Alibabacloud Dataworks Datastudio Develop

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:42 AM UTC
• Version: 0.0.3

Overview

The skill matches Alibaba DataWorks automation, but it asks the agent to run an unverified remote installer and make persistent CLI/plugin changes before using broad cloud mutation capabilities.

Install only if you are comfortable letting the agent operate Alibaba Cloud DataWorks resources with your configured CLI profile. Prefer installing Aliyun CLI and plugins yourself through a pinned, trusted, verifiable method before using the skill; avoid the `curl | bash` path, review any plugin updates, and use least-privilege RAM credentials scoped to the target project.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:30

Finding

Unverified Remote Installer Is Piped Directly into Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30–32
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code

markdown

**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash` to update,

Technical Analysis

The Skill directs the agent to download a shell script from an external URL and pipe it directly into bash. The retrieved payload is executed without being saved for inspection, pinned to an immutable version, or verified using a publisher signature or known cryptographic checksum.

Although the URL uses HTTPS and appears associated with the declared Alibaba Cloud functionality, TLS only protects the current transport connection. It does not ensure that the script remains identical to the version reviewed with this Skill. The effective payload can change after publication of the Skill. Compromise of the hosting infrastructure, CDN, release process, DNS/TLS trust path, or upstream account could therefore turn this installation command into arbitrary code execution.

Installing or updating the Aliyun CLI is relevant to the Skill’s purpose, but immediate execution of mutable remote content exceeds the minimum necessary behavior. A package-manager installation or a versioned, integrity-verified artifact would provide the required functionality with less supply-chain risk.

Attack Path

1. An agent loads the Skill and follows its mandatory CLI pre-check.
2. The environment has no Aliyun CLI or has a version older than 3.3.3.
3. An attacker compromises or gains control over the remote installer, its publishing pipeline, CDN delivery, or a trusted network endpoint.
4. The attacker modifies setup.sh to include arbitrary shell commands.
5. curl retrieves the attacker-contr ...[truncated 1174 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | bash installation path.
2. Prefer an operating-system package manager with repository signature verification, such as a pinned Homebrew or distribution package release.
3. If direct installation is necessary:
   • Download a version-specific artifact rather than a mutable latest installer.
   • Obtain the expected SHA-256 or stronger digest through a separately authenticated release channel.
   • Verify the cryptographic digest before extraction or execution.
   • Verify a publisher signature where available.
   • Abort installation if any verification fails.
4. Save scripts or archives to a newly created private temporary directory and inspect them before execution.
5. Avoid elevated privileges unless installation into a protected location is explicitly required and approved by the user.
6. Require explicit user confirmation before installing or updating host-level tooling.
7. Document the exact expected version, artifact URL, checksum, publisher identity, destination path, and files modified by installation.
8. Do not automatically update the CLI or plugin during unrelated DataWorks operations; perform updates only when required for compatibility.

A safer conceptual workflow is:

bash

# Use an immutable version and a checksum supplied by the trusted release page.
curl -fL --proto '=https' --tlsv1.2 \
  -o aliyun-cli-VERSION.tgz \
  'https://TRUSTED_HOST/PINNED_VERSION/aliyun-cli.tgz'

printf '%s  %s\n' 'EXPECTED_SHA256' 'aliyun-cli-VERSION.tgz' | sha256sum -c -
# Continue only after successful verification and explicit approval.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence

