Security audit

Alibabacloud Cleversee Search

Security checks for vulnerabilities and agentic risk

Overview

This search skill is not malicious, but it asks agents to install a global CLI and may handle cloud credentials in an unsafe, under-scoped way.

Install only if you intentionally want Alibaba Cloud CleverSee handling your searches. Prefer an isolated environment, verify the npm package provenance yourself, avoid entering access-key secrets on the command line, use the narrow EngineSearch permission only, and rotate any credential previously used with the documented command-line secret pattern.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:21
Finding: Unverified Global Installation of a Third-Party npm CLI
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:139
Finding: Cloud Access-Key Secret Passed Through Command-Line Arguments
Content: View full analysis
\ --access-key-secret \ --arn ``` The same insecure command pattern is also documented in the authentication table at `SKILL.md`, line 59, and endorsed for automated contexts in `references/acceptance-criteria.md`, line 76. ### Technical Analysis The command passes an Alibaba Cloud access-key secret as a command-line argument. Depending on the operating system, shell, and automation environment, command arguments may be exposed through: - Shell history. - Process listings and process-monitoring interfaces. - Terminal session recording. - CI/CD job logs. - Agent tool-call transcripts. - Audit and observability systems. - Error reports that preserve the executed command. This pattern also conflicts with the security rule at `SKILL.md`, lines 32-34, which prohibits reading, printing, or asking for AK/SK values through the conversation or command line. Even if the placeholder is replaced only at execution time, the secret still becomes part of the process argument vector. ### Attack Path 1. A user or automation system replaces `` with a real Alibaba Cloud access-key secret. 2. The shell launches `cleversee` with the secret included in its argument vector. 3. The command or its arguments are retained in shell history, process telemetry, terminal logs, CI/CD output, or an agent transcript. 4. A local user, administrator, log reader, monitoring operator, or attacker with access to those records obtains the secret. 5. The attacker combines the secret with the associated access-key ID and role information. 6. The attacker authenticates to Alibaba Cloud and invokes APIs allowed by the compromised identity until the credential is r ...[truncated 730 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list contains broad phrases such as 'web search', '查资料', and '实时信息', which are likely to match many ordinary user requests and cause the skill to activate in situations beyond its intended scope. Overbroad activation increases the likelihood that users are funneled into this skill's credential and profile-management behaviors unnecessarily, amplifying the risk introduced by the auth-related instructions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill documentation includes credential configuration and profile management flows that go beyond a narrowly scoped web-search capability. Expanding the skill into authentication handling increases the chance an agent will solicit, process, or modify sensitive credentials in contexts where only read-only search behavior was expected, widening the attack surface and enabling unintended account access changes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Documenting and exemplifying cleversee auth set --mode RamRoleArn --access-key-id <id> --access-key-secret <secret> --arn <arn> introduces a non-search capability that can cause the agent to request or handle long-lived cloud credentials despite the skill's stated purpose being web search. This is dangerous because command-line secret entry can expose credentials through shell history, logs, agent transcripts, or misuse by an over-permissive automation flow.
Content: No source excerpt is available for this finding.