Alibabacloud Compute Provision

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 0.0.1-beta.1

Overview

This skill appears intended for Alibaba Cloud compute automation, but it gives an agent broad, costly cloud-administration and remote-code-execution authority with several under-scoped defaults.

Install only if you intentionally want an agent to manage real Alibaba Cloud resources and run scripts remotely. Use a least-privilege RAM role in a test account first, require explicit confirmation for regions, public network exposure, workspace creation, and deletion, avoid untrusted or secret-containing scripts, and review logs before sharing transcripts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill directs the agent to execute Python that can read environment-derived credentials, access files, make network requests, and run shell-like actions through cloud APIs, yet it declares no permissions or guardrails. That mismatch is dangerous because users and the hosting platform are not given an accurate capability boundary for a skill that can create billable infrastructure and execute arbitrary scripts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documented behavior materially exceeds the advertised purpose: beyond selecting compute and running jobs, it can manage networking, security groups, workspaces, and perform broader cloud queries. This increases the attack surface and can lead to unexpected resource creation, exposure of services via firewall changes, or privilege creep under the guise of a narrower compute-provisioning skill.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The job runner unconditionally deletes any existing Kubernetes Job with the same name before creating a new one. In a multi-tenant or reused cluster, this can destroy another workload's state or interrupt an unrelated task, especially because default job names are generic and cluster reuse is explicitly supported elsewhere in the skill.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The module will automatically create a new PAI workspace whenever none exists, which expands its effective privileges and mutates cloud state beyond the core expectation of submitting jobs. In a skill that already provisions and executes compute workloads, silent creation of a persistent workspace increases surprise, cost/governance risk, and could bypass an operator's intended approval boundaries.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger language is extremely broad, covering common intents like running scripts, deploying services, training models, budgets, and generic hardware terms. That makes accidental invocation more likely, which is risky here because the skill can progress from vague user language to cloud provisioning and script execution with real cost and infrastructure impact.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The region-selection rules automatically force overseas regions for workloads with external dependencies, without requiring explicit user approval. This can create compliance, data residency, and governance issues, especially if code, models, or data are deployed outside an expected jurisdiction solely due to package-install heuristics.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This documentation explicitly promotes passing a local script path to an API that reads the file, wraps it, uploads it, and executes it in Alibaba Cloud, but it does not clearly warn that local file contents will be transmitted off-host and run remotely. In a skill whose purpose is automatic compute provisioning and script execution, that omission materially increases the risk of accidental exfiltration of secrets, credentials, proprietary code, or sensitive local data through normal-looking workflow steps.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The reusable executor pattern describes a persistent function that accepts scripts from the invocation payload and executes them repeatedly, which is effectively a remote arbitrary code execution interface. Without strong safety warnings and constraints, users may treat this as a convenience feature and unknowingly enable execution of untrusted payloads or transmit sensitive code/data into a cloud runtime, with risk amplified by the skill's stated end-to-end automation and deployment behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation states that if no workspace exists, one will be created automatically, but it does not require explicit user confirmation or prominently warn that this creates a persistent cloud resource. In a provisioning skill that can incur cost, allocate resources, and change account state, silent workspace creation expands the agent's authority and can lead to unintended account modifications and billing.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The cleanup guidance includes examples that delete jobs, but it does not clearly warn that deletion is destructive and may remove job records or make postmortem analysis harder. In this skill's context, cleanup operations affect cloud-managed training jobs and can destroy evidence needed for debugging or terminate workflows the user did not intend to remove.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The cleanup helper performs destructive cluster deletion with no confirmation gate at the deletion call site. Because this skill can reuse existing clusters, an automatic cleanup path may delete infrastructure that was not created solely for the current run, causing availability loss and data/workload disruption.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The runner removes any existing Job with the same name without warning the caller that prior job history and execution state will be destroyed. In the context of cluster reuse and a fixed default job name, this creates a realistic risk of clobbering other workloads or hiding prior evidence of execution.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The reusable executor is explicitly designed to accept payload-supplied shell or Python code and run it remotely in Alibaba Function Compute. In an agent skill context, this creates a direct remote code execution primitive that can be triggered by user-controlled input, enabling arbitrary command execution, data exfiltration, lateral movement using cloud credentials, and abuse of provisioned compute resources.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The wrapper helpers generate handler code that decodes and executes arbitrary shell or Python content via bash -c and exec. Although this may be intended for automation, it materially lowers the barrier to turning untrusted input into code execution on cloud infrastructure, which is especially dangerous in an agent that may transform user prompts into runnable scripts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Pod logs are printed directly to stdout without sanitization or access control, and training/job logs commonly contain secrets, dataset paths, tokens, environment variables, prompts, or user code output. In this skill's context, where arbitrary user commands are executed on cloud compute, direct log emission materially increases the chance of credential and sensitive workload-data disclosure.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: Pod events are emitted directly and may reveal internal infrastructure details such as image names, registry paths, node/runtime errors, VPC-related context, and operational metadata. While typically less sensitive than full logs, this still leaks environment information that can aid reconnaissance or expose workload details in shared agent output.

Unvalidated Output Injection

High

• Category: Output Handling

Content

env_info = {"python": sys.version, "cwd": os.getcwd(), "platform": sys.platform}

    if script_type == "shell":
        r = subprocess.run(
            ["bash", "-c", script],
            capture_output=True, text=True, timeout=sub_timeout,
        )

• Confidence: 95% confidence
• Finding: subprocess.run( ["bash", "-c", script], capture_output

Unvalidated Output Injection

High

• Category: Output Handling

Content

def handler(event, context):
    start = time.time()
    script = base64.b64decode("{encoded}").decode("utf-8")
    r = subprocess.run(
        ["bash", "-c", script],
        capture_output=True, text=True, timeout={sub_timeout},
    )

• Confidence: 96% confidence
• Finding: subprocess.run( ["bash", "-c", script], capture_output

Credential Access

High

• Category: Privilege Escalation

Content

| `cs:DescribeClustersV1` | 读 | 查询集群列表 |
| `cs:DescribeClusterDetail` | 读 | 查询集群详情与状态 |
| `cs:DescribeClusterNodePools` | 读 | 查询集群节点池列表 |
| `cs:DescribeClusterUserKubeconfig` | 读 | 获取集群 kubeconfig（用于 kubectl 操作） |
| `cs:CreateCluster` | 写 | 创建 ACK 集群 |
| `cs:DeleteCluster` | 写 | 删除 ACK 集群（资源清理） |
| `cs:CreateClusterNodePool` | 写 | 创建集群节点池 |

• Confidence: 90% confidence
• Finding: Kubeconfig

Credential Access

High

• Category: Privilege Escalation

Content

| `cs:DescribeClustersV1` | 读 | 查询集群列表 |
| `cs:DescribeClusterDetail` | 读 | 查询集群详情与状态 |
| `cs:DescribeClusterNodePools` | 读 | 查询集群节点池列表 |
| `cs:DescribeClusterUserKubeconfig` | 读 | 获取集群 kubeconfig（用于 kubectl 操作） |
| `cs:CreateCluster` | 写 | 创建 ACK 集群 |
| `cs:DeleteCluster` | 写 | 删除 ACK 集群（资源清理） |
| `cs:CreateClusterNodePool` | 写 | 创建集群节点池 |

• Confidence: 90% confidence
• Finding: kubeconfig

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.