Security audit
Security checks for vulnerabilities and agentic risk
This Dataphin automation suite matches its stated purpose, but it needs Review because it combines broad administrative access with unsafe credential, installer, and network-security guidance.
Before installing, treat this as a powerful Dataphin administration suite. Use the narrow per-sub-skill RAM policy instead of the suite-wide Resource "*" policy, configure credentials outside the agent conversation, avoid commands that expose secrets as arguments, prefer HTTPS with valid certificates or a trusted private CA, and do not run remote installer scripts directly without verification.
references/cli-installation-guide.md:19Unverified Remote Installer Scripts Are Executed Directly by Bash
references/dataservice/call-data-service-api/scripts/call-data-service-api.py:125Credential-Bearing Dataphin API Requests Use Plaintext HTTP by Default
references/assets/manage-asset-attributes/scripts/dataphin_asset_api.py:110TLS Certificate Verification Is Disabled by Default for Standalone API Operations
SKILL.md:135Long-Lived Cloud Secrets Are Solicited in Agent Conversations and Placed in Command Arguments
The declared description says this skill is a Dataphin suite入口 that routes user scenarios to many concrete sub-skills spanning nearly the full Dataphin product surface. The supplied code does not do routing, scenario detection, or orchestration. Instead, it is a standalone implementation for one narrow function: calling already-published Dataphin Data Service APIs through the gateway, including signature generation, POST requests, async job status/result polling, closeJob, and SSE stream handling. This is a materially different primary purpose from a suite router. While '数据服务 API 调用' appears within the broad declared coverage, the code chunk itself is not an entry skill for all those scenarios and exposes a specific undeclared operational capability profile centered on authenticated gateway invocation. Therefore the description does not accurately represent this code chunk.
The declared description says this skill is a Dataphin suite entry point that routes many different business scenarios to specialized sub-skills across a large set of domains. The supplied code chunk does something materially different: it is a test file for a particular data-service API client script. Its primary purpose is regression testing of request signatures, paths, transport handling, async pagination/job closing, server-sent events, and CLI behavior. It even enforces offline execution by blocking socket access. While 'data service API' is one topic mentioned in the description, this code is not implementing a suite router or the broad multi-domain business workflow coverage claimed. Instead, it is narrowly focused on validating a client implementation. That is a clear description-behavior mismatch.
The declared description presents this skill as a broad Dataphin suite entry point that routes requests into many business-domain sub-skills covering end-to-end Dataphin workflows. The supplied code does none of that. It is a standalone support script for generating a skill User-Agent string from a local manifest and session ID, with validation logic for manifest name, semantic version, and session ID format. There is no evidence of routing, keyword handling, Dataphin API access, cloud/resource management, or any of the listed business capabilities. This is a clear description-behavior mismatch because the actual primary purpose is unrelated utility initialization rather than Dataphin workflow orchestration.
The declared description presents this skill as a broad Dataphin operational router covering many platform workflows. The supplied code does not implement any Dataphin routing, API calls, business-flow handling, or user-triggered operations. Instead, it is a regression test file for a validator module, focused on checking structure and safety constraints of eval definitions and reference documents. This is a materially different primary purpose, so the description does not accurately represent the code.
The declared description presents an orchestration/router skill for a broad Dataphin business suite. The supplied code instead is a repository utility script for offline evaluation file validation. Its behavior is limited to reading local JSONC/reference files, checking naming/assertion conventions, validating prompt contents for offline eval cases, and reporting static coverage. There is no evidence of Dataphin API interaction, request routing to sub-skills, business keyword dispatch, cloud/platform resource operations, or any of the listed domain capabilities. This is a materially different primary purpose, so the description does not accurately represent the code.
The standalone flow mandates --skip-secure-verify, which disables TLS certificate validation and enables man-in-the-middle interception of credentials, API requests, and responses. This is especially dangerous here because the same workflow handles AccessKey secrets, tenant identifiers, and administrative Dataphin operations over the network.
