alibabacloud-dataworks-data-agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:14 AM UTC
• Version: 0.0.1

Overview

The skill has a coherent Alibaba Cloud DataWorks purpose, but its command examples and data-transfer guidance create review-worthy risk around local command injection and sensitive data handling.

Review before installing. Use only with a properly scoped aliyun CLI profile, avoid sending secrets or regulated data, confirm any local file upload yourself, and prefer implementations that build JSON with a serializer and invoke the CLI without shell interpolation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:59

Finding

Shell Command Injection Through User-Controlled JSON Values

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–62 and 93–101; additional affected examples appear in references/examples.md, lines 14–17 and 93–96
Vulnerability Type: Shell command injection caused by unsafe interpolation into single-quoted CLI arguments
Risk Level: High

Vulnerable Code

From SKILL.md, lines 59–62:

bash

aliyun dataworks-public prompt-agent-session --profile default --region cn-shanghai \
  --params '{"SessionId":"<session-id>","Prompt":[{"Type":"text","Text":"your question"}]}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-agent/<session-id>

From SKILL.md, lines 93–101:

bash

# With dataset context
aliyun dataworks-public prompt-agent-session --profile default --region cn-shanghai \
  --params '{"SessionId":"<id>","Prompt":[{"Type":"text","Text":"query"}],"Meta":{"Context":"{\"datasetUuid\":\"xxx\"}"}}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-agent/<session-id>

# With file attachment
aliyun dataworks-public prompt-agent-session --profile default --region cn-shanghai \
  --params '{"SessionId":"<id>","Prompt":[{"Type":"text","Text":"analyze"},{"Type":"file","Name":"data.csv","Uri":"file:///path/to/data.csv"}]}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-agent/<session-id>

From references/examples.md, lines 14–17:

bash

# 2. Send prompt
aliyun dataworks-public prompt-agent-session --profile default --region cn-shanghai \
  --params '{"SessionId":"<session-id>","Prompt":[{"Type":"text","Text":"Analyze data quality of orders table for the last 7 days"}]}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-dataworks-data-agent/<session-id>

From references/examples.md, lines 93–96:

bash

aliyun dataworks-public prompt-agent-session --profile default --region cn-shanghai \
  --params '{"SessionId":"<session-id>","Prompt":[{"Type":"text","Text":"Analyze the sales data trends in this file"},{"Type
...[truncated 2251 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not construct shell command strings through interpolation.
2. Invoke aliyun through an argument-array API that bypasses shell parsing, such as a subprocess interface with shell execution explicitly disabled.
3. Build request objects and serialize them with a trusted JSON library. Pass the resulting JSON string as one literal process argument.
4. Treat prompt text, session identifiers, dataset identifiers, attachment names, file URIs, profile names, and regions as untrusted input.
5. Apply strict allowlist validation where practical:
   • Validate session identifiers against the service's documented identifier format.
   • Restrict regions and profiles to expected character sets and configured values.
   • Normalize and validate attachment paths before use.
   • Reject prohibited sensitive directories after canonical path resolution.
6. If shell execution is unavoidable, apply robust platform-appropriate shell quoting after JSON serialization rather than relying on handwritten quoting.
7. Update every command example in SKILL.md and references/examples.md to demonstrate safe argument construction.
8. Add tests containing single quotes, command separators, substitutions, newlines, and malformed JSON to verify that values remain inert process arguments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Workflow

bash

# 1. Create session (extract SessionId from $.JsonRpcResponse.Result.SessionId)
#    NOTE: do NOT add a top-level ClientToken field — the dataworks-public plugin
#    rejects it ("unknown field: ClientToken"); keep the request body minimal
aliyun dataworks-public create-agent-session --profile default --region cn-shanghai \

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The skill directs the agent to automatically retry and proceed without asking the user in certain cases. In a conversational system that can trigger external API actions, this reduces user confirmation boundaries and can cause unintended repeated requests, extra token consumption, or actions taken on an ambiguous basis.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

