alibabacloud-flink-ai-ops

• Outcome: Pass
• Latest audit: Nov 12, 2026 · 5:57 AM UTC
• Version: 0.0.1

Overview

ClawScan’s verdict is benign: AIG reported no findings, and the contextual review treated the listed Skillspector flags as expected for this skill, though the scanner outputs include a conflicting critical “do not install” recommendation.

The verdict is benign with medium confidence, but the scanner outputs conflict: Skillspector’s raw assessment labels the risk critical and recommends not installing, while the final verdict and contextual findings say benign. Consider that discrepancy before installing, especially if you require consistent scanner results.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/assistant-and-hitl.md (reported line 61)May include surrounding context.

md

ing and collect the genuinely missing decisions. Other items being approved does not constitute authorization for all.
3. Use the same real `sessionId` and return only the real `hitlId`s with `approve/deny`; add `--confirm` when any approve is included. `--confirm` neither replaces user authorization nor validates historical authorization.
4. After continuation, still handle failures and verification per the stream events; an approval having been sent is not equivalent to the tool having executed successfully. After authorized start/stop or configuration items return, execute the corresponding pure-read commands of the workspace skill to recheck, then deliver the result; keep them unverified only when the capability is genuinely unavailable. If another rejected item makes the whole return `CHAT_FAILED`, the executed authorized items can still be verified read-only — do not resend Chat or approvals.

The following is a continuation format illustration and must not be executed directly:

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, mcp, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

4. Authentication

• Use the SDK default credential chain; do not conclude credentials are missing merely because environment variables are unset. Only guide configuration when credential resolution ultimately fails (MissingCredentials).
• Security rules: never read, echo, or print any AK/SK value; commands such as echo $ALIBABA_CLOUD_ACCESS_KEY_ID are forbidden; never ask the user for plaintext credentials in the session or on the command line.
• When credentials are missing, the user configures them in the terminal where the execution process is started (placeholders below are redacted and must not be executed as-is):

bash

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

Use [Related Commands](references/related-commands.md) to identify the required inputs for the selected operation.

Reuse confirmed scope. A manual patrol on specific deployments requires a workspace ID, namespace, region, and deployment IDs. If any are missing or are placeholders, ask for all missing real values in one message and wait for the user's reply before installing dependencies or running a command. Use the confirmed deployment IDs as the patrol scope. If the user declines or asks to stop before execution, end the task and state that no patrol started and no report ID is available. Never discover, default, or guess a target in place of the requested scope. A user directly requesting a specific modification authorizes that scope; show the impact and execute without asking again.

## 7. SDK Request Tracing

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · references/assistant-and-hitl.md (reported line 30)May include surrounding context.

md

igent assistant, give suggestions, do not modify" is still a regular AI diagnosis: call Chat via the user's designated entry point, keep the constraint, and do not approve write operations. Only switch to pure-read tools when the user explicitly requires strict read-only, permission isolation, or forbidding any entry that may write; never drop the user's explicitly designated AI assistant just because "do not modify" was seen.

When the user explicitly requires "strictly read-only" or "must not invoke any tool that may write", do not call Chat. Read the installed `alibabacloud-flink-workspace-ops` documentation yourself and execute pure-read commands such as `deep_check_job`, `diagnose_job`, `get_job`, keeping the user's original scope; if that skill is not installed, state the limitation instead of asking the user to reroute for the Agent. A general diagnosis also never auto-approves HITL write operations. When the user authorizes remediation, verify the approval scope item by item an

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/assistant-and-hitl.md (reported line 30)May include surrounding context.

md

er's designated entry point, keep the constraint, and do not approve write operations. Only switch to pure-read tools when the user explicitly requires strict read-only, permission isolation, or forbidding any entry that may write; never drop the user's explicitly designated AI assistant just because "do not modify" was seen.

