Alibabacloud Dlf Manage

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 0.0.1

Overview

The skill is mostly a read-only Alibaba Cloud DLF metadata query tool, but its install instructions claim a pinned dependency file that is missing and the fallback install path uses unpinned packages.

Review before installing. Use an isolated virtual environment, add or obtain a pinned requirements.txt before exposing Alibaba Cloud credentials, and grant only the listed read-only DLF permissions to the credentials used by this skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Missing Dependency Manifest and Unversioned Package Installation Fallback

Content

View full analysis

**Pre-check: Python SDK dependency** ``` `scripts/dlf_metadata_query.py:17-25`: ```python try: from alibabacloud_tea_openapi.models import Config from alibabacloud_dlfnext20250310.client import Client from alibabacloud_dlfnext20250310 import models as dlf_models from alibabacloud_credentials.client import Client as CredentialClient from Tea.exceptions import TeaException except ImportError: print(json.dumps({ "error": "SDK not installed", "hint": "Run: pip install alibabacloud-dlfnext20250310 alibabacloud-credentials" })) ``` ### Technical Analysis The project documentation states that `requirements.txt` contains a pinned transitive dependency closure, but the audited project root contains only `SKILL.md`, `references/`, and `scripts/`; the referenced manifest is absent. When an import fails, the executable script recommends installing `alibabacloud-dlfnext20250310` and `alibabacloud-credentials` without version or integrity constraints. Consequently, package resolution depends on whichever releases and transitive dependencies are available from the configured package index at installation time. Python packages can execute arbitrary code during installation, import, or normal operation. Installing unconstrained packages in an environment containing Alibaba Cloud credentials therefore creates a supply-chain exposure. This does not demonstrate that the named Alibaba Cloud packages are malicious; the risk arises from the lack of re ...[truncated 1731 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

> **IMPORTANT: Parameter Confirmation** — Before invoking the API,
> the following user-specific parameters must be confirmed with the user; do not assume them.
> Region defaults to cn-hangzhou; if the user does not specify one, use the default without asking.

| Parameter | Required | Description | Default |
|------|------|------|--------|

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/dlf_metadata_query.py (reported line 174)May include surrounding context.

python

try:
        return Client(config)
    except Exception as e:
        out_error(f"Failed to create DLF client: {e}",
                  "Check credentials and region.")

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

This is a markdown file, so SQP-2 applies to missing warnings in documentation about behaviors affecting privacy or system integrity. The reference tells users the APIs use AK signature authentication and later advises checking AK/SK on authentication failure, but it does not include any caution about protecting credentials or avoiding exposing them in logs or shared contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This code initializes cloud credentials and constructs a remote DLF API client, which will send authentication material and catalog/database/table query parameters to Alibaba Cloud endpoints. While the module docstring says the tool is a read-only CLI, there is no explicit user-facing warning in the code comments/help text that cloud metadata and credential-backed requests will be transmitted over the network.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/dlf_metadata_query.py (reported line 182)May include surrounding context.

python

"""Generic serializer: extract non-None attributes from an SDK object."""
    result = {}
    for a in attrs:
        v = getattr(obj, a, None)
        if v is not None:
            result[a] = v
    return result

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/dlf_metadata_query.py (reported line 209)May include surrounding context.

python

for i, f in enumerate(fields)
            ]
        for key in ("partition_keys", "primary_keys", "options", "comment"):
            val = getattr(schema, key, None)
            if val is not None:
                schema_dict[key] = val
        result["schema"] = schema_dict