Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed read-only Alibaba Cloud network diagnostic that uses existing CLI credentials to inspect one user-confirmed resource and report egress status.
Install only if you are comfortable letting the skill use your configured aliyun CLI account for read-only diagnostic queries. It may display account identity, VPC/vSwitch details, NAT/SNAT status, and public egress IPs, and it writes a small local identity cache without credentials.
A description-behavior mismatch is dangerous because users may authorize a supposedly read-only network diagnostic while the implementation instead performs identity/role inspection and writes local identity metadata. That undermines informed consent, can expose account context unrelated to the requested task, and suggests the skill may be incomplete, misleading, or intentionally masking different behavior.
The skill instructs execution of local Python scripts and CLI commands but does not declare any explicit tool scope or permissions boundaries. That creates a trust gap: an agent/runtime may grant broader shell, file, or environment access than users expect, increasing the chance of unintended local side effects or misuse of ambient credentials.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
**Required inputs**: product, region, instance-id (three items). If the user omits any of them, ask before proceeding; do not run with guessed values.
**Auto-fill first, ask second**: never ask the user for the UID when it can be derived via `sts_token.py`. Whenever any parameter is auto-filled (e.g. UID), the Agent MUST explicitly declare it in the response, e.g. "UID auto-derived via sts:GetCallerIdentity: 1772241626973633". This declaration is mandatory and must appear in the final output.
## Covered Products
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Read-only actions do not support resource-level restriction on these products, so `Resource: "*"` is scoped by the action list only — no action wildcards are used.
- If a query is rejected with HTTP `403` and an authorization error code (for example `NoPermission`), attach the missing action above; the script records such errors as `[WARN]` degradation traces and points to this file.
- This skill contains **no write or delete operations**; any non-read-only API call observed in traces should be reported as an anomaly.
## Credential Handling Rules
The helper explicitly states it 'Keeps all output English-only' and removes non-ASCII characters from upstream messages. This imposes a language policy in code without offering the user a locale choice or documenting a justified region-specific constraint.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
try:
# stdin=DEVNULL: never hang on interactive CLI prompts (e.g. plugin
# auto-install questions); fail fast with a timeout/error instead.
proc = subprocess.run(
cmd, capture_output=True, text=True,
timeout=CLI_TIMEOUT_SECONDS, stdin=subprocess.DEVNULL,
)
The module is dedicated to verifying the current aliyun CLI caller identity, deriving AccountId, detecting whether a diagnosis role is already assumed, and caching those identity facts. The manifest describes a read-only network egress diagnostic flow for cloud-native products, but does not mention auditing caller identity, role-session state, or local credential-context inspection as part of the user-facing purpose.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Detect whether the caller already holds a session of the target diagnosis
role (evaluation sandboxes pre-inject such a session); in that case no
further role-related action is needed — the CLI session is already usable.
- Cache the public identity facts in scripts/.sts_cache.json (chmod 0600)
Usage:
python3 sts_token.py
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
try:
# stdin=DEVNULL: never hang on interactive CLI prompts (e.g. plugin
# auto-install questions); fail fast with a timeout/error instead.
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=60,
stdin=subprocess.DEVNULL)
except subprocess.TimeoutExpired:
print("Error: get-caller-identity timed out after 60s. Retry or check network.", file=sys.stderr)