Alibabacloud Das Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:22 AM UTC
• Version: 0.0.2

Overview

The skill mostly does what it claims, but it asks for broad cloud database authority and handles remote diagnostic output in ways that need careful review.

Install only if you can run it with a dedicated Alibaba Cloud RAM user or role limited to the minimum needed permission, preferably das:Chat rather than FullAccess. Treat DAS output, tool previews, stdout logs, and session IDs as sensitive database diagnostics, and confirm any state-changing database action before sending it through the skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:140

Finding

Untrusted Remote DAS Output Is Mandated for Verbatim Relay

Content

View full analysis

300 else result_content self._emit(f"[tool_output] {preview}") ``` ### Technical Analysis The Skill instructs the host AI agent to reproduce the complete stdout stream verbatim and expressly prohibits summarization, filtering, or omission. However, stdout contains content controlled by an external service, including generated assistant messages and previews of raw DAS tool results. Those results may incorporate database metadata, SQL text, object names, diagnostic data, or other content influenced by users with access to the analyzed database. Consequently, the Skill crosses a trust boundary by treating remote and potentially attacker-influenced text as authoritative instructions for the host agent. Response delimiters identify where a response starts and ends, but they do not neutral ...[truncated 1704 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:15

Finding

Documentation Requests Excessive Alibaba Cloud Permissions

Content

View full analysis

Requires uv (Python package manager) and HTTPS access to das.cn-shanghai.aliyuncs.com. Requires Alibaba Cloud credentials to be available through the default credential chain (AliyunHDMFullAccess permission). DAS Agent ID is optional. ``` The same Skill metadata identifies only one required action: ```yaml metadata: async: true timeout: 1800 required_permissions: - "das:Chat" ``` The RAM reference similarly documents the implemented requirement: ```markdown | Product | Action | Description | |---------|--------|-------------| | `das` | `Chat` | Call the DAS Agent Chat API to send natural language queries and receive diagnostic results | ``` ### Technical Analysis The implementation sends a single signed `Chat` action to the fixed DAS endpoint. Both the Skill metadata and RAM policy reference identify `das:Chat` as the required API permission. In contrast, the compatibility declaration instructs users to provide credentials with `AliyunHDMFullAccess`. A full-access managed policy is broader than the single action exercised by this client and violates least-privilege principles. The script obtains credentials from the Alibaba Cloud default credential chain. Therefore, the effective authority available to the process depends on the permissions attached to the resolved RAM user or role. If users follow the broad compatibility guidance, compromise of the runtime, a dependency, or the remote orchestration path would have a larger impact than necessary. ### Attack Path 1. An administrator follows `SKILL.md` and provisions a RAM user or role with `AliyunHDMFullAccess`. 2. The Skill resolves those credentials through an environment variable, local profile, or ECS RAM role. 3. The process receives credentials authorized for operations ...[truncated 1009 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/call_das_agent.py:137

Finding

Pipe Mode Mixes Remote Tool Output and Progress with the Final Answer

Content

View full analysis

300 else result_content self._emit(f"[tool_output] {preview}") ``` The documented pipe-mode contract states: ```markdown # Pipe mode (RECOMMENDED for agents) — clean output: progress to stderr, answer clearly delimited on stdout ``` ```markdown **Always use `--pipe` when invoking as an agent.** It routes all progress/tool-call noise to stderr and writes only the DAS answer to stdout, wrapped in clear delimiters — making the real response impossible to miss. ``` ### Technical Analysis Pipe mode is presented as an agent-safe interface in which stderr carries progress and tool-call noise while stdout carries only the final DAS answer. The implementation does not enforce that contract. The `_progress` method sends pipe-mode progress to stdout, and `_on_tool_call_result` sends remote tool-output previews to stdout. Tool start, completion, and activity indicators are also emitted on stdout elsewhere in the pipe-mode handlers. Consumers that rely on the documented stream separation may ...[truncated 1510 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence

Findings (17)

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 85% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

- Credential environment variables are empty or missing — configure them according to the official documentation.
- Errors mentioning `~/.aliyun/config.json` or `~/.alibabacloud/credentials.ini`
  The SDK attempted local profile-based credentials, but the files were missing or invalid. Create/fix the default profile if you want to use local profiles.
- Errors mentioning `100.100.100.200`
  The SDK attempted ECS metadata. This is expected on ECS, but usually a local-machine misconfiguration elsewhere.

For local development, if you are not using ECS RAM Role credentials, you can explicitly disable ECS metadata lookup:

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 85% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

- Credential environment variables are empty or missing — configure them according to the official documentation.
- Errors mentioning `~/.aliyun/config.json` or `~/.alibabacloud/credentials.ini`
  The SDK attempted local profile-based credentials, but the files were missing or invalid. Create/fix the default profile if you want to use local profiles.
- Errors mentioning `100.100.100.200`
  The SDK attempted ECS metadata. This is expected on ECS, but usually a local-machine misconfiguration elsewhere.

For local development, if you are not using ECS RAM Role credentials, you can explicitly disable ECS metadata lookup:

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 85% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · scripts/call_das_agent.py (reported line 173)May include surrounding context.

python

- Credential environment variables are empty or missing — configure them according to the official documentation.
- Errors mentioning `~/.aliyun/config.json` or `~/.alibabacloud/credentials.ini`
  The SDK attempted local profile-based credentials, but the files were missing or invalid. Create/fix the default profile if you want to use local profiles.
- Errors mentioning `100.100.100.200`
  The SDK attempted ECS metadata. This is expected on ECS, but usually a local-machine misconfiguration elsewhere.