- **Follow-up turns**: If the user sends a short acknowledgment after your report (e.g., "OK"), your final response MUST still restate the key conclusion of the workflow in one line (e.g., the "No active session" outcome, or the analysis/session result) before closing — do NOT end with only a generic acknowledgment such as "Got it, let me know if you need anything".
- **Reporting completeness** (MANDATORY): Your final response MUST mention each action the user requested and its outcome (executed / skipped / failed, with the reason) — e.g., if the user asked to check token usage AND cancel the session, address BOTH explicitly even when the workflow terminates early.
- **Create session failure**: If `create-agent-session` returns empty or fails to return a SessionId after 2 attempts, fall back to `list-agent-sessions` to find an existing non-RELEASED session and reuse its SessionId. Do NOT retry create more than 2 times — the 3rd attempt is forbidden. This 2-attempt cap counts ALL `create-agent-session` calls in the entire workflow, including attempts made because the user asked to "retry" — a user retry request refers to retrying the analysis/query, NOT to creating additional sessions. NEVER substitute the user-agent workflow UUID or any other self-generated identifier for the SessionId — a valid SessionId can ONLY come from a `create-agent-session` or `list-agent-sessions` API response; if none is available, terminate per this guideline instead of improvising. Do NOT use RELEASED sessions for `prompt-agent-session` — they will return empty responses. If `list-agent-sessions` also returns only RELEASED sessions, report to the user: "Unable to create session and no active sessions available. Please retry later or check service status." and terminate the workflow immediately. EXCEPTION: if the user has stated they haven't created any session (Security Constraint #7 applies), the list-agent-sessions fallback is pointless and MUST be skipped — create failures then termin
...[truncated 26 chars]

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill uses the term "session-id" for the observability UUID in the user-agent string while separately requiring that SessionId only come from API responses. That naming conflict can cause an agent implementation to substitute a self-generated UUID where a real API SessionId is required, leading to mis-bound requests, failed operations, or accidental actions against the wrong session state.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The Scope section states 'This tool covers Agent Session management APIs only (8 APIs),' which narrows the documented intent to session-management functions. Later sections document artifact listing/content retrieval and token usage endpoints, so the documentation actively contradicts itself about the tool's actual scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The prompt examples explicitly show sending arbitrary text and local file URIs to a remote cloud API, but provide no warning that user prompts and referenced files may leave the local environment and be processed remotely. In a data-analysis skill, users are likely to submit datasets, query text, or filenames containing sensitive business data, so omission of privacy and data-handling guidance increases the risk of inadvertent disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The artifact listing and retrieval APIs may expose generated reports, extracted data, or other session outputs that could contain sensitive information, yet the documentation presents them as routine reads without any caution. In this skill context, artifacts are a natural place for query results and analysis exports, so failing to warn about sensitivity and access control makes accidental data disclosure more likely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The example explicitly encourages passing a local file via a file:// URI to a remote agent service, which expands the effective capability surface to local file access and exfiltration. In a conversational data-analysis skill, users may not realize that attaching a local path causes file contents to be transmitted off-host, creating data leakage risk if sensitive files are selected or inferred by downstream tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

These examples send both local file contents and dataset context identifiers to a remote service without any privacy or transmission warning. That can cause inadvertent disclosure of sensitive business data, metadata, or tenant-specific identifiers, especially in enterprise environments where datasets and attached files may contain regulated information.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The instruction to automatically retry with a modified query and not ask the user authorizes autonomous action that changes the original request semantics. In a data agent context, this can trigger unintended additional remote processing, extra token consumption, and potentially broader data retrieval than the user explicitly approved.

Content

Scanner excerpt · references/examples.md (reported line 134)May include surrounding context.

md

Agent should:

1. Report the empty response to the user (do not treat as success)
2. AUTOMATICALLY retry with a more specific query (e.g., add time range or specific API name) — do NOT ask the user whether to retry
3. If retry also returns empty, report the failure and suggest checking backend service status or session validity

Static analysis

No suspicious patterns detected.