alibabacloud-ddos-origin-exposure-detector

• Outcome: Review
• Latest audit: Aug 25, 2026 · 12:21 PM UTC
• Version: 0.0.1

Overview

This skill has a coherent security-scanning purpose, but it also asks the agent to modify the local Aliyun CLI/plugin setup and includes risky credential/setup guidance that deserves manual review before installation.

Install only if you are comfortable with a skill that uses your existing Aliyun profile, may create pay-as-you-go CloudMonitor probe tasks, and can actively probe origin IPs. Before running it, avoid pasting access keys into commands or chat, review any CLI/plugin install or update step manually, and prefer least-privilege RAM credentials or temporary credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill clearly uses shell execution, environment access, and file writes, but the metadata does not declare those capabilities or required permissions. That mismatch weakens review and consent boundaries, making it easier for a caller to invoke a skill that performs higher-impact actions than its manifest suggests.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger list contains broad phrases like 'DescribeWebRules', 'probe origin server', and related generic monitoring language that could activate this skill during unrelated conversations. Because the skill can run shell commands, call cloud APIs, and probe network targets, accidental activation increases the risk of unintended scans, charges, or data handling.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide shows non-interactive commands with inline access-key material, which can leak secrets through shell history, process listings, terminal logs, CI logs, and plaintext local storage. In the context of a security-focused skill, normalizing direct secret entry without strong warnings is more dangerous because users may run these commands in shared or automated environments.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

> Run these checks now. If any fails, pause and ask the user to fix before continuing to Step 1.

1. **CLI version**: `aliyun version` — must be >= 3.3.3. If not: `/bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh)"` or `aliyun upgrade` (CLI >= 3.3.5). See `references/cli-installation-guide.md`.
2. **Plugin auto-install**: `aliyun configure set --auto-plugin-install true`, then `aliyun plugin update`.
3. **Credentials**: `aliyun configure list` — confirm a valid profile (AK/STS/OAuth). **NEVER** read/echo/print AK/SK values; **NEVER** ask the user to input credentials in conversation. If no valid profile: stop, ask user to configure credentials outside this session, then re-run.

• Confidence: 95% confidence
• Finding: The skill instructs the agent to execute a remote install command via '/bin/bash -c "$(curl ... setup.sh)"' and to enable automatic plugin installation/update. Piping remote content directly into a shell and auto-installing plugins creates a supply-chain and arbitrary code execution risk if the remote source, transport, or plugin path is compromised.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

2. Use `DescribeWebRules` for layer-7 (domain/CNAME/origin/port/RsType) and `DescribeNetworkRules` for layer-4 (port/origin/protocol); merge both into the detection checklist.
3. **Fetching probe results MUST use `DescribeSiteMonitorLog` (includes per-probe-point resolved IP, HTTP status code); do NOT use `DescribeSiteMonitorData` — it only returns aggregate availability, without the resolved IP and status code, so it cannot support a verdict.**
4. **Handle cloud-probe failures per the Cloud Probe Error Handling Decision Tree** (Type A service-not-activated → local fallback; Type B plugin parse bug → remediation ladder then local; Type C throttling → backoff then list-as-failed). Never fall back to local unconditionally; on final local fallback, warn that IPv6 origins cannot be probed (mark not detected).
5. **Local HTTP probing must bind Host with `curl --resolve <domain>:<port>:<origin-ip>`** (equivalent to the cloud probe options-json `header:"Host: ..."` field), otherwise the origin's Host-based routing mis-returns 4xx and causes a miss; add `-k` for HTTPS origins with mismatched certs to judge connectivity + status code only.
6. **Probing has execution latency**: after creating a task, poll for logs (recommend every 5s, up to 6 times); keep waiting while `Data` is empty, to avoid fetching too early and getting an empty result.
7. **Pick probe method by onboarding type and protocol**: domain onboarding (layer-7) uses HTTP probing + bound Host header, inspect 2xx/3xx; port onboarding (layer-4) by the `Protocol` field: tcp uses TCP probing (inspect handshake), udp uses UDP probing (inspect whether port unreachable is received). UDP reliability is lower than TCP; note this in the report.
8. **When the origin is a domain (RsType=1), resolve it to an IP with local `dig +short` first** before probing; do not resolve via cloud probe (avoid resolving too many IPs that complicate probing).

• Confidence: 78% confidence
• Finding: The skill directs local probing with curl '--resolve' and similar network tools against origin IPs, which can be safe in this niche but still represents high-impact tool parameterization because it initiates active network access to potentially sensitive targets. In context, the purpose is legitimate detection, but misuse or accidental activation could scan arbitrary hosts and bypass normal DNS-based routing assumptions.

Static analysis

No suspicious patterns detected.