Security audit

Alibabacloud Flink Instance Manage

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Alibaba Cloud Flink helper that can create billable resources, but its main runtime path is scoped and confirmation-gated.

Install only if you intend to manage Alibaba Cloud Flink VVP resources. Use a dedicated least-privilege RAM role or user, review every create command because it may create billable resources, and avoid following the generic ECS/plugin examples unless you separately need them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The guide explicitly promotes installing and using all Alibaba Cloud product plugins and broad CLI coverage, which exceeds this skill's stated Flink VVP create/query-only scope. In an agent context, this over-broad operational guidance increases the chance of capability drift, misuse of unrelated services, and execution of commands outside the intended authorization boundary.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The document recommends least privilege but then suggests broad permissions such as AliyunECSFullAccess and unrelated ECS operations, which contradicts the skill's limited Flink VVP purpose. This can lead operators or downstream agents to provision excessive rights, expanding blast radius if credentials are misused or the agent is prompted outside scope.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The skill manifest explicitly limits behavior to create/query operations, but this reference document normalizes deletion lifecycle states such as `RELEASING` and includes deletion-initiated transitions. In an agentic setting, contradictory operational guidance can broaden the model's perceived scope and increase the chance it assists with or reasons about unsupported destructive actions.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The troubleshooting guidance states that an instance may have been deleted and instructs the agent to handle that path, which conflicts with the skill's create/query-only boundary. Even without explicit delete commands, documenting deleted-state handling can prime the agent to treat destructive lifecycle operations as in-scope and produce unsafe assistance around unsupported operations.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill metadata claims query support only for Flink instances, namespaces, regions, zones, or tags, but the implementation accepts an arbitrary resource_type for tag listing. This can broaden the tool's effective scope and let callers enumerate metadata for other Alibaba Cloud resource types, enabling unintended cross-service information disclosure and policy bypass within an agent environment that relies on the manifest for least-privilege behavior.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The guide shows configuring long-lived access keys and then displays them as stored in ~/.aliyun/config.json without clearly warning that sensitive secrets are persisted locally in recoverable form. In automation and agent-driven environments, this materially increases credential exposure risk through filesystem access, backups, logs, screenshots, or accidental commits.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Recommending aliyun configure get and debug logging without a warning about redaction can expose access key identifiers, profile details, endpoints, and other sensitive configuration material to terminal history, CI logs, support tickets, or shared consoles. In an agent setting, verbose logging is especially risky because outputs may be captured, persisted, or relayed automatically.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.