Referenced artifact was not completely inspected
数据文件：[`references/config/openapi-2.0-versions.json`](./references/config/openapi-2.0-versions.json)（383 条 union，字段 `min_version` + `channel`）。
Referenced artifact was not completely inspected
数据文件：[`references/config/openapi-2.0-versions.json`](./references/config/openapi-2.0-versions.json)（383 条 union，字段 `min_version` + `channel`）。
Referenced artifact was not completely inspected
数据文件：[`references/config/openapi-2.0-versions.json`](./references/config/openapi-2.0-versions.json)（383 条 union，字段 `min_version` + `channel`）。
Referenced artifact was not completely inspected
| 即席查询 / 执行 SQL / 临时跑代码 / 建表 / execute-ad-hoc-task | [execute-ad-hoc-task](./references/dev/execute-ad-hoc-task/SKILL.md) |
Referenced artifact was not completely inspected
| 业务日期 / bizdate / T-1 / 今天日期 / 昨天 | [get-bizdate](./references/dev/get-bizdate/SKILL.md) |
Referenced artifact was not completely inspected
| 数据同步 / 数据搬运 / pipeline / reader-writer / MySQL→MaxCompute | [create-pipeline-task](./references/pipeline/create-pipeline-task/SKILL.md) |
Referenced artifact was not completely inspected
| 知识图谱 Schema / 本体模型 / 实体类型 / 关系类型 / Schema 导入导出 / Schema 发布 | [manage-kg-schema](./references/knowledge-graph/manage-kg-schema/SKILL.md) |
Referenced artifact was not completely inspected
| 质量监控 / 质量规则 / 数据质量校验 / 质量告警 / 质量试跑 / 质量调度 / 监控对象 | [configure-quality-rule](./references/assets/configure-quality-rule/SKILL.md) |
Referenced artifact was not completely inspected
向量化 / Embedding 入库 / create-work-flow-by-json | [create-unstructured-workflow](./references/unstructured-data/create-unstructured-workflow/SKILL.md) |
Referenced artifact was not completely inspected
详见 [相关命令索引](./references/related-commands.md)。
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
## 安全验收
- [ ] 不伪造 `create-project`、`update-project`、`delete-project` 等不存在的公开 CLI 命令。
- [ ] 不直接调用页面内部 `/api/project/basic`、`/api/project/update` 或 `DELETE /api/project/{projectId}`。
- [ ] 白名单更新必须先回读旧值，并确认合并后的新值。
- [ ] 项目成员初始化建议路由到 `manage-project-member`，避免本 Skill 混入成员全生命周期。
- [ ] 任何未来写操作都必须先 HITL 确认命令全文、影响范围和回滚方案。
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
|---|---|---|
| `/api/project/basic` | 创建 Basic 模式项目 | 仅作为语义参考，不执行 |
| `/api/project/update` | 更新项目信息 | 仅作为语义参考，不执行 |
| `DELETE /api/project/{projectId}` | 删除项目 | 仅作为语义参考，不执行 |
| `/api/datacatalog/project/search` | 页面项目搜索与创建后验证 | 公开替代为 `get-project-by-name` / `list-projects` |
| `/api/v1/schedule/resource/config/list` | 获取调度资源组 | 仅作为语义参考，不执行 |
| `/api/project/relation` | 查询项目依赖关系 | 公开替代为 `check-project-has-dependency` |
The skill instructs users to fetch and immediately execute a remote shell script via curl ... | bash, which bypasses integrity verification, review, and pinning. If the hosting domain, CDN path, TLS trust chain, or upstream script is compromised, the user could execute arbitrary code on the local machine running the agent or operator workflow.
**Pre-check: Aliyun CLI >= 3.4.8 required**
> Run `aliyun version` to verify >= 3.4.8. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.
**Pre-check: Aliyun CLI plugin update required**
The markdown provides a copy-pastable curl command using -k and cleartext HTTP to probe a host, encouraging unsafe tool usage with attacker-influenced network parameters. Even if framed as discovery, this normalizes disabling transport protections and could expose app identifiers, enable spoofed responses, or train users to bypass certificate failures instead of fixing trust configuration.
数据服务调用路径为 /{methodType}/{apiId}?appKey=<AppKey>&env=PROD。用 GET 探一下候选域名即可判断是否命中网关（GET 会被拒，但拒的方式能证明域名对不对）：
curl -sS -k -m 8 "http://<候选host>/list/<apiId>?appKey=<AppKey>&env=PROD"
| 返回 | 结论 |
The skill instructs users to set runtime.ignore_ssl = True, which disables TLS certificate validation and makes HTTPS connections vulnerable to man-in-the-middle interception or endpoint spoofing. In this skill, those connections carry Alibaba Cloud access credentials and API management actions, so an attacker on the network path could steal secrets or tamper with create/publish requests.
This skill enables ad-hoc SQL, DDL, and Shell execution but does not clearly foreground the risk of destructive or irreversible actions such as DROP, TRUNCATE, ALTER, UPDATE/DELETE without predicates, or harmful shell commands. In this context, the missing warning is significant because the skill is explicitly designed to execute one-off code directly against production-capable data systems.
The command downloads a shell script from an external URL and immediately executes it with sudo, creating a classic remote code execution and supply-chain risk. In the context of an agent skill, this is more dangerous because users may follow the snippet verbatim with elevated trust, leading to full host compromise if the remote source is malicious or compromised.
官方一键脚本，自动识别架构并安装到 /usr/local/bin：
sudo -v ; curl https://gosspublic.alicdn.com/ossutil/install.sh | sudo bash
依赖
unzip或7z解压；macOS 自带unzip，一般无需额外安装。
The pipeline chains network retrieval directly into privileged shell execution, reducing opportunities for inspection and increasing the chance that users execute attacker-controlled content. This kind of chaining is especially risky in automation or skill documentation because it encourages copy-paste execution with minimal scrutiny.
官方一键脚本，自动识别架构并安装到 /usr/local/bin：
sudo -v ; curl https://gosspublic.alicdn.com/ossutil/install.sh | sudo bash
依赖
unzip或7z解压；macOS 自带unzip，一般无需额外安装。
This repeats the same unsafe pattern on Linux: fetching an external installer script and piping it directly into a privileged shell. A compromise of the CDN, DNS, TLS trust chain, or published script contents could yield arbitrary root-level command execution.
/usr/bin）sudo -v ; curl https://gosspublic.alicdn.com/ossutil/install.sh | sudo bash
需
unzip或7z：sudo yum install -y unzip或sudo apt-get install -y unzip。
Detected: suspicious.dynamic_code_execution, suspicious.insecure_tls_verification