Alibabacloud Esa Pages Deploy

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 0.0.2

Overview

This skill appears to deploy to Alibaba Cloud ESA as advertised, but it can make live production cloud changes and expose short-lived access-token URLs in logs.

Install only if you explicitly want an agent to deploy to Alibaba Cloud ESA. Use a dedicated least-privilege RAM role where possible, verify the active Alibaba Cloud account before running scripts, review content before production deployment, and treat any URL containing esa_er_token as a secret that should not be posted to logs, chats, screenshots, or CI output.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script requests a routine access token and appends it directly to the returned URL, then prints that URL to stdout. Query-string tokens are easily exposed through shell history, CI/CD logs, terminal scrollback, screenshots, referrer leakage, and shared logs, which can grant unintended access to the deployed routine for the token lifetime.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The skill's 'use when' description is broad enough to match many generic web deployment tasks, which can cause an agent to invoke a powerful cloud deployment skill in situations where a safer or more specific skill should be used. In this context, over-broad routing is risky because the skill can perform real cloud actions, deploy code, and interact with storage using ambient credentials.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs users to rely on environment variables and the default credential chain but does not prominently warn against exposing, logging, or echoing credentials. Because this skill is designed to make privileged cloud API calls, weak guidance around secret handling increases the chance of credential leakage through terminal output, debug logs, or copied examples.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The example generates an access token, appends it to the URL query string, and prints the full URL. Query-string tokens are commonly exposed through logs, shell history, browser history, referrers, screenshots, and chat transcripts; printing them without warning materially increases the chance of credential disclosure and unauthorized access during the token lifetime.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script performs high-impact side effects automatically: it may enable the Edge Routine service and later publishes uploaded code directly to production without any explicit confirmation or prominent warning. In an agent skill context, this is risky because a user may invoke deployment expecting a dry run or staging action, but instead incur billing, activate services, and expose new production code immediately.

Credential Access

High

• Category: Privilege Escalation

Content

? `https://${routine.body.defaultRelatedRecord}`
    : null;

  // Get access token and append to URL
  if (url) {
    console.log("Getting access token...");
    const tokenParams = new OpenApi.Params({

• Confidence: 91% confidence
• Finding: access token

Credential Access

High

• Category: Privilege Escalation

Content

// Get access token and append to URL
  if (url) {
    console.log("Getting access token...");
    const tokenParams = new OpenApi.Params({
      action: "GetRoutineAccessToken",
      version: "2024-09-10",

• Confidence: 88% confidence
• Finding: access token

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.