alibabacloud-cdn-refresh-preload

• Outcome: Review
• Latest audit: Aug 17, 2026 · 3:00 AM UTC
• Version: 0.0.1

Overview

The skill is mostly a disclosed read-only CDN diagnostic tool, but it can automatically enumerate CDN task records across all visible domains when the user gives incomplete input.

Install only in an environment where the current aliyun CLI credentials are allowed to read CDN refresh/preload task history. Prefer providing an explicit URL or domain, avoid the no-parameter mode in shared or highly privileged accounts, and treat printed task URLs, AccountId, Arn, and probe output as sensitive operational data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill invokes shell commands, reads local configuration, uses network access, and relies on environment/default credential chains, yet it declares no explicit permissions or capability boundaries. This is dangerous because reviewers and policy engines may treat it as lower risk than it is, while the skill can still access cloud identity context, local files such as CLI config, and perform outbound probes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill is presented as a narrowly scoped read-only CDN diagnostic tool, but the documented behavior includes arbitrary command execution through a probe wrapper, identity discovery via STS, and task enumeration/auto-extraction when the user provides incomplete input. That mismatch is dangerous because it expands data access and execution scope beyond user expectations, enabling unintended reconnaissance, disclosure of account identity metadata, and broader local/network actions under the guise of a limited diagnostic skill.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The skill advertises targeted diagnostics for a specific refresh/preload issue, but the CLI permits running with no `--url` and no `--domain`, causing enumeration of recent CDN refresh/preload tasks across all domains accessible to the current credentials. In a privileged environment this broadens data access beyond user intent and can expose operational metadata and URLs unrelated to the incident being investigated.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: When no URL is provided, the code fetches task records and auto-selects the most recent URL from all visible tasks, including cross-domain scope when no domain is supplied. That behavior can leak sensitive CDN object paths and operational history and may trigger follow-on probing of assets outside the user's requested target.

Missing User Warnings

Low

• Confidence: 74% confidence
• Finding: The script prints AccountId and Arn directly to stdout/stderr, which can expose cloud account identifiers in terminal logs, CI logs, chat transcripts, or other shared observability sinks. While these values are not secrets by themselves, they are sensitive metadata that can aid reconnaissance and should be disclosed intentionally.

Unvalidated Output Injection

High

• Category: Output Handling

Content

def local_exec(argv, timeout=60):
    """Execute a validated argv list locally (argv list, never a shell)."""
    try:
        result = subprocess.run(
            argv, shell=False, capture_output=True, text=True, timeout=timeout,
        )
        return {

• Confidence: 84% confidence
• Finding: Although command injection is well mitigated, the script captures and prints raw stdout/stderr from attacker-influenced network tools. A remote server or DNS response can emit ANSI escape sequences or other terminal control content, which may lead to terminal output injection, log poisoning, or operator deception when results are viewed in a terminal or copied into downstream systems.

Unvalidated Output Injection

High

• Category: Output Handling

Content

self._log(f'  Command: {curl_command}')

        try:
            proc = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
        except subprocess.TimeoutExpired:
            return {'ok': False, 'curl_command': curl_command, 'resolve': resolve_used,
                    'error': 'curl request timeout (>15s)'}

• Confidence: 91% confidence
• Finding: The tool logs and reports a reconstructed curl command and prints response-derived fields such as headers, URLs, and task paths without terminal escaping. An attacker controlling the URL, `--resolve` value, or an HTTP response header could inject ANSI escape sequences or other control characters into terminal output or logs, enabling log spoofing, misleading diagnostics, or terminal manipulation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

chaining, substitution) are never available to the input.
  2. Raw-input pre-check: any input containing shell metacharacters
     (; | & $ ` > < newline) is rejected before parsing.
  3. Binary whitelist: only curl / dig / openssl may be executed; every
     other binary is refused with a clear error and a fix hint.
  4. curl is restricted to read-only GET/HEAD requests: body/upload/output
     flags (-d/--data*, -F/--form*, -T/--upload-file, -o/--output, -O, -J,

• Confidence: 78% confidence
• Finding: The skill intentionally executes user-supplied network diagnostic commands, and even with strong restrictions this creates a parameter-abuse surface because curl, dig, and openssl can still be used to reach arbitrary hosts. In the skill context this is less dangerous than arbitrary command execution, but it still enables SSRF-style probing, internal network scanning, or access to sensitive metadata services if an untrusted user can supply targets.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Shell metacharacters that must never appear in a probe command.
FORBIDDEN_CHARS = set(";|&$`><\n\r")

# curl flags that perform writes (request body, upload, local file output)
# or can smuggle arbitrary options (-K reads a config file).
CURL_WRITE_FLAGS = {
    "-d", "--data", "--data-raw", "--data-binary", "--data-urlencode",

• Confidence: 81% confidence
• Finding: The same policy surface around allowed curl parameters presents a real abuse risk despite the read-only intent: requests remain attacker-directed and can interact with arbitrary infrastructure. Because this skill is specifically for CDN diagnostics, broad outbound flexibility is somewhat expected, but without network boundary checks it can still be repurposed for reconnaissance or access to internal HTTP services.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Shell metacharacters that must never appear in a probe command.
FORBIDDEN_CHARS = set(";|&$`><\n\r")

# curl flags that perform writes (request body, upload, local file output)
# or can smuggle arbitrary options (-K reads a config file).
CURL_WRITE_FLAGS = {
    "-d", "--data", "--data-raw", "--data-binary", "--data-urlencode",

• Confidence: 81% confidence
• Finding: The same policy surface around allowed curl parameters presents a real abuse risk despite the read-only intent: requests remain attacker-directed and can interact with arbitrary infrastructure. Because this skill is specifically for CDN diagnostics, broad outbound flexibility is somewhat expected, but without network boundary checks it can still be repurposed for reconnaissance or access to internal HTTP services.

Static analysis

No suspicious patterns detected.