Alibabacloud Dts Task Query

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:23 AM UTC
• Version: 0.0.1

Overview

The skill is mostly a disclosed Alibaba Cloud DTS inventory query tool, but it asks users to make broad persistent CLI/plugin changes and forces complete disclosure of cloud task metadata.

Review before installing. Use a least-privilege Alibaba Cloud RAM identity with only DTS read permissions, avoid running `aliyun plugin update --all` unless you intentionally want to update every CLI plugin, and treat the generated report as sensitive cloud inventory. Prefer limiting by region, instance ID, or job name when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned Blanket Update of All Alibaba Cloud CLI Plugins

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 30
Vulnerability Type: Supply-chain exposure through unpinned dependency updates
Risk Level: Medium

Vulnerable Code

bash

# Update all plugins to latest version
aliyun plugin update --all

Technical Analysis

The skill defines updating every installed Alibaba Cloud CLI plugin to its latest available version as a mandatory prerequisite. The command neither limits the update to the DTS plugin required by the skill nor pins dependencies to reviewed versions.

Consequently, the runtime dependency set can differ from the code that was originally audited. It also unnecessarily brings unrelated installed plugins into the skill's trust boundary. If an upstream plugin release or its distribution channel is compromised, the update can install attacker-controlled code that subsequently executes with the privileges of the user running the Alibaba Cloud CLI.

This is a supply-chain risk rather than evidence that the current project contains an actively malicious plugin.

Attack Path

1. An attacker compromises an upstream CLI plugin release, publisher account, or plugin distribution channel.
2. A user follows the skill's mandatory setup instructions and runs aliyun plugin update --all.
3. The CLI downloads and installs the compromised release, including unrelated plugins that the DTS skill does not require.
4. Malicious plugin code executes when that plugin is loaded or invoked during this or a later CLI operation.
5. The payload operates with the local privileges and accessible cloud credentials of the user running the CLI.

Impact Assessment

Successful exploitation could permit arbitrary actions available to malicious plugin code under the invoking user's account, including access to local files, environment data, and Alibaba Cloud credentials available to the CLI process. Cloud-side impact would depend on the permissions assigned to those credentials.

The exposure is broader ...[truncated 235 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove aliyun plugin update --all from mandatory setup instructions.
2. Install or update only the DTS plugin required by this skill.
3. Pin the DTS plugin to a specifically reviewed version rather than automatically selecting the latest release.
4. Obtain the plugin only from an authenticated official Alibaba Cloud source.
5. Verify available package signatures, checksums, or other integrity metadata before installation.
6. Require explicit user approval before changing locally installed plugins.
7. Document the supported CLI and DTS plugin versions and test upgrades before changing those requirements.
8. Keep unrelated plugins outside this skill's installation and update process.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A strong description-behavior mismatch is security-relevant because users may authorize the skill expecting a cloud DTS query, while the actual behavior appears to read local files and perform unrelated linting/document processing. This undermines informed consent and can conceal unintended data access or prompt-injection style abuse behind a benign cloud-operations description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill describes shell execution, local file reads/writes, and temporary-file handling but does not declare any explicit tool scope or allowed-tools boundary. That creates a privilege ambiguity where an agent may execute broader filesystem or shell actions than users expect, increasing the blast radius if the skill is invoked in a permissive runtime.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description explicitly says the skill outputs a full Chinese report, which imposes a specific language on users. This is reinforced elsewhere in the document as a mandatory requirement, and there is no opt-in, alternative locale, or justification that the skill is region-specific from a compliance perspective.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs the model to reproduce complete script output with no omission, which can force disclosure of all returned task metadata including identifiers, names, regions, timestamps, and possibly sensitive operational details. In a cloud inventory context, full unredacted enumeration materially increases reconnaissance and data-exposure risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Mandating a full line-by-line listing of every DTS task encourages bulk disclosure of cloud inventory and task metadata far beyond what is usually necessary to answer an operational question. This makes the skill more dangerous because its stated purpose is cross-region querying of production cloud resources, so the exposed data is likely real and sensitive.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The execution rules state that all output, including summaries and headers, must be in Chinese. This is a locale policy issue because it forces a language choice regardless of user preference and does not provide any mechanism for opting into or overriding that behavior.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 93% confidence

Finding

Instructions that forbid truncation and require showing all rows create an unbounded-output condition that can overwhelm the agent, the user interface, or downstream systems while also amplifying data leakage. In this skill, unbounded output is especially risky because it is tied to enumerating cloud task inventories across many regions.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

### 2. 任务明细
**⚠️ CRITICAL - Output Completeness:**
- **Script GUARANTEES complete output**: The script ALWAYS outputs ALL tasks without truncation
- **ALWAYS display ALL rows**: Every single task MUST be listed row-by-row, no exceptions
- **NEVER use placeholders**: No "..." or similar truncation symbols - show EVERY task with actual data
- **Complete example structure** (actual output contains ALL real data rows, NO truncation):

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 93% confidence

Finding

The 'NO truncation' mandate is a direct anti-safety instruction that prevents sensible output bounding. This can cause denial-of-service style behavior in constrained contexts and magnifies the impact of any sensitive data returned by the script.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