Findings (229)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description describes a broad DataWorks automation skill with many management and orchestration capabilities. The supplied code chunk only contains a minimal shell script that echoes two lines and does not interact with DataWorks, workflows, Alibaba Cloud APIs, CLI tools, or any node/resource management functionality. This is a materially different and much narrower behavior than the declared purpose, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description describes a broad, feature-rich DataWorks management and orchestration skill with many mutating capabilities. The supplied code chunk is only a minimal manual workflow processing step that prints messages and the Python version. Its primary purpose is materially different from the declared functionality, and it does not implement any of the advertised DataWorks operations, integrations, or resource management behaviors.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Yes, this is a mismatch. The description claims a broad operational DataWorks skill with many management and orchestration capabilities, including mutating operations on nodes and workflows. The actual code chunk is only a trivial print statement and does not interact with DataWorks, Alibaba Cloud, workflows, files, UDFs, scheduling, CLI, or SDKs. Its primary behavior is materially different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad, mutation-capable DataWorks automation skill with extensive node/workflow management features and orchestration support. The actual code shown is only a minimal shell script that echoes a constant message and does not create, configure, validate, deploy, update, move, rename, or orchestrate anything. This is a materially different primary purpose from the declared description, so it is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a full-featured DataWorks operational skill with broad mutating and orchestration capabilities. The supplied code chunk is much narrower: it is a preprocessing/build script for FlowSpec JSON assembly from local files. Its only substantive actions are file discovery, property parsing, placeholder substitution, embedding code into the first node's script content, and basic validation for DI node JSON. This is not merely an implementation detail of the declared skill; it reflects a materially different primary purpose and far fewer capabilities than advertised. There are no undeclared dangerous behaviors, but the description significantly overstates what this code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code chunk’s behavior is narrowly scoped to validation. It reads local files, optionally validates against JSON Schema, checks directory structure and properties, validates DI JSON content, and reports validation results. There are no mutating operations, no remote API/CLI interactions, no deployment or orchestration logic, and no resource/UDF/component management. While validation is one capability mentioned in the description, the declared description substantially overstates the implemented functionality and primary purpose of this code chunk.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs piping a remotely fetched shell script directly into bash to install or update the Aliyun CLI. This is a classic supply-chain and remote code execution risk: if the remote host, TLS chain, CDN, or download path is compromised, the agent would execute attacker-controlled code on the host with the agent's privileges.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.

**Aliyun CLI Setup (execute before first use)**:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md

- [ ] No invented fields — Compare against the FlowSpec Anti-Patterns table above; remove any field not documented in `references/flowspec-guide.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 490)May include surrounding context.

md

- [ ] No invented fields — Compare against the FlowSpec Anti-Patterns table above; remove any field not documented in `references/flowspec-guide.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 392)May include surrounding context.

md

e prohibited. If an API call returns an error, first check [troubleshooting.md](references/troubleshooting.md); do not fall back to legacy APIs

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 393)May include surrounding context.

md

e prohibited. If an API call returns an error, first check [troubleshooting.md](references/troubleshooting.md); do not fall back to legacy APIs

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 495)May include surrounding context.

md

e prohibited. If an API call returns an error, first check [troubleshooting.md](references/troubleshooting.md); do not fall back to legacy APIs

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/nodetypes/controller/CONTROLLER_ASSIGNMENT.md (reported line 19)May include surrounding context.

md

**Key restriction**: Parameters can only be passed to **direct downstream (one level)** child nodes; cross-level passing is not supported.

## Supported Languages and Output Rules

| Language | script.language | Code File language Field | Output Rule | Transfer Format |
|----------|----------------|--------------------------|-------------|-----------------|

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · assets/templates/08-assignment-node/README.md (reported line 26)May include surrounding context.

md

## Supported Languages and Output Rules

| Language | script.language | Code File language Field | Output Rule | Transfer Format |
|----------|----------------|--------------------------|-------------|-----------------|
| MaxCompute SQL | `odps` | `"odps"` | The result of the last `SELECT` statement | 2D array `[["v1","v2"],["v3","v4"]]` |
| Python 2 | `python2` | `"python2"` | The output of the last `print` statement | 1D array `["v1","v2","v3"]` |

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/nodetypes/controller/CONTROLLER_ASSIGNMENT.md (reported line 21)May include surrounding context.

md

## Supported Languages and Output Rules

| Language | script.language | Code File language Field | Output Rule | Transfer Format |
|----------|----------------|--------------------------|-------------|-----------------|
| MaxCompute SQL | `odps` | `"odps"` | The result of the last `SELECT` statement | 2D array `[["v1","v2"],["v3","v4"]]` |
| Python 2 | `python2` | `"python2"` | The output of the last `print` statement | 1D array `["v1","v2","v3"]` |

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/nodetypes/data_integration/datasources/Amazon S3/Amazon S3-Destination.md (reported line 15)May include surrounding context.

