Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Security audit
alibabacloud-analyticdb-mysql-serverless-analysis
Security checks for vulnerabilities and agentic risk
Overview
This skill appears benign: it performs disclosed, bounded read-only Alibaba Cloud ADB queries against user-specified OSS data using a runtime token.
Install only if you want the agent to run read-only ADB Serverless queries against specific OSS data. Verify the endpoint or region, workspaceId, OSS scope, and planned SQL before live use, and remember that even read-only cloud scans can expose sensitive data or incur query costs.
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code presents its description, validation errors, help text, and runtime error output in Chinese, while also including some English text in comments/docstrings. There is no visible user opt-in or documented justification that the skill is intended only for Chinese-speaking users, so it may violate language/locale policy expectations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 18% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Terminal means no retry, timeout increase, endpoint/workspace replacement, parent or sibling prefix probe, registered/direct-source switch, or alternative table function. Report the redacted failure and the exact scope that could not be accessed. ## Raw curl Form Use this only when the Python client cannot run. Select an explicit user-supplied token before the environment fallback, then expose the selected value to `curl` only through a child-process environment variable:
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.
- Content
python print(json.dumps(result, ensure_ascii=False, indent=2)) return 0 except (ValidationError, QueryError, OSError) as exc: secret = selected_token or access_token or os.environ.get(TOKEN_ENV) print(f"错误：{_redact(str(exc), secret)}", file=sys.stderr) return 2
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md After validation, keep the confirmed endpoint or regionCode, workspaceId, and OSS URI as an immutable parameter ledger for the current request. Copy those exact literals into every command; do not retype, normalize, abbreviate, or reconstruct them from memory. Before every invocation, compare the command arguments and SQL scope with the ledger character-for-character. Treat any mismatch as a local command-construction error: do not send a live request, rebuild the command from the confirmed literals, and run dry-run again. When a later user message supplies the table-prefix that was missing from a bucket-root request, combine that prefix with the previously confirmed bucket, revalidate the complete current parameter set, and continue from source selection without asking again for values that remain explicit and valid. When a later message explicitly confirms an exact large-scan SQL plan, use this rigid sequence: dry-run `SHOW SCHEMAS`; live `SHOW SCHEMAS`; `SHOW TABLES`; successful `DESCRIBE`; then the exact confirmed SQL. Do not prepend, interleave, or append a direct-file query, sample, alternate aggregate, or artifact action. Execute only that confirmed SQL after the required metadata checks; do not repeat the confirmation question or broaden the plan. Resolve `scripts/adb_query.py` from the absolute base directory printed when this skill loads; do not guess a task-working-directory-relative path. When no explicit `accessToken` was supplied, check environment-token presence only with a command that cannot print its value:
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | `ossUri` | Required | Must start with `oss://`, include a bucket, and identify a clear scan scope. | | `analysisGoal` | Required | Must identify the question, metric, dimension, filter, or time range to analyze. | If any input is missing, report every missing item in one response and stop before network access. If neither credential source is available, tell the user to configure `ADB_ACCESS_TOKEN` outside the conversation. Never ask the user to paste a token into chat, but accept one they voluntarily supplied and use it only for the current request. When the user corrects a parameter, the most recent explicit correction replaces the earlier value for the current request. Revalidate the complete parameter set and use only the corrected endpoint or regionCode, workspaceId, OSS URI, and goal in dry-run and live requests. Never send a request with a superseded value merely to prove that it is wrong.
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 22% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md | 400 with `Cannot detect OSS file format`, `no supported files`, `No files found`, `NoSuchBucket`, or `NoSuchKey` | Stop for the current OSS scope. Do not alter the path, try globs or subdirectories, or switch readers. | | 401/403, `InvalidAccessToken`, or `AccessDenied` | Stop. Ask the user to verify the token, workspace authorization, and OSS read permissions outside the conversation. Do not retry or switch sources. | | 404, workspace not found, bucket not found, or prefix not found | Stop for the confirmed endpoint, workspace, and OSS scope. Do not guess another region or path. | | 429 | Preserve requestId and wait or reduce concurrency. Do not retry indefinitely. | | 5xx | Preserve the redacted error and requestId, then stop. Only the specific `DESCRIBE files(...)` unsupported-shape messages documented in the Skill permit one same-prefix bounded fallback. | | SQL syntax error | Correct the statement as Presto SQL, then run dry-run again. | | Timeout or oversized result | Narrow the OSS path, partitions, time range, projection, and LIMIT. |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 22% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Trigger coverage reuses a functional scenario; the directory contains no separate trigger-only or without-skill scenarios. - The fallback, independent cross-check, missing-schema, corrected-parameter, and empty-result branches are represented by functional scenarios. - Follow-up handling is covered when the user supplies a previously missing table-prefix and when the user later confirms an exact large-scan plan. - Large-scan confirmation scenarios use top-level automated `hitl` answers plus a referenced `expectations[].type: "hitl"` assertion, so they cover the confirmation action without waiting for a human. The explicit follow-up confirmation scenario executes without asking again. - Generic evaluator requests for `outputs/`, `ran_scripts/`, or action logs do not override the terminal no-more-tools rule. ## Dry Run
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Treat the following responses as terminal for the current endpoint, workspace, and OSS scope: - HTTP 401 or 403, `InvalidAccessToken`, `Invalid access token`, `AccessDenied`, or an equivalent authorization failure; - HTTP 404, `NoSuchBucket`, `NoSuchKey`, workspace not found, bucket not found, prefix not found, or an equivalent confirmed resource-not-found failure; - Any HTTP 5xx response, including an ALB HTML `503 Service Temporarily Unavailable` response; - `Cannot detect OSS file format`, `no supported files`, or `No files found for schema inference` from an OSS table function.
Static analysis
No suspicious patterns detected.