alibabacloud-dns-resolve-diagnose-customer

• Outcome: Review
• Latest audit: Jul 29, 2026 · 1:07 PM UTC
• Version: 0.0.1

Overview

The skill is mostly a read-only DNS diagnostic tool, but it asks for broad credentialed cloud access and local CLI/plugin changes that users should review carefully before installing.

Install only if you are comfortable with Alibaba Cloud read-only DNS/GTM/PrivateZone access, public resolver queries, and boce.aliyun.com receiving the domains being tested. Use a least-privilege read-only RAM role, avoid broad or persistent access keys, disable or review automatic plugin updates, and do not use it for sensitive internal hostnames without confirming where probes will be sent.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

def _extract_root_domain(domain: str) -> str:
    """Extract root domain from full domain (strip subdomain prefix)."""
    # Use dns_common's splitting logic
    sys.path.insert(0, str(__import__("pathlib").Path(__file__).parent))
    try:
        from dns_common import split_domain
        candidates = split_domain(domain)

• Confidence: 79% confidence
• Finding: The code mutates sys.path at runtime and then imports dns_common from that injected path, which can create a module-hijacking surface if an attacker can influence the filesystem contents of the script directory. While this is often done for local package convenience, it weakens import trust boundaries and can cause unintended code execution from a spoofed module.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill invokes shell commands, reads files under references/, and accesses environment-based credentials, but does not declare permissions or capability boundaries. This creates a governance gap: an agent/runtime may grant broader access than users or reviewers expect, increasing the chance of unsafe command execution or unintended credential/context exposure during troubleshooting.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill is described as a read-only DNS diagnostic tool, but the reference includes STS AssumeRole instructions that enable acquisition of temporary cloud credentials. Even if the intended use is limited, documenting credential acquisition expands the skill’s operational scope and can enable privilege escalation or accidental secret exposure if users or downstream agents follow it.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Obtaining temporary cloud credentials is context-inappropriate for a customer-facing DNS diagnosis skill whose stated function is read-only troubleshooting. In this context, credential acquisition is more dangerous because users may treat the skill as low risk and unwittingly expose or over-delegate access beyond simple diagnostics.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This reference guide substantially exceeds the stated scope of a read-only DNS diagnostic skill by teaching full Alibaba Cloud CLI setup, authentication modes, profile management, service invocation, and plugin expansion. In an agent-skill context, broad operational documentation can normalize or enable credentialed access and non-diagnostic actions, undermining least privilege and increasing the chance that the skill is used as a stepping stone for wider account access.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The document includes multiple examples for provisioning persistent account credentials, including access keys, role assumption, and stored profiles, even though the skill is described as read-only DNS diagnostics. In this context, encouraging broad credential configuration is dangerous because it can lead operators or automated systems to grant durable, overly privileged cloud access that is unnecessary for the task and could be abused if the environment or skill chain is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Plugin installation instructions expand the CLI with arbitrary product capabilities such as ECS, VPC, and RDS, which are unrelated to the declared DNS-diagnostic purpose. In an agent or operator workflow, this widens the available attack surface and can facilitate drift from read-only DNS troubleshooting into broader cloud enumeration or administration.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The documented `aliyun sts assume-role` command introduces credential acquisition and cross-account access capability into a skill explicitly described as read-only DNS diagnostics. Even if the command itself does not directly modify resources, obtaining temporary credentials expands privilege boundaries and could enable access beyond the skill’s stated purpose if an agent or operator follows the documentation blindly.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The file implements HTTP probing against user-supplied targets, which expands behavior beyond a narrowly described DNS-diagnostic capability and causes outbound requests to arbitrary domains via a third-party platform. In a read-only diagnostic skill this is still not a write action, but it increases data exposure and scanning capability, especially if users believe only DNS-layer checks will occur.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is presented as a DNS diagnostic tool, but the implementation supports broad account-wide enumeration of domains, DNS records, GTM instances, and PrivateZone assets. In a diagnostic context, this expands data exposure beyond a single user-requested domain and can leak internal inventory or configuration information if the skill is invoked with broad queries.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code assumes roles via STS for cross-account access even though the skill is described as a read-only DNS diagnostic helper. Cross-account role assumption materially broadens reachable data and trust boundaries; if the environment is configured with a powerful role ARN, the skill can inspect resources outside the original account, increasing blast radius and the chance of unauthorized disclosure.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger list contains broad phrases such as 'quick check' and 'DNS diagnose' that can match ordinary conversation and cause unintended skill activation. If auto-invoked, the skill may run network probes, read credential state, update CLI plugins, or collect domain intelligence without sufficiently clear user intent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The reference explicitly lists credential fields such as AccessKeyId, AccessKeySecret, and SecurityToken without any warning to redact, avoid logging, or securely store them. This creates a realistic risk that an agent, user, or logging pipeline will print or persist active secrets, enabling unauthorized access for the credential lifetime.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide shows command-line examples containing access key IDs, secrets, and tokens without point-of-use warnings about shell history, screen exposure, process inspection, or plaintext persistence in local config. In practice, users often copy such commands directly, which can leak credentials into terminals, logs, CI output, and configuration files, creating a real secret-handling risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: HTTP probing sends user-supplied URLs or domains to boce.aliyun.com through automated browser actions without an explicit warning at the execution point. This can leak sensitive internal hostnames, customer infrastructure details, or investigation targets to a third party, and the skill context makes this more significant because users may expect a DNS-only diagnostic rather than external HTTP probing.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: DNS probing submits user-provided domains to an external Alibaba Cloud probing service without an explicit execution-time notice or consent check. Even for legitimate diagnostics, this may disclose sensitive domains, internal naming schemes, or customer investigation activity to a third party, which is especially relevant in enterprise/security workflows.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The tool is explicitly designed to send queried domains to public recursive DNS services such as AliDNS, Google DNS, and 114 DNS. In a diagnostic skill, this can disclose sensitive internal, customer, or not-yet-public domain names to third parties, especially because the behavior is automatic and the code provides no consent prompt, warning, or option to disable external resolution.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

> [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date.

**Other tools:**

| Tool | Purpose | Installation |
|------|---------|-------------|

• Confidence: 91% confidence
• Finding: The installation flow mandates `aliyun configure set --auto-plugin-install true` and `aliyun plugin update`, which can fetch and install code/plugins into the local CLI environment. Even though the skill is described as read-only for cloud resources, this is still a local state-changing operation and expands execution surface by trusting external plugin sources at runtime.

Static analysis

No suspicious patterns detected.