md

| fileFormat | Text type, the file type to write to S3. | Y | csv | Y | Frontend default value: `csv`; Linkage logic: Switching fileFormat resets writeHeader status and notifies the column mapping component to update |
| object | S3 Object information (filename with path). For example, a.txt or aaa/bbb/cc.csv. | Y | None | Y | Required field |
| column | Column configuration for the output file. For csv/text, use numeric placeholders like `["0", "1"]`; for parquet/orc, configure name and type combinations. | Y | None | Y | Auto-generated by the column mapping component |
| writeMode | Prefix conflict handling strategy. | Y | truncate | Y | Frontend default value: `truncate` (replace existing files); Frontend options: `Replace existing files` → `truncate`, `Keep existing files` → `append`, `Exit with error` → `nonConflict` |
| fieldDelimiter | Field delimiter for writing. | Y when fileFormat is csv/text | , | Y | Display condition: fileFormat is csv or text; If the delimiter is not visible, please use Unicode encoding, such as `\u001b`, `\u007c`; Frontend default value: `,` |
| lineDelimiter | Line delimiter for writing. | Y when fileFormat is text | \n | Y | Display condition: fileFormat is text |
| encoding | Encoding format for the output file. | Y when fileFormat is csv/text | UTF-8 | Y | Display condition: fileFormat is csv or text; Frontend default value: UTF-8 |

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/nodetypes/data_integration/datasources/OSS/OSS-Destination.md (reported line 16)May include surrounding context.

md

| fileFormat | Text type, the file type to write to S3. | Y | csv | Y | Frontend default value: `csv`; Linkage logic: Switching fileFormat resets writeHeader status and notifies the column mapping component to update |
| object | S3 Object information (filename with path). For example, a.txt or aaa/bbb/cc.csv. | Y | None | Y | Required field |
| column | Column configuration for the output file. For csv/text, use numeric placeholders like `["0", "1"]`; for parquet/orc, configure name and type combinations. | Y | None | Y | Auto-generated by the column mapping component |
| writeMode | Prefix conflict handling strategy. | Y | truncate | Y | Frontend default value: `truncate` (replace existing files); Frontend options: `Replace existing files` → `truncate`, `Keep existing files` → `append`, `Exit with error` → `nonConflict` |
| fieldDelimiter | Field delimiter for writing. | Y when fileFormat is csv/text | , | Y | Display condition: fileFormat is csv or text; If the delimiter is not visible, please use Unicode encoding, such as `\u001b`, `\u007c`; Frontend default value: `,` |
| lineDelimiter | Line delimiter for writing. | Y when fileFormat is text | \n | Y | Display condition: fileFormat is text |
| encoding | Encoding format for the output file. | Y when fileFormat is csv/text | UTF-8 | Y | Display condition: fileFormat is csv or text; Frontend default value: UTF-8 |

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/nodetypes/data_integration/datasources/Elasticsearch/Elasticsearch-Destination.md (reported line 15)May include surrounding context.

md

| index | The index name in Elasticsearch. | Y | None | Y | Linkage logic: checks if the table already exists after selection; clears the type (index type) field when the index changes; prerequisite: index list can be fetched after a successful connection. |
| type | The type name of the index in Elasticsearch. | N | None | Y | Display condition: Displayed when an index is selected and the data source extension info `needElasticSearchType === true` (ES version below 7.0); Linkage logic: depends on the index value to fetch the type list, cleared when the index changes. |
| cleanup | Defines whether the current task should delete data when the index already exists. * Yes (true): Deletes the original index before importing data and recreates an index with the same name. This operation will delete the data under that index. * No (false): Retains the existing data in the index before importing data. | N | false | Y | Frontend options: `Yes` → `true`; `No` → `false`; Linkage logic: when "No" is selected, the deleteQueryDSL parameter is displayed in non-elastic environments. |
| deleteQueryDSL | Pre-import delete statement (JSON format DSL statement). | N | None | Y | Display condition: Displayed when `cleanup === false` (delete original index not selected); Validation rule: must be valid JSON. |
| actionType | Indicates the action type of Elasticsearch when writing data. Currently, Data Integration supports index and update actionType. The default value is index: * index: Uses the Index.Builder of the Elasticsearch SDK to construct batch requests at the underlying level. If no ID is specified, Elasticsearch will automatically generate a unique ID. If an ID is specified, it will update (replace the entire document). * update: Updates the document based on the user-specified ID. If the ID value does not exist in the index, the document is inserted; if it exists, the specified column fields are updated. When the action type is set to update, you need to set the primary key *
...[truncated 26 chars]

