Security audit

Alibabacloud Ecs Code Deploy

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent Alibaba Cloud ECS deployment helper, but it should be reviewed because it asks for broad cloud authority and includes some under-scoped local install and secret-handling guidance.

Install only if you are comfortable granting broad Alibaba Cloud deployment permissions. Prefer OAuth or short-lived credentials, avoid copying real API keys into command lines or config files, review the RAM policy and scope it to specific regions/resources where possible, confirm any CLI/PATH changes, and use a clean working directory or isolated clone path for repository deployments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: Allowing arbitrary git URLs to be cloned into the current working directory expands the skill from deployment into untrusted code acquisition and local filesystem modification. Even without executing the code immediately, this can overwrite expected workspace contents, introduce malicious files, and set up later execution during packaging or deployment.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill is presented as an ECS deployment workflow but also directs modification of the local host environment, including software installation, PATH changes, and shell profile edits. This broadens its impact to persistent host changes that may affect unrelated tools and future sessions.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The document explicitly forbids collecting or persisting secrets in chat or files, but later examples instruct passing an API key directly on the command line and in JSON. Command-line arguments and inline JSON are commonly exposed via shell history, process listings, logs, and audit trails, so this guidance can leak credentials despite earlier safeguards.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The document claims a least-privilege design, but every statement uses `Resource: "*"` across powerful services such as ECS, OSS, VPC, and ComputeNest. Even when actions are enumerated, unrestricted resource scope can allow the credential to create, modify, or delete any matching resource in the account, which materially weakens the least-privilege claim and can increase blast radius if credentials are misused or stolen.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The documentation asserts that the policy includes only actions the skill actually invokes, yet the listed permissions enable broad infrastructure provisioning and remote command execution capabilities. In a deployment skill, these permissions are sensitive because they can create compute, networking, storage, and execute commands on ECS instances, so overstating necessity may lead users to grant more access than the workflow truly requires.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The verify workflow exceeds the declared deployment-helper scope by invoking ECS RunCommand and probing live services. That expands the skill from appmanager deployment into remote instance command execution, which materially increases blast radius if the skill is triggered in the wrong context or against a sensitive host.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: Direct remote-command execution on ECS is a privileged post-deploy action not clearly justified by the skill's appmanager-focused purpose. Even though the current command is limited to reading /root/app.log, this capability can expose sensitive host data and normalizes use of broad ecs:RunCommand permissions inside a deployment skill.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs cloning a repository into the current directory without an explicit warning about local filesystem changes. This can unexpectedly modify the user's workspace, create name collisions, or place attacker-controlled files alongside trusted project content.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Examples that place API keys directly on the command line create an avoidable secret-exposure path. Even if the key shown is a placeholder, users often copy patterns verbatim, causing real keys to be stored in shell history and visible to local users or monitoring tools.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The skill contradicts its own secret-handling policy by showing secrets embedded in both shell commands and persisted JSON content. This is dangerous because JSON examples may be copied into files or config artifacts, extending secret lifetime and increasing the risk of accidental disclosure or repository leakage.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.