Security audit
Security checks for vulnerabilities and agentic risk
This read-only billing skill needs review because it includes unrelated purchases, can misidentify idle databases, and gives incomplete advice about disruptive changes.
Use a dedicated read-only cloud profile and keep billing reports private. Request database-only order filtering and corrected missing-measurement handling before relying on audit results. Independently verify release recommendations, preserve required backups and audit logging, and review [PolarDB unsubscription rules](https://www.alibabacloud.com/help/en/polardb/polardb-for-mysql/unsubscribe-instructions) before cancelling a cluster.
The reported unfiltered order retrieval and analysis would expose unrelated cloud purchase information to a database-only audit and could misattribute unrelated renewal anomalies. This is a data-minimization and scope-control issue, not evidence of resource mutation or external exfiltration; the underlying order-analysis code was not included for independent verification.
The FAQ presents unsubscribing and repurchasing an entire PolarDB cluster as a storage-billing workaround without explaining potential downtime or data-loss consequences. Although the skill does not execute this change, users following its manual advice could disrupt production or lose data without a verified migration and recovery plan.
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
## Absolute Rules
1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating API — e.g. `Modify*`, `Delete*`, `Create*`, `Restart*`, `Release*`, `Upgrade*`, `Downgrade*`, or any configuration/spec change on database resources. This includes commands "for the user to run manually". If the user asks to downgrade, release, or resize an instance to cut cost, only output the manual guidance and declare this skill is read-only.
2. **API WHITELIST:** The only permitted OpenAPI actions are the read-only BSS queries `DescribeInstanceBill`, `DescribeSplitItemBill`, `QueryOrders`, and `QueryAvailableInstances` (bssopenapi, endpoint `business.aliyuncs.com`, API version `2017-12-14`), the read-only CloudMonitor query `DescribeMetricList` (cms), plus `sts:GetCallerIdentity` for identity traceability. Any other action is forbidden.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or p
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
; optional for account-level trend analysis, where instances are auto-discovered from the bill itself.
- **Product filter** (`--product`): optional; one of `rds|dds|kvstore|polardb|dts|cbs|cdt`. When an instance ID is given, the DB product is auto-inferred from its prefix (`rm-` RDS, `r-` Redis, `dds-` MongoDB, `pc-` PolarDB, etc.), so no extra question is needed; CDT is an account-level transfer product, so pass `--product cdt` explicitly when its charges are in question.
- **UID**: can always be omitted — it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (billing cycle, product, or UID), the Agent MUST explicitly declare this in the response or report metadata, e.g. "Billing cycle auto-defaulted to the current month (2026-08)" or "Product auto-inferred from instance prefix: ApsaraDB RDS".
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Error | Cause | Resolution |
|-------|-------|------------|
| No credentials found | Default credential chain not configured | Run `aliyun configure`; never ask the user for AK/SK |
| `NoPermission` / `AccessDenied` | RAM policy missing a BSS read permission | Record the missing action, continue with remaining queries, point to [references/ram-policies.md](references/ram-policies.md) |
| `InvalidParameter` / invalid billing cycle | Wrong cycle format or out-of-range month | Log `[WARN]`, verify `YYYY-MM` format, continue |
| `Throttling.User` | Request rate limited | Retried automatically with backoff (up to 3 attempts); then log `[WARN]` and continue |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## 1. Deleted / released instance still billed (most frequent)
**Q: My instance was deleted/released. Why am I still being charged?**
A: Releasing an instance does not automatically delete its backups. The three
most common causes:
1. **Backup retention policy of the deleted instance** -- "keep last
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
by temporary files from slow queries (see below), so check the root cause
first.
**Q: Auto performance scaling: how is it billed?**
A: It steps up within the same spec family (e.g. 2C4G -> 2C8G), billed by
the second at the higher spec while active, and scales back automatically
when load drops (the scale-back is not refunded).
The checklist recommends closing unused SQL audit without requiring validation of security, investigation, or compliance requirements. Following this advice could create an audit-coverage gap and eliminate evidence needed to investigate database misuse, even though the skill itself remains read-only.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd += [_param_flag(product, key, plugin_style), str(value)]
try:
result = subprocess.run(
cmd,
capture_output=True,
text=True,
When a returned datapoint lacks both Average and Value, the parser appends a fabricated zero, and the resulting nonempty list is treated as evidence of real metric coverage. This can incorrectly classify an instance as idle and generate release or downscale recommendations; the read-only implementation limits direct damage, but users or downstream agents could act on misleading results.
QueryOrders retrieves account-wide order history, and no subsequent database-product filter is applied before renewal, anomaly, and engine-version analysis. Consequently, a database-only audit can expose unrelated order identifiers, prices, and payment statuses in its output and attribute unrelated charges to database renewals; read-only access prevents modifications but does not prevent this scope expansion.
No suspicious patterns detected.