Security audit
Security checks for vulnerabilities and agentic risk
This diagnostic skill needs review because its advertised read-only safeguards allow unintended file access, file writes, and potentially leaking local data.
Prefer a corrected version before using production credentials or running alongside sensitive files. Any evaluation should use an isolated environment without unrelated secrets and narrowly scoped CDN credentials. The skill uses the currently configured CLI account; supplying a UID does not switch accounts. Fixes should safely handle response headers, restrict probe options and destinations, and verify HTTPS by default.
scripts/cdn_probe.pyUntrusted response headers can inject curl arguments and disclose local files
Disclosure of readable, header-compatible local files, potentially including credential-bearing configuration lines, to the attacker's endpoint.
The advertised read-only probe boundary is undermined by options that access local files or write output, including curl header-file loading and write-out output redirection. An attacker who influences a probe command could expose local data or modify files with the agent's privileges; routing every probe through this wrapper increases reliance on its incomplete validation.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
chaining, substitution) are never available to the input.
2. Raw-input pre-check: any input containing shell metacharacters
(; | & $ ` > < newline) is rejected before parsing.
3. Binary whitelist: only curl / dig / openssl may be executed; every
other binary is refused with a clear error and a fix hint.
4. curl is restricted to read-only GET/HEAD requests: body/upload/output
flags (-d/--data*, -F/--form*, -T/--upload-file, -o/--output, -O, -J,
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Shell metacharacters that must never appear in a probe command.
FORBIDDEN_CHARS = set(";|&$`><\n\r")
# curl flags that perform writes (request body, upload, local file output)
# or can smuggle arbitrary options (-K reads a config file).
CURL_WRITE_FLAGS = {
"-d", "--data", "--data-raw", "--data-binary", "--data-urlencode",
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Shell metacharacters that must never appear in a probe command.
FORBIDDEN_CHARS = set(";|&$`><\n\r")
# curl flags that perform writes (request body, upload, local file output)
# or can smuggle arbitrary options (-K reads a config file).
CURL_WRITE_FLAGS = {
"-d", "--data", "--data-raw", "--data-binary", "--data-urlencode",
The validator accepts arbitrary -w/--write-out values, including %output{filename} on supporting curl versions. This permits file creation or overwrite with attacker-influenced formatting output despite the stated prohibition on local writes.
The --url=value branch checks the option name but never validates the value's scheme, unlike the separate --url value branch. Consequently, curl can read file:/// paths and return their contents through captured stdout, exposing files accessible to the agent.
The OpenSSL validator blocks only a small set of write flags and therefore accepts s_client -keylogfile with an arbitrary writable path. This breaks the read-only boundary by creating or appending to local files and can persist TLS session secrets.
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
no direct HTTP signing). No external Python SDK dependencies.
2. **Alibaba Cloud credentials** — Credentials are resolved automatically by the aliyun CLI default credential chain (environment or ~/.aliyun/config.json). Do not read, print, or pass AK/SK/STS tokens explicitly.
3. **Target inputs**: URL (the resource to diagnose) and UID (the Alibaba Cloud account UID). UID can be omitted — it defaults to the caller account derived via `aliyun sts get-caller-identity`. Auto-fill first, ask second: never ask the user for UID or role name when they can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (UID, domain, URL, or role name), the Agent MUST explicitly declare this in the response or report metadata. For example: "UID auto-derived via sts:GetCallerIdentity: 1772241626973633" or "Domain auto-discovered via DescribeUserDomains: tofirae.com" or "URL auto-extracted from refresh task records: https://tofirae.com/1.png". This declaration is manda
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
cd $SKILL_DIR && python3 scripts/sts_token.py --json
The probe examples disable certificate verification with curl -k, and the instructions also recommend an HTTP fallback without explaining the loss of authentication and confidentiality. A network attacker could forge cache headers and diagnosis evidence, while plaintext requests may expose sensitive URL paths or query parameters.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def local_exec(argv, timeout=60):
"""Execute a validated argv list locally (argv list, never a shell)."""
try:
result = subprocess.run(
argv, shell=False, capture_output=True, text=True, timeout=timeout,
)
return {
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
result: Optional[Dict[str, Any]] = None
for attempt in (1, 2):
try:
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
except subprocess.TimeoutExpired:
raise RuntimeError('CliError: aliyun CLI request timed out after 30s')
except FileNotFoundError:
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
result: Optional[Dict[str, Any]] = None
for attempt in (1, 2):
try:
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
except subprocess.TimeoutExpired:
raise RuntimeError('CliError: aliyun CLI request timed out after 30s')
except FileNotFoundError:
Although the argument-list subprocess prevents shell injection, curl receives a URL without an HTTP/HTTPS scheme restriction and bypasses the designated probe validator. Because task matching ignores scheme and port, a completed matching directory task can authorize probing a different protocol or port, potentially enabling unintended service interactions or internal-network requests through --resolve.
self._log(f' Command: {curl_command}')
try:
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
except subprocess.TimeoutExpired:
return {'ok': False, 'curl_command': curl_command, 'resolve': resolve_used,
'error': 'curl request timeout (>15s)'}
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
try:
# stdin=DEVNULL: never hang on interactive CLI prompts (e.g. plugin
# auto-install questions); fail fast with a timeout/error instead.
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=60,
stdin=subprocess.DEVNULL)
except subprocess.TimeoutExpired:
print("Error: get-caller-identity timed out after 60s. Retry or check network.", file=sys.stderr)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
try:
# stdin=DEVNULL: never hang on interactive CLI prompts (e.g. plugin
# auto-install questions); fail fast with a timeout/error instead.
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=60,
stdin=subprocess.DEVNULL)
except subprocess.TimeoutExpired:
print("Error: get-caller-identity timed out after 60s. Retry or check network.", file=sys.stderr)
The module documentation at L008-L010 says authentication is handled exclusively by the CLI and the script never reads secrets. However, L087-L090 opens and fully deserializes ~/.aliyun/config.json, which can contain stored access keys and security tokens, bringing those secrets into the Python process even though only the region is needed.