Alibabacloud Cadt Deploy On Aliyun

• Outcome: Review
• Latest audit: Jul 20, 2026 · 1:38 PM UTC
• Version: 0.0.1

Overview

This skill is mostly a disclosed Alibaba Cloud ECS deployment tool, but it needs Review because it combines broad cloud execution authority with unsafe/under-scoped implementation details.

Install only if you are comfortable giving this skill Alibaba Cloud deployment authority. Use a least-privilege RAM role, provide explicit region and instance IDs, review generated start/stop scripts and artifacts before confirming deployment, avoid sending sensitive files through EcsSendFile until the shell-escaping issue is fixed, and verify the missing ops/step files are supplied before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill clearly instructs use of shell commands, environment variables, and reading/writing local files, but it declares no permissions or capability boundaries. In a deployment skill, this creates hidden execution and filesystem access expectations that can bypass user understanding, weaken policy enforcement, and increase the blast radius if the skill is triggered unexpectedly or modified maliciously.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code builds a shell script using untrusted fields such as targetDir, name, fileMode, fileOwner, and fileGroup and interpolates them directly into bash commands. Because these values are inserted into double-quoted shell strings without robust shell escaping, an attacker who can control arguments can inject command substitutions or break quoting, leading to arbitrary command execution across all targeted ECS instances.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The runner supports hidden routing to `oss` and default `qoder` service types even though the skill is described as an ECS deployment capability. That creates a scope-expansion/backdoor-style risk: callers or hooked operations may reach cloud actions outside the expected trust boundary, increasing the chance of unintended data access, file staging, or execution paths that users and reviewers would not anticipate.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The presence of `EcsSendFile` and `OssGeneratePresignedUrl` introduces file-transfer and URL-generation capabilities that are broader than a narrow build/deploy runner. In an agent context, these features can be abused for data movement or exfiltration—especially when combined with hooks and remote command execution—making the mismatch between declared purpose and actual capability security-relevant.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger list includes broad terms like build, deploy, diagnose, troubleshoot, root cause, 502, and 503, which are common in normal conversations and could activate the skill outside the user's intended context. Because this skill performs packaging, script injection, and cloud deployment actions, overbroad activation increases the chance of accidental execution of sensitive workflows.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly instructs the agent to run local build commands, inject and execute start/stop scripts, retrieve cloud credentials, upload artifacts, and trigger deployment, but it does not present a clear warning or require explicit user confirmation for these impactful operations. In an LLM-operated skill, that omission is dangerous because a user may invoke a seemingly routine build/deploy flow without understanding that it can execute arbitrary local commands and perform irreversible remote actions in their Alibaba Cloud environment.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document explicitly grants and describes `ecs:RunCommand` and `ecs:SendFile`, which enable arbitrary command execution and file transfer on ECS instances. In a deployment skill, these capabilities may be operationally useful, but documenting them without a prominent user-facing warning, tighter scope, or strong execution guardrails increases the risk of unexpected remote access and misuse if the skill is invoked in troubleshooting or failure-recovery paths.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The code silently parses a session identifier out of a --user-agent value and stores it in SKILL_SESSION_ID, creating an implicit trust boundary from user-supplied CLI input into process environment state. Because environment variables are commonly consumed by downstream code for logging, correlation, authorization context, or request metadata, an attacker may spoof or poison session attribution, and users are not clearly informed that this side effect occurs.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The hook silently uploads user-provided file content to OSS when the payload exceeds a size limit, which can exfiltrate sensitive data outside the expected direct-send path. In a deployment skill, external staging may be operationally reasonable, but doing so without explicit notice, consent, retention controls, or clear trust boundaries creates confidentiality and compliance risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.generated_source_template_injection

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/cli/lib/hooks.py:46

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/cli/tests/test_smoke.py:314

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: references/build-pipeline/build-commands.md:29