alibabacloud-cas-ssl-cert-deploy

• Outcome: Review
• Latest audit: Jul 31, 2026 · 3:59 AM UTC
• Version: 0.0.1

Overview

The skill is aimed at certificate deployment, but it also grants and documents broad cloud-provisioning and credential-handling authority that needs careful review before use.

Install only if you intentionally want an agent to manage Alibaba Cloud certificate deployment and possibly create or alter related CDN/WAF/OSS/ALB resources. Use a dedicated low-privilege RAM role, avoid entering AccessKey or private-key material in chat or command arguments, require explicit confirmation before any resource creation, rollback, deletion, or listener/routing change, and review the ALB and OSS helper flows before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill includes CLI installation, upgrade, and plugin update instructions that expand its authority beyond certificate deployment into software lifecycle management. This increases supply-chain and environment-modification risk because a deployment request could lead to downloading and executing setup scripts or changing the local toolchain state.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The workflow explicitly allows creating new cloud resources when no matching resource exists, which materially broadens the skill from certificate deployment into infrastructure provisioning. That can incur cost, expose services, or create internet-facing resources under the guise of a certificate operation, especially because the skill loops and strongly pressures staying in this path.

Description-Behavior Mismatch

Low

• Confidence: 89% confidence
• Finding: The cleanup phase mutates state by deleting deployment jobs and exporting/unsetting environment variables, but these actions are not clearly reflected in the manifest description. Hidden or under-disclosed side effects reduce user visibility and can destroy audit artifacts or alter downstream shell behavior unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This reference goes beyond certificate deployment and includes ALB infrastructure provisioning and backend configuration operations such as creating listeners, server groups, adding backend servers, and routing rules. In an agent skill whose stated purpose is certificate deployment, these extra capabilities expand the action surface and could let the agent make unintended production traffic changes, increasing risk of misconfiguration or service disruption.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file includes commands to create CDN and WAF domain resources, not merely deploy certificates to existing resources. Resource onboarding can alter public exposure, DNS/application flow, and security posture; bundling it into a certificate deployment skill increases the chance that a user request to 'deploy a cert' results in broader infrastructure changes than intended.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The guide goes well beyond the stated certificate-deployment scope and teaches broad Alibaba Cloud CLI administration, credential configuration, profile switching, role assumption, and plugin installation. In an agent skill context, this expands the operational blast radius: an agent or user following the document may provision broad cloud access and install extra product plugins unrelated to certificate deployment, increasing the chance of misuse or overprivileged execution.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The ALB section explicitly warns that `update-listener-attribute` must not be used for certificate deployment, but the flow immediately instructs 'Has HTTPS listener → Update certificate (update-listener-attribute)'. In an agent skill, contradictory instructions are dangerous because the model may follow the operational flow rather than the warning, causing it to bypass the intended CAS DeploymentJob path and directly mutate production ALB listener configuration.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: This helper file is part of a certificate deployment skill, yet it embeds multiple resource-creation workflows for ALB, CDN, WAF, and OSS. In an agentic context, mixing infrastructure provisioning with certificate deployment broadens the action surface and can lead the agent to create or alter cloud resources the user did not intend, increasing risk of configuration drift, billing impact, and deployment to the wrong targets.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The skill instructs the agent to treat vague certificate-related input as deployment intent by default and to avoid routing to other skills before clarification. This creates unsafe over-triggering: ambiguous requests like asking to 'handle a certificate' may enter a workflow that can inspect resources, create infrastructure, or initiate deployment-related actions under the wrong intent.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger section includes an open-ended activation condition for 'any scenario requiring deployment' which is too broad for reliable intent matching. Over-broad triggers can cause the wrong skill to activate and expose high-impact deployment or provisioning behavior in response to loosely related requests.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The deployment job creation and status update commands are state-changing production operations, yet the reference does not instruct the agent to obtain explicit confirmation before execution or warn that scheduling will push certificates live. In an autonomous or semi-autonomous agent context, omission of approval guidance can cause accidental certificate rollout to the wrong resources or environments.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Rollback and delete commands directly modify deployment state and may remove auditability or revert live certificate changes, but the reference provides them without strong caution or confirmation requirements. In an agent workflow, this can lead to accidental rollback of valid deployments or deletion of jobs that operators still need for troubleshooting and traceability.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The OSS command accepts raw certificate PEM and private key material on the command line without any warning about sensitive secret handling. Passing private keys via CLI arguments can expose them through shell history, process listings, logs, agent traces, or telemetry, creating a direct credential-compromise risk that could enable TLS impersonation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The first credential setup examples immediately instruct users to pass long-lived AccessKey secrets on the command line without a prominent preceding warning that these values may be persisted in shell history and stored locally in configuration. In an agent-driven or automated environment, this creates a realistic risk of credential leakage through logs, transcripts, process inspection, or filesystem compromise.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document recommends broad system policies such as full-access roles for CAS, CDN, WAF, OSS, and ALB without prominent least-privilege guidance or warnings about the infrastructure impact of those permissions. In the context of a certificate deployment skill, these permissions can modify listeners, domains, CNAME bindings, and deployment jobs across user cloud resources, increasing the blast radius if the skill is misused, misconfigured, or compromised.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.