ClawHub
Back to skill

Security audit

Alibabacloud Flink Instance Manage

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Alibaba Cloud Flink purpose, but it gives an agent weak control over paid create operations and includes broader cloud setup guidance than the Flink-only scope needs.

Install only if you are comfortable letting the agent create Alibaba Cloud Flink resources. Use a RAM identity limited to the listed stream actions, require the agent to show the exact final command, region, resource size, and billing impact before any create operation, and avoid the unrelated ECS/plugin examples. Prefer a pinned and verified Aliyun CLI installation or skip the optional CLI setup if it is not needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
references/required-confirmation-model.md:5
Finding

Confirmation Flag Can Be Added Without Explicit User Approval

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/instance_ops.py:178
Finding

Conflicting and Non-Positive Resource Specifications Are Accepted

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/cli-installation-guide.md:33
Finding

Aliyun CLI Installation Uses Mutable Unverified Binaries

Content
View full analysis
Remediation
View remediation
aliyun-cli-linux-amd64.tgz" | sha256sum --check ``` 4. Prefer cryptographic signature verification when Alibaba Cloud provides signed release artifacts and a documented signing key. 5. Abort installation immediately if verification fails. 6. Prefer a trusted operating-system package manager or an official package repository that performs signature verification. 7. Avoid elevated installation when unnecessary; a per-user directory such as `~/.local/bin` reduces system-wide exposure. 8. Document the exact expected version after installation and verify that value rather than merely checking whether the command runs. 9. Apply equivalent integrity verification to the Windows PowerShell installation instructions. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared behavior says the skill is limited to Alibaba Cloud Flink create/query operations, but the detected behavior indicates local file generation and overwrite capability unrelated to that purpose. This mismatch is dangerous because it defeats operator expectations and can be abused to write or replace local artifacts, enabling data tampering, persistence, or staging of further malicious actions under the cover of a benign cloud-management skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation uses ECS verification commands even though the skill manifest explicitly rejects unrelated cloud services such as ECS. Including runnable ECS operations normalizes out-of-scope service access and may cause an agent or user to validate credentials using broader permissions than the Flink-only skill should require.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is narrowly scoped to create/query-only Alibaba Cloud Flink VVP instances and namespaces, but this reference guide explicitly teaches generic plugin installation and exploration of unrelated services such as ECS and Function Compute. In an agent skill context, broad operational instructions can expand the effective capability surface beyond the declared policy boundary, making prompt misuse or accidental cross-service actions more likely.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
78% confidence
Finding

The skill does not declare any explicit tool scope such as allowed-tools or permissions, yet the surrounding package reportedly includes file read/write capabilities. In an agentic environment, missing tool scoping can let the skill access local files beyond what users expect, increasing the chance of unauthorized data exposure or unintended file modification if the wrapper or referenced assets are invoked.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 41)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 56)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 69)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 129)May include surrounding context.

md
1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide documents six generic Alibaba Cloud authentication modes, including role assumption and cross-account access, which materially exceeds the narrow create/query-only Flink use case. In a constrained agent skill, broad credential onboarding increases the chance of over-privileged setup, cross-account reach, and misuse of credentials outside the intended scope.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 415)May include surrounding context.

bash
# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/common-failures.md (reported line 146)May include surrounding context.

md
---

## Pattern 6: Claiming Success Without Verification

**Scenario**: Reporting success after create response only

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/common-failures.md (reported line 210)May include surrounding context.

❌ Wrong:

bash
# Create instance without checking if it exists
python scripts/instance_ops.py create \
  --name my-instance \
  ...

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 82)May include surrounding context.

Linux (Ubuntu/Debian)

bash
sudo apt-get install python3 python3-pip

Linux (CentOS/RHEL)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/python-environment-setup.md (reported line 48)May include surrounding context.

Linux (Ubuntu/Debian)

bash
sudo apt-get install python3 python3-pip

Linux (CentOS/RHEL)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/python-environment-setup.md (reported line 53)May include surrounding context.

Linux (Ubuntu/Debian)

bash
sudo apt-get install python3 python3-pip

Linux (CentOS/RHEL)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/python-environment-setup.md (reported line 193)May include surrounding context.

Linux (Ubuntu/Debian)

bash
sudo apt-get install python3 python3-pip

Linux (CentOS/RHEL)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/python-environment-setup.md (reported line 194)May include surrounding context.

Linux (Ubuntu/Debian)

bash
sudo apt-get install python3 python3-pip

Linux (CentOS/RHEL)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says the skill should be used when the user asks in Chinese or English, which imposes a language constraint in the natural-language policy without presenting it as a user choice or justified locale-specific limitation. This is a policy-style language restriction rather than a technical requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The sample configuration sets "language": "en", which is a natural-language locale choice embedded in the guide. Because the document does not present this as optional or offer alternatives, it can be read as prescribing English by default, which conflicts with the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/instance_ops.py (reported line 65)May include surrounding context.

python
"""Call API with timeout runtime options when available."""
        method_with_options = None
        for candidate in (f"{method_name}_with_options", f"{method_name}with_options"):
            method_with_options = getattr(self.client, candidate, None)
            if method_with_options:
                break

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/instance_ops.py (reported line 74)May include surrounding context.

python
return method_with_options(self.runtime_options)
            return method_with_options(request, self.runtime_options)

        method = getattr(self.client, method_name)
        if request is None:
            return method()
        return method(request)

Static analysis

No suspicious patterns detected.