Alibabacloud Dlf Manage

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 0.0.1

Overview

The skill is mostly a read-only Alibaba Cloud DLF metadata query tool, but its install instructions claim a pinned dependency file that is missing and the fallback install path uses unpinned packages.

Review before installing. Use an isolated virtual environment, add or obtain a pinned requirements.txt before exposing Alibaba Cloud credentials, and grant only the listed read-only DLF permissions to the credentials used by this skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39
• Finding: Missing Dependency Manifest and Unversioned Package Installation Fallback<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:39-49` - `scripts/dlf_metadata_query.py:17-25` **Vulnerability Type**: Unpinned third-party dependencies and missing dependency manifest **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:39-49`: ```markdown ## Installation ```bash pip install -r requirements.txt ``` `requirements.txt` pins the full transitive dependency closure (including `alibabacloud-dlfnext20250310==3.0.0`) for reproducible installs. > **Pre-check: Python SDK dependency** ``` `scripts/dlf_metadata_query.py:17-25`: ```python try: from alibabacloud_tea_openapi.models import Config from alibabacloud_dlfnext20250310.client import Client from alibabacloud_dlfnext20250310 import models as dlf_models from alibabacloud_credentials.client import Client as CredentialClient from Tea.exceptions import TeaException except ImportError: print(json.dumps({ "error": "SDK not installed", "hint": "Run: pip install alibabacloud-dlfnext20250310 alibabacloud-credentials" })) ``` ### Technical Analysis The project documentation states that `requirements.txt` contains a pinned transitive dependency closure, but the audited project root contains only `SKILL.md`, `references/`, and `scripts/`; the referenced manifest is absent. When an import fails, the executable script recommends installing `alibabacloud-dlfnext20250310` and `alibabacloud-credentials` without version or integrity constraints. Consequently, package resolution depends on whichever releases and transitive dependencies are available from the configured package index at installation time. Python packages can execute arbitrary code during installation, import, or normal operation. Installing unconstrained packages in an environment containing Alibaba Cloud credentials therefore creates a supply-chain exposure. This does not demonstrate that the named Alibaba Cloud packages are malicious; the risk arises from the lack of re ...[truncated 1731 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add the documented `requirements.txt` to the distributed project. 2. Pin every direct and transitive dependency to reviewed versions, including: - `alibabacloud-dlfnext20250310` - `alibabacloud-credentials` - `alibabacloud-tea-openapi` - All dependencies recursively required by those packages. 3. Record cryptographic hashes for every distribution and install with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Generate the locked manifest through a reproducible dependency-locking process and review updates before accepting them. 5. Replace the unversioned fallback command in `dlf_metadata_query.py` with a reference to the integrity-checked manifest: ```python "hint": "Run: python3 -m pip install --require-hashes -r requirements.txt" ``` 6. Use an explicitly trusted package index and disable untrusted supplemental indexes to reduce dependency-confusion risk. 7. Install dependencies in an isolated virtual environment before exposing cloud credentials to the process. 8. Run dependency vulnerability and provenance checks in CI, and fail packaging if the locked manifest is missing. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

> **IMPORTANT: Parameter Confirmation** — Before invoking the API,
> the following user-specific parameters must be confirmed with the user; do not assume them.
> Region defaults to cn-hangzhou; if the user does not specify one, use the default without asking.

| Parameter | Required | Description | Default |
|------|------|------|--------|

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

try:
        return Client(config)
    except Exception as e:
        out_error(f"Failed to create DLF client: {e}",
                  "Check credentials and region.")

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: This is a markdown file, so SQP-2 applies to missing warnings in documentation about behaviors affecting privacy or system integrity. The reference tells users the APIs use AK signature authentication and later advises checking AK/SK on authentication failure, but it does not include any caution about protecting credentials or avoiding exposing them in logs or shared contexts.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: This code initializes cloud credentials and constructs a remote DLF API client, which will send authentication material and catalog/database/table query parameters to Alibaba Cloud endpoints. While the module docstring says the tool is a read-only CLI, there is no explicit user-facing warning in the code comments/help text that cloud metadata and credential-backed requests will be transmitted over the network.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

"""Generic serializer: extract non-None attributes from an SDK object."""
    result = {}
    for a in attrs:
        v = getattr(obj, a, None)
        if v is not None:
            result[a] = v
    return result

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

for i, f in enumerate(fields)
            ]
        for key in ("partition_keys", "primary_keys", "options", "comment"):
            val = getattr(schema, key, None)
            if val is not None:
                schema_dict[key] = val
        result["schema"] = schema_dict

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Static analysis

No suspicious patterns detected.