Security audit

Alibabacloud Dataworks Workspace Manage

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate DataWorks management skill, but its setup guidance can grant broader Alibaba Cloud permissions than the skill says it should use.

Review before installing. Use a dedicated least-privilege RAM user or role, remove dataworks:UpdateProject from copied policies, avoid AliyunDataWorksFullAccess unless truly necessary, do not install unrelated Alibaba Cloud plugins for this skill, and explicitly verify the region, workspace, target user, and role codes before any mutating command.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file materially exceeds the stated DataWorks workspace-management scope by teaching generic Aliyun CLI installation, authentication, plugin management, and cross-service operations. In an agent skill, this broadens operator capabilities and increases the chance the skill is used to obtain or apply credentials for unrelated services, expanding abuse surface beyond the advertised purpose.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: This section documents cross-account and elevated-access credential modes such as RamRoleArn and RamRoleArnWithEcs that are not necessary for routine workspace management. In the context of an automation skill, providing these patterns can facilitate privilege expansion, lateral movement, or unauthorized operations if the skill or its users are compromised.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The document explicitly states that `dataworks:UpdateProject` is prohibited and must be performed manually via the console, but the custom policy example later grants that permission. This contradiction can cause operators to copy a policy that enables a higher-risk action the skill claims to disallow, undermining least-privilege controls and governance expectations.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrases include very broad terms such as 'workspace' and 'DataWorks', which can cause the skill to activate for ambiguous requests. In a skill that can create workspaces and grant roles, overbroad activation increases the chance of unintended privileged operations or the wrong skill handling a request.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill description says it manages members and role authorization but does not prominently warn that these actions modify access control and can grant significant privileges. In this context, missing an explicit access-change warning makes unsafe or accidental privilege assignment more likely, especially because the skill supports admin and owner-adjacent role operations.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The guide shows long-lived access keys passed directly on the command line and via environment variables, while also noting storage in a local config file, but it does not warn about shell history, process-list visibility, CI log leakage, or plaintext persistence. In practice this can expose cloud credentials to other local users, logging systems, build pipelines, or malware, leading to account compromise.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The section recommends attaching `AliyunDataWorksFullAccess`, which is a broad system policy, without a nearby warning that it grants substantially more privilege than the skill's stated allowed operations require. In a workspace-management skill, readers are likely to follow examples directly, so presenting full access as a simple option increases the chance of unnecessary overprivilege.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The custom policy creation example includes `dataworks:UpdateProject`, even though the document marks that action as prohibited, and it is presented as a ready-to-use sample with no warning not to apply it directly. Because this is an executable IAM policy example, users may deploy it verbatim and grant modification capability that bypasses the documented operational restriction.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.