T08 · Insecure Dependencies
Warning
- Location
SKILL.md:23- Finding
Third-Party Packages Installed Without Integrity or Source Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Alibabacloud Cadt Probe
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Alibaba Cloud inventory tool, but its permissions and outputs can expose sensitive infrastructure details.
Install only if you intend to inventory an Alibaba Cloud account. Use a dedicated RAM role with the documented read-oriented permissions, limit regions and resource types where practical, avoid --debug and --keep-attributes unless needed, and write output only to private trusted directories because the JSON may reveal infrastructure topology and security relationships.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/probe.py:1461- Finding
Sensitive Cloud Inventory Written Through Symlinks and Potentially Permissive File Modes
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill can access environment-based credentials and write probe output files, but the manifest does not declare an explicit tool scope such as allowed-tools or permissions. In a skill that inventories cloud resources, undeclared access increases the chance of unintended credential use and uncontrolled persistence of sensitive cloud inventory data, reducing enforceability of least privilege.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger word "probe" is overly broad and may cause the skill to activate for unrelated user requests. Because this skill performs sensitive cloud inventory discovery, accidental invocation could expose account topology and resource metadata in contexts where the user did not intend a cloud reconnaissance action.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill description explains how to enumerate and export cloud resources but does not prominently warn that outputs may contain sensitive infrastructure inventory, identifiers, relationships, and network details. In a cloud discovery skill, omission of this warning increases the likelihood that sensitive results are displayed, stored, or shared without adequate user awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation enumerates a large set of read and relationship-discovery permissions across many Alibaba Cloud services, including security-group configuration, load balancer listeners, resource sharing, and network topology metadata, but it does not clearly warn that using the skill can expose broad account inventory and sensitive architectural details. In practice, this can lead users to grant sweeping access without understanding that the skill can map significant portions of their environment, increasing the risk of unnecessary data exposure and over-privileged deployment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The --debug option causes full API response bodies from probe operations to be printed to stderr, and those responses can contain discovered cloud resource inventory, metadata, and potentially sensitive configuration details. In an agent or automation context, stderr is often captured into logs or surfaced to other systems, so enabling debug can unintentionally exfiltrate sensitive account topology and resource information beyond the intended consumer.
- Content
Excessive Permissions
Low
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
- Content
md For the complete permission list including a least-privilege RAM policy JSON, see [references/ram-policies.md](references/ram-policies.md). **Key permissions:** | Service | Action | Purpose | |---------|--------|---------|
Static analysis
No suspicious patterns detected.