alibabacloud-dsc-column-encryption

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 5:51 AM UTC
• Version: 0.0.1-beta.1

Overview

This skill is a high-impact Alibaba Cloud DSC column-encryption operator, but its cloud access and write actions are disclosed, scoped, and gated by preflight plus explicit approval instructions.

Install only if you are comfortable letting the agent operate DSC column-encryption workflows through a named Alibaba Cloud CLI profile. Start with query-only RAM permissions, add change permissions only for approved operators, prefer OAuth or temporary credentials, and review every preflight plan before approving any write.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description overstates the skill's scope. The supplied code is tightly focused on safely creating a DSC column-encryption rule: it normalizes input, validates region/product/algorithm/key/account expiry fields, runs online preflight checks against instance/template/column/account/KMS state, requires a confirmation token, issues one CreateDataMaskingRule request, and polls for resulting status. This aligns partially with enabling column encryption and selecting an algorithm or KMS key, and partially with managing account expiry as part of the creation request. However, major declared capabilities are absent: there is no code for searching or browsing columns using the broad set of listed filters, no disable/decrypt/delete flow, no asset sync operation, and no kernel upgrade action. Because the declared purpose presents a substantially broader operational assistant than the code actually implements, this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description frames the skill as a full operational assistant for protecting sensitive columns and controlling plaintext access, including several mutating administrative actions. The code does not implement those management behaviors. Instead, it performs read-only discovery against an allowlisted set of SDDP 2026-01-20 APIs: listing regions/templates/instances/accounts/databases/tables/columns, checking eligibility, and finding candidate non-encrypted columns. The script even enforces read-only behavior with an action allowlist and states 'Writes=none'. While part of the declared description mentions finding columns and viewing metadata, the primary declared purpose includes multiple write/change operations that are not present. Therefore the description materially overstates what the code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents the skill as both discovery and management for DSC column encryption, including several state-changing operations. The code chunk, however, explicitly documents itself as read-only and its implementation supports only query/list/check behavior. It can help users inspect columns, instances, accounts, supported algorithms, KMS keys, and upgrade-version options, which partially matches the discovery portions of the description. But it does not implement the declared management actions such as enabling/disabling encryption, modifying account access/expiry, synchronizing assets, choosing/applying algorithms or KMS keys, or performing upgrades. Because these are central declared capabilities rather than minor omissions, the description materially overstates what the code actually does.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

- Delete rules, change account access, change algorithms or keys, synchronize assets, or upgrade kernels: `scripts/manage_column_encryption.py`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

or offline requests. `<skill-dir>` always means the directory containing this `SKILL.md`, not the user's application repository.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/aliyun_cli.py (reported line 100)May include surrounding context.

python

# A previously exported AK, STS token, default profile, endpoint, or debug
    # switch must not override the selected profile. Preserve HOME/PATH
    # and normal proxy settings so CLI can reach its own config and endpoints.
    result = {name: value for name, value in os.environ.items()
              if not name.upper().startswith(("ALIBABA_CLOUD_", "ALIBABACLOUD_", "ALIYUN_", "ALICLOUD_"))
              and name.upper() not in {"ACCESS_KEY_ID", "ACCESS_KEY_SECRET", "SECURITY_TOKEN"}}
    # CLI's native Mock interceptor runs before RPC dispatch. Removing its

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill invokes shell, reads/writes files, and may inspect environment-backed runtime state, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates a governance gap: a host agent may expose broader capabilities than reviewers or users expect, increasing the chance of unintended command execution or file access during a sensitive cloud-management workflow.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

## Runtime and permissions

Follow [runtime-constraints.md](references/runtime-constraints.md) for Python 3.10+, Alibaba Cloud CLI 3.4.10+ (or exactly 3.3.23 with a preconfigured StsToken profile), and credential setup performed by the user or trusted platform outside the agent session. OAuth remains the recommended interactive setup. AK/SK, STS temporary credentials and RamRoleArn are also supported through named CLI profiles; do not ask users to paste credentials into chat. The scripts use only the Python standard library; no SDK installation is needed. All three entry points accept `--profile`, defaulting to `dsc-oauth`. Use the same profile and authentication mode throughout query, preflight and execution. Replace `dsc-oauth` in the examples with the user's selected profile for other modes.

Read [ram-policies.md](references/ram-policies.md) before online use. It separates query permissions, opt-in change permissions and key-scoped `kms:DescribeKey`. Dependency declarations do not grant permissions. Never attach RAM policies or expand access automatically.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file describes the delete API and notes that deleting the last effective rule disables the instance's column encryption status. That is a safety-critical, potentially irreversible impact on protected data configuration, but the document does not include a clear user-facing warning or confirmation step about that consequence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown states that synchronization may remove local asset records that no longer exist, which can affect user-visible state and system integrity. The section explains behavior but does not present it as a caution or warning to the user before running the operation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/aliyun_cli.py (reported line 117)May include surrounding context.

python

def _run(argv: Sequence[str], *, timeout: int = 75) -> subprocess.CompletedProcess[str]:
    try:
        return subprocess.run(list(argv), stdin=subprocess.DEVNULL, capture_output=True,
                              text=True, encoding="utf-8", errors="replace", check=False,
                              timeout=timeout, env=cli_environment())
    except subprocess.TimeoutExpired:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The example configuration sets "RegionId" to "cn-hangzhou", which imposes a specific regional locale in natural-language/config semantics. There is no accompanying explanation that this is only an example value or that users should choose an appropriate region, so it may conflict with locale-choice policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file includes a natural-language/config example that forces a specific locale value. Under the policy, locale restrictions should be optional or explicitly justified; here the examples prescribe zh_cn without opt-in or explanation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This example reinforces a single forced locale across operations. Because the file does not state that the workflow is limited to Chinese-language operation or provide alternatives, it appears to violate the language/locale choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

As with the other examples, the documentation presents a single locale as though it were required. The policy allows locale constraints only when users can opt in or when the limitation is documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The docstring says "No credential setup," suggesting the script operates without credential handling. In practice, the code checks EVAL_ROLE_ARN, resolves a cloud profile, restricts profile auth modes, and builds an authenticated client, so the documentation understates its credential dependency.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The top-level docstring states the file deliberately contains no write action, which reads as an absolute claim about side effects. However, the program does perform output writes via print_safe_error_diagnostics and print(...) to stdout/stderr during error handling and normal execution, so the documentation overstates the absence of writes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest frames this skill as operating on the DSC column-encryption console, and the module/docstring emphasizes read-only queries mirroring that page. While still read-only, the kms-keys path goes beyond listing DSC-visible KMS candidates and directly calls the KMS product API DescribeKey, which is an additional cross-service operation not evident from the manifest's narrower DSC-console wording.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The --lang argument defaults to zh, which causes the skill to request Chinese responses unless the user explicitly overrides it. This is a language/locale policy concern because the tool imposes a specific locale by default rather than presenting a neutral default or explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.