Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a read-only Alibaba Cloud diagnostic helper, but it needs review because its command gate can misclassify unsafe local commands and its workflow requires an unpinned CLI plugin update.
Install only after reviewing the command hook and setup workflow. Use a minimally privileged read-only Alibaba Cloud profile, avoid approving unpinned plugin updates unless you trust the update source, and require explicit firewall or CEN targeting before running closure prechecks.
scripts/check-write-operation.sh:51Bash Authorization Hook Allows Arbitrary or Destructive Commands Through Unsafe Allowlist Matching
SKILL.md:81Mandatory Unpinned CLI Plugin Update Introduces Executable Supply-Chain Risk
scripts/closure_precheck.py:40Closure Pre-Check Enumerates Regional Firewalls and Selects the First Result Without Resource Validation
Referenced artifact was not completely inspected
1. Read this complete `SKILL.md`.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Use OpenAPI read-only queries for current state.
- Treat `ErrorDetail` and recent ActionTrail evidence as stronger than precheck-only results.
## Output Rules
- Put the conclusion first.
- Keep evidence concise.
The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The skill is presented as a read-only diagnostic assistant, but it mandates local CLI state changes (ai-mode enable/disable) and a plugin update. These operations modify the operator's environment and can introduce supply-chain or session-scope risk that is outside the declared diagnostic purpose, especially because plugin updates fetch and install new code locally.
These standards authorize execution of local/system commands that are not themselves read-only cloud API queries, including plugin management and CLI configuration changes. Even if not directly destructive, this expands the skill's operational scope from diagnosis into host-environment modification, increasing the chance of unintended side effects or abuse if the workflow is followed blindly.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
print(f"Error: run_cli only accepts a list[str], got {type(argv).__name__}")
sys.exit(1)
try:
result = subprocess.run(argv, shell=False, capture_output=True, text=True, timeout=30)
if result.returncode != 0:
print(f"Error: command failed: {result.stderr}")
sys.exit(1)
The manifest frames the skill as using read-only Alibaba Cloud APIs for diagnosis, but the standards mandate running scripts/analyze_routes.py for route comparison. Executing a local script is an additional capability beyond direct API-based diagnosis and is not explicitly disclosed in the stated purpose.
Line L32 states that the default language should be en for portable diagnostic output, which is a natural-language locale recommendation. Under the policy, forcing or prescribing a specific language without user opt-in can be a locale-policy issue, and the guide does not explicitly offer alternatives or frame this as optional user choice.