When the user explicitly requires "strictly read-only" or "must not invoke any tool that may write", do not call Chat. Read the installed `alibabacloud-flink-workspace-ops` documentation yourself and execute pure-read commands such as `deep_check_job`, `diagnose_job`, `get_job`, keeping the user's original scope; if that skill is not installed, state the limitation instead of asking the user to reroute for the Agent. A general diagnosis also never auto-approves HITL write operations. When the user authorizes remediation, verify the approval scope item by item and validate the effect by reading back the actual resources.

## Stream Events and Completion Semantics

The skill directs execution of strictly read-only job diagnosis despite explicitly excluding that workflow from its manifest.

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The manifest explicitly places strictly read-only job diagnosis out of scope. However, this instruction tells the agent to load another skill's documentation and execute deep_check_job, diagnose_job, or get_job when the user requests strict read-only diagnosis. This handles an excluded workflow directly, rather than merely verifying an in-scope assistant operation.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/flink_ai_ops/client.py (reported line 71)May include surrounding context.

python

))


def runtime_options(connect_timeout, read_timeout, timeout=None, *, for_chat=False):
    """Convert timeouts to milliseconds and cap them by the remaining budget."""
    from darabonba.runtime import RuntimeOptions

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/flink_ai_ops/sdk.py (reported line 93)May include surrounding context.

python

"""Bind every request to one explicit workspace, namespace and region."""

    def __init__(self, region, workspace, namespace, connect_timeout=DEFAULT_CONNECT_TIMEOUT,
                 read_timeout=None):
        if not isinstance(region, str) or not re.fullmatch(r"[a-z0-9]+(?:-[a-z0-9]+)*", region):
            raise OpsError("ValidationError", "region_id must be a real Alibaba Cloud region identifier.")
        for name, value in (("workspace", workspace), ("namespace", namespace)):

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/flink_ai_ops/sdk.py (reported line 100)May include surrounding context.

python

if not isinstance(value, str) or not value.strip() or any(ord(c) < 32 for c in value):
                raise OpsError("ValidationError", f"{name} must be a non-empty real value.")
        self.connect_timeout = positive_number(connect_timeout, "connect_timeout")
        self.read_timeout = None if read_timeout is None else positive_number(read_timeout, "read_timeout")
        self.workspace = workspace
        self.namespace = namespace
        self.last_request_id = ""

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/flink_ai_ops/sdk.py (reported line 135)May include surrounding context.

python

)
        return params, request

    def request(self, action, parameters=None, body=None, timeout=None):
        """Return a validated business response; retry temporary read errors once."""
        self.last_request_id = ""
        if action not in _OPERATIONS or action == "ChatAiAgent":

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/flink_ai_ops/patrol.py (reported line 380)May include surrounding context.

python

"""Translate CLI query names and validate the complete patrol request."""
    request = {
        "command": args.command, "body": body,
        "parameters": {wire: getattr(args, flag) for flag, wire in _QUERY_FIELDS.items()
                       if getattr(args, flag, None) is not None},
        "confirm": getattr(args, "confirm", False),
        "timeout": getattr(args, "timeout", 300),

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/flink_ai_ops/patrol.py (reported line 381)May include surrounding context.

python

request = {
        "command": args.command, "body": body,
        "parameters": {wire: getattr(args, flag) for flag, wire in _QUERY_FIELDS.items()
                       if getattr(args, flag, None) is not None},
        "confirm": getattr(args, "confirm", False),
        "timeout": getattr(args, "timeout", 300),
        "poll_interval": getattr(args, "poll_interval", 5),

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/flink_ai_ops/sdk.py (reported line 120)May include surrounding context.

python

method, area, resource = _OPERATIONS[action]
        values = parameters if method == "GET" else body
        model = getattr(models, action + "Request")().from_map(values or {})
        model.validate()
        serialized = model.to_map()
        params = utils_models.Params(

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/flink_ai_ops/sse.py (reported line 88)May include surrounding context.

python

self.__dict__.update(overrides)

    def __getattr__(self, name):
        return getattr(self._original, name)


def _private_binding(function, **overrides):