ClawHub
Back to skill

Security audit

Alibabacloud Dataworks Metadata

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and mostly well controlled, but it asks users to grant broad account-wide Alibaba Cloud DataWorks metadata permissions that include write actions.

Review before installing. Use a dedicated low-privilege Aliyun identity, prefer the read-only policy unless writes are truly needed, and narrow RAM resources or conditions to approved projects/workspaces wherever Alibaba Cloud supports it. Treat every write confirmation carefully because the suggested write policy can alter DataWorks metadata broadly even though it cannot delete resources.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
references/ram-policies.md:9
Finding

Account-Wide RAM Resource Scope Exceeds Least Privilege

Content
View full analysis

Vulnerability Details

File Location: references/ram-policies.md:9-39 and references/ram-policies.md:49-83
Vulnerability Type: Overly broad cloud access policy
Risk Level: Medium

Vulnerable Code

Policy A grants read access across every applicable resource:

json
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dataworks:ListCrawlerTypes",
        "dataworks:ListCatalogs",
        "dataworks:GetCatalog",
        "dataworks:GetDatabase",
        "dataworks:GetTable",
        "dataworks:ListColumns",
        "dataworks:GetColumn",
        "dataworks:ListPartitions",
        "dataworks:GetPartition",
        "dataworks:ListLineages",
        "dataworks:ListLineageRelationships",
        "dataworks:GetLineageRelationship",
        "dataworks:ListDatasets",
        "dataworks:GetDataset",
        "dataworks:ListDatasetVersions",
        "dataworks:GetDatasetVersion",
        "dataworks:PreviewDatasetVersion",
        "dataworks:ListMetaCollections",
        "dataworks:GetMetaCollection",
        "dataworks:ListEntitiesInMetaCollection"
      ],
      "Resource": "*"
    }
  ]
}

Policy B grants read and mutation access across every applicable resource:

json
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dataworks:ListCrawlerTypes",
        "dataworks:ListCatalogs",
        "dataworks:GetCatalog",
        "dataworks:GetDatabase",
        "dataworks:GetTable",
        "dataworks:UpdateTableBusinessMetadata",
        "dataworks:ListColumns",
        "dataworks:GetColumn",
        "dataworks:UpdateColumnBusinessMetadata",
        "dataworks:ListPartitions",
        "dataworks:GetPartition",
        "dataworks:ListLineages",
        "dataworks:ListLineageRelationships",
        "dataworks:GetLineageRelationship",
        "dataworks:CreateLineageRelationship",
        "dataworks:CreateDataset",
        "dataworks:ListDatasets",
        "dataworks
...[truncated 3121 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace "Resource": "*" with explicit resource identifiers for the approved projects, workspaces, datasets, and metadata objects wherever the corresponding DataWorks API supports resource-level authorization.
  2. Separate read-only and write identities. Use the read-only policy by default and activate a narrowly scoped write identity only for confirmed write operations.
  3. Separate permissions by workflow rather than granting all non-destructive writes together. For example, dataset maintenance should not automatically grant lineage and metadata-collection mutation rights.
  4. If particular list operations or APIs require "Resource": "*", isolate those actions into a separate statement and document the Alibaba Cloud authorization limitation. Keep all resource-scopable actions restricted.
  5. Use a dedicated low-privilege RAM user or role for the Skill instead of a broadly privileged human or administrative profile.
  6. Add conditions supported by RAM, such as project, workspace, region, source identity, or session constraints, where applicable.
  7. Retain the existing user-confirmation, idempotency, timeout, and no-deletion safeguards as defense in depth, but do not rely on them as substitutes for IAM enforcement.
  8. Periodically audit CloudTrail or equivalent Alibaba Cloud action logs for unexpected metadata reads and writes performed by the Skill identity.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
> **Aliyun CLI >= 3.3.3 required** — Run `aliyun version` to verify the version is `>= 3.3.3`. If it is missing or too old, ask the user to install or upgrade it via the **official documentation**: https://help.aliyun.com/document_detail/121541.html (or see `references/cli-installation-guide.md`).
>
> **[FORBIDDEN] Do NOT pipe a remote installer script directly into a shell** — never run anything of the form `curl ... | bash` / `curl ... | sh` / `wget ... | bash`. Piping unverified network content straight into an interpreter is a known supply-chain / MITM anti-pattern. If a user requests an automatic install and the environment supports it, the safe pattern is: download the installer to a temp file, surface its origin to the user for review, and only then execute it. Otherwise, defer to the official package manager / installer URL above.
>
> **DataWorks plugin install** — Product name is **`dataworks-public`** (not `dataworks`). Run install directly; modern Aliyun CLI fetches the plugin on demand without any prior configuration toggle:
> ```bash

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
> **Aliyun CLI >= 3.3.3 required** — Run `aliyun version` to verify the version is `>= 3.3.3`. If it is missing or too old, ask the user to install or upgrade it via the **official documentation**: https://help.aliyun.com/document_detail/121541.html (or see `references/cli-installation-guide.md`).
>
> **[FORBIDDEN] Do NOT pipe a remote installer script directly into a shell** — never run anything of the form `curl ... | bash` / `curl ... | sh` / `wget ... | bash`. Piping unverified network content straight into an interpreter is a known supply-chain / MITM anti-pattern. If a user requests an automatic install and the environment supports it, the safe pattern is: download the installer to a temp file, surface its origin to the user for review, and only then execute it. Otherwise, defer to the official package manager / installer URL above.
>
> **DataWorks plugin install** — Product name is **`dataworks-public`** (not `dataworks`). Run install directly; modern Aliyun CLI fetches the plugin on demand without any prior configuration toggle:
> ```bash

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
> **Aliyun CLI >= 3.3.3 required** — Run `aliyun version` to verify the version is `>= 3.3.3`. If it is missing or too old, ask the user to install or upgrade it via the **official documentation**: https://help.aliyun.com/document_detail/121541.html (or see `references/cli-installation-guide.md`).
>
> **[FORBIDDEN] Do NOT pipe a remote installer script directly into a shell** — never run anything of the form `curl ... | bash` / `curl ... | sh` / `wget ... | bash`. Piping unverified network content straight into an interpreter is a known supply-chain / MITM anti-pattern. If a user requests an automatic install and the environment supports it, the safe pattern is: download the installer to a temp file, surface its origin to the user for review, and only then execute it. Otherwise, defer to the official package manager / installer URL above.
>
> **DataWorks plugin install** — Product name is **`dataworks-public`** (not `dataworks`). Run install directly; modern Aliyun CLI fetches the plugin on demand without any prior configuration toggle:
> ```bash

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list contains generic phrases such as "dataset", "catalog", "table info", "column info", and "partition", which are common terms that may appear in ordinary user requests outside the intended DataWorks metadata context. Because the activation criteria are presented as a flat list without exclusions or narrower context constraints, the skill risks matching unrelated conversations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.