported line 5)May include surrounding context.

sh

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cluster_connect.sh (reported line 14)May include surrounding context.

sh

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cluster_connect.sh (reported line 188)May include surrounding context.

sh

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cluster_connect.sh (reported line 191)May include surrounding context.

sh

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cluster_connect.sh (reported line 210)May include surrounding context.

sh

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cluster_connect.sh (reported line 212)May include surrounding context.

sh

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cluster_connect.sh (reported line 239)May include surrounding context.

sh

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cluster_connect.sh (reported line 240)May include surrounding context.

sh

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cluster_connect.sh (reported line 246)May include surrounding context.

sh

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cluster_connect.sh (reported line 248)May include surrounding context.

sh

# ACK Multi-Cluster Connection Verification Script
# Usage: bash cluster_connect.sh [--profile <name>] [--private]
#
# One-click completion: Fetch all clusters → Fetch kubeconfig one by one → Verify connectivity → Output summary

set -euo pipefail

Static analysis

No suspicious patterns detected.