Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches a Flink deployment workflow, but it asks users or agents to run unverified installer/update commands and grants broader cloud permissions than the creation workflow needs.
Install only after reviewing the Aliyun CLI installer/update process and granting a minimal RAM policy for the specific operation. Prefer a pinned, verified CLI installation, an isolated Python virtual environment with pinned dependencies, and RAM permissions limited to DescribeVvpInstances, CreateDeployment, GetDeployment, and ListEngineVersionMetadata only when needed; keep start/stop/update/log/API-proxy permissions in a separate operational workflow.
SKILL.md:22Unverified Remote Shell Script Download and Execution
SKILL.md:30Unpinned Python Dependencies Installed Without Integrity Verification
references/ram-policies.md:13RAM Permission Guidance Exceeds the Skill's Declared and Implemented Scope
The skill instructs the agent to execute a remote installation script via curl piped to /bin/bash and also to self-update the Alibaba CLI/plugin. That introduces an unpinned, network-fetched code-execution path and mutable tooling state inside the session; if the upstream source, transport, mirror, or plugin channel is compromised, the agent could run attacker-controlled code with the user's privileges.
**Pre-check: Aliyun CLI >= 3.3.3 required**
> [MUST] Verify: `aliyun version` — must be >= 3.3.3.
> - **First install or major upgrade:** `/bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh)"`
> - **Routine update (CLI >= 3.3.5):** `aliyun upgrade` — prefer this built-in self-update over re-running the install script.
> - See `references/cli-installation-guide.md` for full installation instructions.
Before the first non-version `aliyun` command, apply the conversation-scoped
Without declared permissions the skill's intent is opaque and cannot be validated.
The manifest description says to route deletion-only requests elsewhere, implying this skill should not handle deletion. However, the Scope section groups 'deletion' among operations to use another Flink workspace skill for, which creates an inconsistent statement of what this skill is responsible for versus what adjacent documentation says about operation routing.
The guide instructs users to execute a shell script fetched directly from the internet via curl piped to bash, without any integrity verification, signature check, pinning, or explicit warning. If the remote host, CDN path, DNS resolution, TLS trust chain, or setup script is compromised, users could execute arbitrary code on their systems during installation.
The documented console path includes /zh/, which forces a specific language locale in the UI. The file does not offer a user opt-in, alternative locale, or justification that this skill is region- or language-specific.
The documented clickable VVP configuration link hardcodes /zh/ in the path, which imposes a specific locale in the user-facing console experience. The file does not offer a language choice or explain why Chinese is required for this workflow.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
"""Store one option value and reject a second occurrence."""
def __call__(self, parser, namespace, values, option_string=None):
if getattr(namespace, self.dest, None) is not None:
parser.error(f'{option_string} may be specified only once')
setattr(namespace, self.dest, values)
No suspicious patterns detected.