Security audit

alibabacloud-dataphin-skills

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent Dataphin admin suite, but it handles powerful cloud credentials and TLS/plugin settings in ways users should review carefully before installing.

Install only in a Dataphin administration context. Prefer a least-privilege, task-specific RAM identity, preconfigure credentials outside the chat/session when possible, avoid putting secrets in command arguments, verify standalone certificates instead of disabling TLS where feasible, and review each write, delete, grant, publish, plugin update, or profile change before allowing it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (165)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill clearly instructs use of environment variables, local file reads/writes, and networked CLI/API operations, but it does not declare permissions or capability boundaries. In an agent setting, undeclared powerful capabilities reduce reviewability and can let the skill access credentials, alter local CLI configuration, and make remote changes without an explicit permission contract.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 83% confidence
Finding: The declared description presents the skill mainly as a routing entrypoint, but the documented behavior reaches much further into direct API invocation, HMAC-signed requests, schema import/export/publish, local auto-fix, and repository validation tasks. That mismatch can mislead users and reviewers about the real authority of the skill, increasing the chance of unexpected data-plane actions or local modifications being approved under a narrower-looking description.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The skill first instructs the agent to never write literal credentials with `aliyun configure set`, but later mandates `aliyun configure set --auto-plugin-install true`. While this specific command does not set secrets, it directly contradicts the earlier safety rule and normalizes use of `configure set`, weakening guardrails around credential handling. In an agentic context, contradictory security guidance increases the chance of unsafe follow-on behavior or policy bypass when similar configuration-writing commands are introduced.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill first prohibits using `aliyun configure set` for credential handling, then later mandates `aliyun configure set --auto-plugin-install true`. Even though this specific command does not write secrets, it still modifies persistent CLI configuration inside the skill flow, creating an unsafe precedent and contradicting the earlier guardrails. In an agentic context, this can normalize config mutation and enable unintended plugin installation behavior that broadens the execution surface.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill gives rollback guidance that says the compute source can be deleted after unbinding, while the same document states there is no unbind API for a MaxCompute project once bound. This inconsistency can mislead an operator into treating the action as reversible when it may be operationally irreversible, increasing the risk of accidental misconfiguration, service disruption, or creation of resources that cannot be cleanly rolled back through the documented workflow.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The skill explicitly tells the operator not to expose credentials, but then requires passing `MC_ACCESS_ID` and `MC_ACCESS_KEY` inline inside JSON arguments to `aliyun` commands. Inline secrets in command arguments are commonly exposed through shell history, process listings, terminal logs, agent transcripts, and observability tooling, creating a realistic secret leakage path. In this skill context, the risk is elevated because the workflow is specifically for creating cloud data sources, so leaked credentials could grant direct access to MaxCompute data and enable broader compromise of data platform resources.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The skill explicitly warns that credentials must not be printed, yet later instructs printing the full API creation response. Even if credentials are not directly echoed, full service responses can contain sensitive identifiers, configuration metadata, or other secrets that end up in logs and terminals, creating an avoidable disclosure path.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The skill explicitly states credentials must never be written with `aliyun configure set`, but then instructs users to run `aliyun configure set --auto-plugin-install true`. While this specific flag does not itself contain secrets, it normalizes use of the forbidden command in the credential-handling pre-check and weakens the safety invariant around CLI configuration. In a credential-sensitive cloud admin workflow, inconsistent guidance can cause agents or operators to later use the same command form with literal credentials, increasing risk of secret persistence or accidental exposure.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill first states that credential material must never be written via `aliyun configure set`, but then mandates `aliyun configure set --auto-plugin-install true`. Even though this specific command does not embed AK/SK values, it normalizes use of `configure set` inside a credential-safety section and can mislead an agent or user into using the same mechanism for sensitive configuration, weakening the stated control boundary.