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/nodetypes/data_integration/datasources/FTP/FTP-Destination.md (reported line 20)May include surrounding context.

md

| encoding | The encoding configuration for writing files. | N | 'UTF-8' | Y | Frontend options: 'Use Database Encoding' (value is '', equivalent to not passing) and 150+ encoding list. |
| nullFormat | In text files, standard strings cannot define null (null pointer). Data Integration provides nullFormat to define which strings can represent null. | N | undefined (no processing) | Y | Three modes: no processing (value: undefined), visible characters (default 'null'), invisible characters (Unicode encoding). |
| dateFormat | The format for serializing date type data into files, for example "yyyy-MM-dd". | N | None | Y | |
| writeMode | FTP Writer data cleanup processing mode before writing: * truncate: Clears files with the same name in the directory before writing. * append: Does no processing before writing, directly writes using fileName, and ensures the file name does not conflict. * nonConflict: If there are files with the fileName prefix in the directory, an error is reported directly. | Y | 'truncate' | Y | Frontend options: 'truncate' → 'Replace Existing Files'; 'append' → 'Keep Existing Files'; 'nonConflict' → 'Exit with Error'. |
| markDoneFileName | Marker file name. A marker file is generated after the synchronization task completes. Based on this marker file, you can determine whether the synchronization task was successful. This should be configured as an absolute path. In offline periodic task scenarios, it is recommended that the marker file includes scheduling parameters. | N | None | Y | |
| timeout | FTP server connection timeout in milliseconds. | N | 60,000 | N | |
| skipHeader | CSV-like format files may have headers as titles that need to be skipped. By default, headers are not skipped. | N | 'false' | N | |

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/nodetypes/data_integration/datasources/Amazon S3/Amazon S3-Destination.md (reported line 15)May include surrounding context.

md

| path | The path information stored in the OSS-HDFS file system. OSS-HDFS Writer will write multiple files under the Path directory according to the concurrency configuration. When associating with a Hive table, please fill in the storage path of the Hive table on OSS-HDFS. | Y | None | Y | |
| fileFormat | The file type. Currently, only text, orc, and parquet are supported for your configuration. * text: Indicates the file write type is text file format. * orc: Indicates the file write type is ORC file format. * parquet: Indicates the file write type is parquet file format. | Y | None | Y | Frontend options: 'text'/'orc'/'parquet'; linkage logic: when fileFormat is 'text', fieldDelimiter is displayed; when 'orc' or 'parquet', fieldDelimiter is hidden. |
| fileName | The file name when OSS-HDFS Writer writes. During actual execution, a random suffix will be added to this file name as the actual file name written by each thread. | Y | None | Y | |
| writeMode | OSS-HDFS Writer pre-write data cleanup processing mode: * append: No processing before writing. Data integration OSS-HDFS Writer directly uses filename for writing and ensures no file name conflicts. * nonConflict: If there are files with the fileName prefix in the directory, an error is reported directly. * truncate: Before writing, clears all files matching the fileName prefix. | Y | None | Y | Frontend options: 'append' → 'Keep original files'; 'truncate' → 'Replace existing files'; 'nonConflict' → 'Exit with error'. Parquet format only supports nonConflict. |
| fieldDelimiter | The field delimiter when OSS-HDFS Writer writes. Only single-character delimiters are supported. Entering multiple characters will cause a runtime error. | N | ',' | Y | Display condition: displayed when fileFormat is 'text'; supports Unicode encoding input (such as \u001b, \u007c). |
| encoding | The encoding configuration for writing files. | N | 'UTF-8' | Y | |
| column | The fields of the data to be written. Writing to partial 
...[truncated 25 chars]

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/nodetypes/data_integration/datasources/OSS-HDFS/OSS-HDFS-Destination.md (reported line 15)May include surrounding context.