• Script GUARANTEES complete output: The script ALWAYS outputs ALL tasks without truncation
• ALWAYS display ALL rows: Every single task MUST be listed row-by-row, no exceptions
• NEVER use placeholders: No "..." or similar truncation symbols - show EVERY task with actual data
• Complete example structure (actual output contains ALL real data rows, NO truncation):

text

#### 迁移任务

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 93% confidence

Finding

Reinforcing that all rows must be output with no truncation increases the likelihood of oversized responses and mass disclosure. Because this content concerns operational cloud task data, the unbounded output issue is not merely cosmetic; it materially increases exposure and reliability risk.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

| [Region2] | [Status2] | [Name2] | [ExpireTime2] | [JobID2] | [CreateTime2] | [InstanceID2] | | [Region3] | [Status3] | [Name3] | [ExpireTime3] | [JobID3] | [CreateTime3] | [InstanceID3] |

text

**The script outputs ALL rows with actual data for EVERY task - NO truncation.**

#### 迁移任务
共 [N] 个

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Saving raw JSON to a temp file and then printing a complete task list creates two exposure channels: at-rest local data and broad natural-language disclosure. Even if the temp file is later deleted, sensitive cloud metadata may persist in logs, crash artifacts, shell history, or model transcripts.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 92% confidence

Finding

Embedding 'NO TRUNCATION' in the workflow makes excessive output a required behavior rather than an incidental one. That increases the chance of transcript bloat, timeout/resource issues, and full disclosure of inventory data when a concise answer would suffice.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

12. Save raw JSON to `/tmp/dts_raw_*.json`.
13. Read temp file, filter by `PayType` (PrePaid/PostPaid), then apply user filters.
14. Group tasks by type (Migration/Sync/Subscribe), sort each group by CreateTime (newest first).
15. Format and print Chinese report with complete task list (NO TRUNCATION).
16. Delete temp file.

**Output Completeness Guarantee:**

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The repeated guarantee that every task row must be shown exactly reinforces exhaustive disclosure and discourages safety-preserving summarization or redaction. In the context of cloud migration/sync/subscription tasks, such complete output can expose infrastructure topology, business system names, timing, and asset identifiers useful for lateral planning or targeted attacks.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 93% confidence

Finding

A blanket guarantee of outputting 100% of tasks without truncation removes an important safety valve against both data overexposure and operational instability. In a cross-region cloud query skill, result size can grow unpredictably, so bounded response handling is necessary.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md

16. Delete temp file.

**Output Completeness Guarantee:**
- ✅ **Script outputs 100% of tasks**: The script ALWAYS outputs ALL tasks without truncation
- ✅ **Format-ready**: The output uses markdown tables ready for direct model response
- ✅ **Zero omissions**: No tasks are hidden, summarized, or omitted under any circumstances
- ✅ **MUST display ALL rows**: When using this skill, you MUST output every single task row exactly

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The instruction that there are 'no exceptions' to complete visibility of all task data is dangerous because it explicitly overrides prudent minimization behavior. This elevates both confidentiality risk and service degradation risk whenever large or sensitive result sets are returned.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

- ✅ **Format-ready**: The output uses markdown tables ready for direct model response
- ✅ **Zero omissions**: No tasks are hidden, summarized, or omitted under any circumstances
- ✅ **MUST display ALL rows**: When using this skill, you MUST output every single task row exactly
- ✅ **NO truncation allowed**: Never truncate, summarize, or use "..." placeholders
- ✅ **Preserve completeness**: The script output is COMPLETE - your response MUST be COMPLETE
- ✅ **Every task visible**: The script outputs EVERY task - your model response MUST show EVERY task
- ✅ **No exceptions**: Script output = Complete data. Your output MUST = Complete data. ALWAYS.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file explicitly advertises 'Outputs full Chinese report' and the generated report strings and headers are hardcoded in Chinese throughout the script. This imposes a specific language without offering user opt-in, selection, or justification for a locale-specific constraint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/query_dts_tasks.py (reported line 88)May include surrounding context.

python

for attempt in range(3):
        try:
            # Increased timeout to 10s for reliability (v12.1)
            res = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
            if res.returncode != 0:
                print(f"ERROR: API call failed for region={region}, job_type={job_type}, page={page}, attempt={attempt+1}/3", file=sys.stderr)
                print(f"  Return code: {res.returncode}", file=sys.stderr)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script writes raw DTS job data to a temporary JSON file on local disk, which can expose potentially sensitive operational metadata such as job names, instance IDs, regions, statuses, and timestamps. Although the file is deleted in a finally block, it still exists on disk during execution and may persist if the process crashes, the host is compromised, or temporary storage is accessible to other local users or collection agents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This shell script's natural-language interface is entirely in Chinese, including comments and user-facing echo output. That imposes a specific language/locale on users without any opt-in, fallback, or documented justification, which matches the language-policy violation category.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · references/ram-policies.md (reported line 24)May include surrounding context.

}

text

**Why this permission:**
- `dts:DescribeDtsJobs` - Required to query the list of DTS jobs and their status information across regions via plugin mode (`aliyun dts describe-dts-jobs` - using plugin mode, NOT PascalCase `DescribeDtsJobs`)

### System Policy (Not Recommended)