For local development, if you are not using ECS RAM Role credentials, you can explicitly disable ECS metadata lookup:

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 85% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · scripts/call_das_agent.py (reported line 175)May include surrounding context.

python

- Credential environment variables are empty or missing — configure them according to the official documentation.
- Errors mentioning `~/.aliyun/config.json` or `~/.alibabacloud/credentials.ini`
  The SDK attempted local profile-based credentials, but the files were missing or invalid. Create/fix the default profile if you want to use local profiles.
- Errors mentioning `100.100.100.200`
  The SDK attempted ECS metadata. This is expected on ECS, but usually a local-machine misconfiguration elsewhere.

For local development, if you are not using ECS RAM Role credentials, you can explicitly disable ECS metadata lookup:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/call_das_agent.py (reported line 211)May include surrounding context.

python

if not access_key_id or not access_key_secret:
            raise ValueError(
                "Failed to resolve access credentials from the Alibaba Cloud default credentials chain"
            )

        return access_key_id, access_key_secret, security_token

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/call_das_agent.py (reported line 361)May include surrounding context.

python

message = self._validate_message(message)
        session_id = self._validate_session_id(session_id)

        # Reset state
        self.message_roles.clear()
        self.accumulated_text = ""
        self.accumulated_tool_result = ""

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/call_das_agent.py (reported line 738)May include surrounding context.

python

, "code": error_code, "message": error_msg})

    def _on_legacy_answer(self, data):
        answer = data.get('Answer', '')
        if not answer:
            return
        if self.mode == self.MODE_JSON:
            self._emit_json({"type": "message", "role": "assistant", "content": answer})
        else:
            self._emit(answer, end='')


def main():
    parser = argparse.ArgumentParser(description="Call Alibaba Cloud DAS Agent Chat API")
    parser.add_argument("--question", required=True, help="The question to send to the Agent")
    parser.add_argument("--session", help="Session ID for maintaining conversation context")
    parser.add_argument("--json", action="store_true", help="JSONL output: one JSON object per line, machine-readable")
    parser.add_argument("--pipe", action="store_true",
                        help="Agent-friendly mode: progress/tool noise to stderr, answer delimited on stdout")
    args = parser.parse_args()

    if args.json:
        mode = DasAgent

Known Vulnerable Dependency: pytest==7.0.0 — 2 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The test extra pins pytest to 7.0.0, which the finding reports as vulnerable to CVE-2025-71176 involving tmpdir handling. This is a genuine vulnerable dependency, but because it is scoped to optional test dependencies rather than the runtime package, the practical exposure is typically limited to developer or CI environments unless untrusted test inputs are processed there.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill can access environment-derived credentials, make outbound network requests, and invoke shell commands, but its declared scope only lists a service permission and does not constrain local execution capabilities. In an agent setting, this weakens least-privilege controls and increases the chance of unintended command execution, credential exposure, or unreviewed external communication if the skill is triggered unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger guidance includes broad casual phrases like 'my database is slow' and 'can't connect to the database,' which can cause this privileged cloud-management skill to activate in ambiguous conversations. Because the skill can use cloud credentials and perform remote diagnostic actions, over-triggering raises the risk of unnecessary access to account data and accidental execution against production resources.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The skill strongly instructs agents to persist and reuse a server-assigned session ID across related requests, meaning conversational context and potentially sensitive database diagnostics are retained server-side over multiple turns. In multi-user or weakly isolated agent environments, mishandling or leaking the session ID could expose prior results or let later requests act within an unintended context.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

The Alibaba Cloud Credentials SDK automatically resolves credentials from multiple sources (environment variables, configuration files, ECS RAM roles, etc.). Refer to the [official credential configuration documentation](https://www.alibabacloud.com/help/en/sdk/developer-reference/v2-manage-python-access-credentials) for setup instructions.

If you have purchased a DAS Agent subscription, create and manage your Agent ID at: https://das.console.aliyun.com/

## Troubleshooting

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation states that credentials may be sourced from the default provider chain and that all JSON mode output, including tool output and raw API response data, is emitted to stdout, but it does not warn that stdout is commonly captured by shells, CI logs, orchestration platforms, or parent processes. In a database diagnostics skill, streamed tool results can contain sensitive operational data, query text, instance metadata, or error details, so documenting unrestricted stdout emission without safety guidance creates a realistic data exposure risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/call_das_agent.py (reported line 133)May include surrounding context.

python

# In PIPE mode, everything goes to stdout in order; answer is wrapped in clear delimiters.

    def _emit(self, text, end="\n"):
        """Write content to stdout."""
        print(text, end=end, flush=True)

    def _progress(self, text, end="\n"):

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code sets AcceptLanguage to zh-CN for every request, which forces a specific locale on all users. This matches the policy-violation category because the skill does not offer a language option or explain why a China-specific locale is required.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The CLI help for --pipe says progress and tool noise go to stderr, but the implementation actually writes them to stdout. In agent pipelines, consumers often treat stdout as trusted machine-readable output, so this mismatch can corrupt parsing, cause response-boundary confusion, or let remote tool/output content be misinterpreted as the primary result.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: requests==2.32.5 — 2 advisory(ies): CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func); CVE-2026-25645 (Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract)

Medium

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The project pins requests to 2.32.5, which the finding indicates is affected by CVE-2026-25645 and fixed in 2.33.0. If any code path uses the vulnerable extract_zipped_paths-related functionality, an attacker may be able to exploit insecure temporary file handling, so shipping the known-vulnerable version is a real supply-chain risk even if exploitability depends on usage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The request body specifies AcceptLanguage=zh-CN, which forces a specific locale in the documented behavior. The file does not indicate that users may choose another language or that the Chinese locale is required for a region-specific or compliance reason.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.