md

| path | The path information stored in the OSS-HDFS file system. OSS-HDFS Writer will write multiple files under the Path directory according to the concurrency configuration. When associating with a Hive table, please fill in the storage path of the Hive table on OSS-HDFS. | Y | None | Y | |
| fileFormat | The file type. Currently, only text, orc, and parquet are supported for your configuration. * text: Indicates the file write type is text file format. * orc: Indicates the file write type is ORC file format. * parquet: Indicates the file write type is parquet file format. | Y | None | Y | Frontend options: 'text'/'orc'/'parquet'; linkage logic: when fileFormat is 'text', fieldDelimiter is displayed; when 'orc' or 'parquet', fieldDelimiter is hidden. |
| fileName | The file name when OSS-HDFS Writer writes. During actual execution, a random suffix will be added to this file name as the actual file name written by each thread. | Y | None | Y | |
| writeMode | OSS-HDFS Writer pre-write data cleanup processing mode: * append: No processing before writing. Data integration OSS-HDFS Writer directly uses filename for writing and ensures no file name conflicts. * nonConflict: If there are files with the fileName prefix in the directory, an error is reported directly. * truncate: Before writing, clears all files matching the fileName prefix. | Y | None | Y | Frontend options: 'append' → 'Keep original files'; 'truncate' → 'Replace existing files'; 'nonConflict' → 'Exit with error'. Parquet format only supports nonConflict. |
| fieldDelimiter | The field delimiter when OSS-HDFS Writer writes. Only single-character delimiters are supported. Entering multiple characters will cause a runtime error. | N | ',' | Y | Display condition: displayed when fileFormat is 'text'; supports Unicode encoding input (such as \u001b, \u007c). |
| encoding | The encoding configuration for writing files. | N | 'UTF-8' | Y | |
| column | The fields of the data to be written. Writing to partial 
...[truncated 25 chars]

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/nodetypes/database/CLICK_SQL.md (reported line 54)May include surrounding context.

md

## Restrictions

- SQL syntax must comply with ClickHouse SQL specifications
- ClickHouse does not support standard UPDATE and DELETE statements; use ALTER TABLE ... UPDATE/DELETE (Mutation operations) instead
- Only one SQL statement can be executed at a time
- Execution timeout is limited by the data source configuration
- ClickHouse has limited transaction support; pay attention to data consistency

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/nodetypes/general/DATA_PUSH.md (reported line 29)May include surrounding context.

md

- Teams: up to 28 KB.
  - Email: one message body only.
- Supported only in a limited set of regions (China East 1 / Hangzhou, China East 2 / Shanghai, China North 2 / Beijing, and several others).
- The channel webhook URL, signing secret, and any access token are bound to the node via the platform UI. **Do not** hard-code credentials into any field that is committed to source.

## Schema

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/nodetypes/general/DATA_PUSH.md (reported line 54)May include surrounding context.

md

- Teams: up to 28 KB.
  - Email: one message body only.
- Supported only in a limited set of regions (China East 1 / Hangzhou, China East 2 / Shanghai, China North 2 / Beijing, and several others).
- The channel webhook URL, signing secret, and any access token are bound to the node via the platform UI. **Do not** hard-code credentials into any field that is committed to source.

## Schema

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/nodetypes/general/FUNCTION_COMPUTE.md (reported line 66)May include surrounding context.

md

| `invocationType` | `Sync` \| `Async` | yes | Invocation mode. `Async` enqueues the invocation and returns as soon as FC accepts it (the DataWorks node succeeds once the enqueue is acknowledged). `Sync` waits for the FC function to complete and reflects the function's outcome in the node's run status. Pick `Sync` when the downstream flow must gate on the FC function having actually finished. |
| `eventBody` | string | yes | The event payload delivered to the FC function. It is a **JSON string** (the inner document is itself JSON, serialized). The inner document may use `${var}` placeholders referencing node parameters or built-in system parameters (e.g. `${bizdate}`); they are substituted before the invocation is made. |

**Authentication**: FC access credentials are resolved by DataWorks from the node's configured connection / data source, **not** from any inline credential material in the spec. Do not place secrets inside `script.content`.

**Output extraction**: the node does not automatically parse the FC function's response into FlowSpec variables. If downstream nodes need to consume data produced by the FC function, have the function persist the result to a shared store (a table, an object store, a queue) and have the downstream node read it from there. The Function Compute node's own output is status-only: it signals whether the invocation succeeded.

Static analysis

No suspicious patterns detected.