Intent-Code Divergence

Medium

Confidence: 82% confidence
Finding: The skill states that Cypher is read-only, but later explicitly permits a generic Python Tea SDK fallback using call_api() in older environments. That fallback can bypass the CLI's constrained command surface and enable arbitrary KG API invocation, undermining the documented safety boundary and potentially allowing unintended write operations or broader data access if an agent follows the fallback path.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The documentation acknowledges that unlabeled Cypher queries can scan the entire underlying graph space and, in shared test/POC deployments, may return data from other knowledge-graph spaces. This is a real cross-scope data exposure risk because a user or agent could issue overly broad queries and retrieve unrelated tenants' or projects' data when isolation is misconfigured.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The template explicitly sets `runtime.ignore_ssl = True`, which disables TLS certificate verification for all API calls. In a credentialed SDK example that sends Alibaba Cloud access keys and knowledge-graph requests, this enables man-in-the-middle interception or response tampering if traffic is routed through a hostile network or endpoint.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The template explicitly sets `runtime.ignore_ssl = True`, disabling TLS certificate validation for API calls. This enables man-in-the-middle interception or tampering of Dataphin API traffic, including credentials and schema-management requests, which is especially risky because the same template performs authenticated write operations.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: This monitoring/log-query skill includes guidance to use a state-changing recovery action (`resume-physical-node`) when diagnosing `WAIT_SCHEDULE`. That expands the skill from read-only observation into operational mutation, which can cause unintended execution changes, bypass change-control expectations, and increase the chance that a user triggers production actions from a skill described as monitoring-only.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The declared scope is task-instance monitoring and log retrieval, but the related commands section advertises mutating operations such as `resume-physical-node`, `rerun-task-instance`, and `pause-task-instance`. This scope creep is dangerous because users or downstream agents may infer that destructive or state-changing actions are in-bounds for a read-oriented skill, increasing the risk of unauthorized or accidental production changes.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The file labels `query-kg` as read-only while granting `dataphin:ExecKgCypher`, an action that executes arbitrary Cypher. Unless the platform enforces read-only semantics server-side, this is a misleading permission description that can cause operators to grant broader graph-query capability than intended, potentially enabling unauthorized data modification or unsafe query execution in knowledge graph spaces.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: Using a local system command for business date introduces unnecessary host-level execution capability into an otherwise API/CLI routing index. Even though `date` is a simple command, expanding the trusted surface to local shell access can become dangerous in agentic environments where command execution pathways may later be generalized or influenced by untrusted input.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill claims credential handling is limited to non-invasive status checks via `aliyun configure list`, but later instructs the agent to modify global CLI configuration with `aliyun configure set --auto-plugin-install true`. That contradiction can cause persistent local state changes outside the immediate task, expands trust to auto-installed plugins, and weakens the safety boundary the authentication section establishes.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The routing table contains very broad and overlapping trigger phrases such as common data-work terms, which can cause the agent to dispatch into the wrong sub-skill. In this context that is risky because many routes lead to privileged read/write operations against Dataphin, so an ambiguous request could unintentionally create, modify, publish, rerun, pause, or grant access to resources.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs collection and handling of AccessKey ID, AccessKey Secret, endpoint, and tenant identifiers, but it does not include an explicit secret-handling warning or safe-input guidance. In a high-privilege cloud administration context, that omission makes accidental disclosure, insecure transmission, logging, or persistence of long-lived credentials more likely.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide instructs users to configure long-lived AccessKey credentials directly on the command line and via environment variables, but it does not warn about shell history, process listing exposure, CI log leakage, or the need to prefer short-lived credentials where possible. In a skill focused on Dataphin and Alibaba Cloud operations, this increases the likelihood that operators will paste real secrets into unsafe contexts during routine setup.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The guide recommends executing a remotely fetched script directly with bash, which removes the user's opportunity to inspect the script before execution. If the CDN, DNS, TLS trust chain, or upstream distribution is compromised, users could execute attacker-controlled code immediately on their systems.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The credential setup section instructs users to place long-lived access keys on the command line and in environment variables without warning about shell history, process inspection, CI log leakage, or least-privilege practices. This can lead to accidental secret exposure and compromise of the associated Alibaba Cloud account or Dataphin resources.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The guide instructs users to provide AccessKey ID and AccessKey Secret directly via command-line arguments and environment variables, but does not warn that these secrets can be exposed through shell history, process listings, logs, CI output, or accidentally committed scripts. In a skill focused on Dataphin and Alibaba Cloud operations, these credentials likely grant access to sensitive cloud resources, so poor secret-handling guidance materially increases the risk of credential compromise.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The guide shows non-interactive credential setup with AccessKey material on the command line and via exported environment variables, but it does not warn that secrets may be recorded in shell history, process listings, CI logs, or inherited by child processes. In a credential-management context for cloud administration tooling, this omission can directly increase the chance of secret disclosure and subsequent unauthorized access.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.insecure_tls_verification

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: references/knowledge-graph/manage-kg-schema/scripts/import-schema.py:182

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: references/dataservice/call-data-service-api/scripts/call-data-service-api.py:127