Security audit

Alibabacloud Elasticsearch Instance Manage

Security checks across malware telemetry and agentic risk

Overview

This skill is not malicious, but it gives an agent broad control over Alibaba Cloud Elasticsearch operations that can affect availability, billing, credentials, and installed plugins.

Install only for operators who intentionally want agent-assisted Alibaba Cloud Elasticsearch administration. Use least-privilege RAM policies scoped to the exact instance and module, avoid the full union policy unless necessary, do not run curl-to-shell blindly, avoid public OSS buckets for dictionaries when a private service-role pattern is available, and require explicit human approval before restarts, upgrades, billing conversion, password reset, YML changes, or any custom plugin upload/install.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Scope Creep

Medium

Confidence: 84% confidence
Finding: The skill advertises capabilities beyond the documented minimum RAM permissions, creating a mismatch between expected and actual authorization scope. This can lead operators to over-broaden permissions to make the skill work or to run sensitive operations without clear least-privilege guidance, increasing the chance of accidental privilege expansion.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The file materially expands the skill from instance lifecycle/configuration into plugin administration, including install and uninstall of cluster components. That scope drift increases the skill’s authority and operational blast radius beyond the declared manifest purpose, making it easier for an agent to perform disruptive or risky actions that a user would not reasonably expect from the advertised capability set.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill supports uploading arbitrary custom plugins from OSS and installing them on Elasticsearch clusters, which can introduce untrusted code or functionality into a production search service. In context, this is more dangerous than ordinary instance configuration because custom plugins can alter cluster behavior, override built-in plugins, and trigger restarts, creating both code-supply-chain and availability risk.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The permission documentation materially broadens the skill's effective capabilities beyond the declared manifest scope by requesting actions for Kibana settings, cluster YAML changes, plugin management, admin password resets, billing changes, and renaming. In an agent setting, operators may grant the documented union policy as-is, enabling powerful configuration and account-impacting operations that are not clearly disclosed by the skill metadata and could be abused for privilege expansion or service disruption.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The document states that system/tool commands such as `aliyun ram ...` must not include `--user-agent`, yet the provided RAM attach-policy examples do include it. This contradiction can cause command failures or encourage operators to rely on incorrect command patterns, undermining policy attachment workflows and observability expectations.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The skill supports service-impacting actions such as restart, upgrade/downgrade, scaling, password changes, and configuration updates, but the overview does not prominently warn about downtime, restarts, or irreversible operational effects. In an agent context, weak user-facing warnings can cause unsafe execution of high-impact actions with insufficient confirmation.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs users to install or update software using a piped remote shell command without any integrity-verification or trust warning. In a security-sensitive automation context, this normalizes execution of unreviewed remote code and increases supply-chain compromise risk if the host, network path, or script source is tampered with.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The acceptance criteria includes restart and update operations that can disrupt availability or alter resource sizing, but it does not require any warning, confirmation, or mention of service impact. In an infrastructure-management skill, omission of operational safety guidance increases the chance that an agent or user performs a disruptive action without understanding downtime, restart effects, or billing/resource consequences.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The password reset example places the new Elasticsearch admin password directly in the command line JSON body, which can expose the secret through shell history, process listings, terminal logging, or audit tooling. In a skill specifically meant to guide operators through administrative actions, this is a real secret-handling weakness because users are likely to copy the example verbatim.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The document authorizes destructive and service-affecting operations such as restarts, upgrades/downgrades, configuration updates, and plugin changes without prominently warning about downtime, restart behavior, or production impact. In an agent-driven workflow, this increases the chance that a user grants broad operational permissions or executes disruptive actions without informed consent.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The guidance says dict-source OSS buckets may be made publicly readable for ingestion, but it does not warn that public read exposes bucket contents to anyone and may disclose sensitive dictionaries, synonyms, internal terminology, or other staged artifacts. Presenting public-read as an acceptable default in security-sensitive documentation can lead directly to data exposure and weak storage posture.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document instructs operators to restart an Elasticsearch instance but does not warn that restart operations can cause temporary service unavailability, degraded cluster health, failed queries, or write interruptions. In an infrastructure-management skill, omission of this operational risk can lead users or agents to trigger disruptive actions in production without planning maintenance windows or validating redundancy.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The upgrade/downgrade verification section describes how to perform and validate instance updates but omits warnings that version or configuration changes can cause downtime, performance degradation, compatibility issues, or data/feature regressions. Because this skill manages live Elasticsearch infrastructure, users may interpret the workflow as safe to run routinely, increasing the chance of harmful production changes.

External Script Fetching

High

Category: Supply Chain
Content: > **Pre-check: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update, > or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions. > **Pre-check: Aliyun CLI plugin update required**
Confidence: 98% confidence
Finding: curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.