ClawHub
Back to skill

Security audit

Alibabacloud Cfw Acl Diagnosis

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only Alibaba Cloud firewall diagnostic helper, but users should understand it can run live cloud queries using their configured credentials.

Install only if you are comfortable letting the agent use your default Alibaba Cloud credentials for read-only firewall, traffic-log, SLS, and ActionTrail queries. Use least-privilege RAM permissions, avoid broad production credentials where possible, and treat plugin installation or curl/wget validation as user-approved setup/testing steps rather than automatic actions.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
82% confidence
Finding
The skill declares itself as a read-only diagnostic assistant, but it instructs the operator to use local active test tools such as curl/wget. That expands behavior from passive querying into traffic generation, which can create unintended network interactions, validation bypasses, or policy-testing against production targets outside the stated scope.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The file is explicitly framed as a read-only diagnostic reference, but it instructs the agent to run `aliyun plugin install --names aliyun-cli-cloudfw`, which modifies the local environment by installing software. In an agent setting, this expands scope from passive querying to system change, increasing supply-chain and environment-integrity risk and violating the skill's stated non-mutating purpose.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The file mandates real CLI execution for every diagnosis step, which directly conflicts with the skill's declared text-only, read-only guidance model. This mismatch can cause an agent to perform live cloud-environment queries and expose operational metadata or interact with privileged credentials when the user expected only advisory assistance.

Intent-Code Divergence

High
Confidence
95% confidence
Finding
The mandatory instructions override the advertised behavior of the skill and push the agent toward executing actual `aliyun` CLI commands, despite the manifest promising console-manual, no-change guidance. In a cloud security context, even read-only diagnostics can reveal sensitive configuration, traffic, and policy data, so this contradiction materially increases the risk of unauthorized data access and user deception.

Static analysis

No suspicious patterns detected.