alibabacloud-flink-sql-skill

• Outcome: Review
• Latest audit: Oct 9, 2026 · 1:04 PM UTC
• Version: 0.0.1

Overview

This is a coherent Alibaba Cloud Flink operations skill, but its broad cloud-control scope includes an unbounded Flink REST proxy presented as read-only, so it should be reviewed before installation.

Install only if you intend to let the agent operate Alibaba Cloud Flink resources. Use a least-privilege RAM role, start in a test workspace, review every mutating command, avoid embedding secrets in SQL, provide the VVP Cookie only when historical metrics are needed, and enable Git sync only for a repository that may receive deployment SQL and configuration. Treat `flink_api_proxy` as an advanced privileged diagnostic escape hatch despite the read-only label.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code is clearly related to Alibaba Cloud Realtime Compute / Ververica Platform and does support part of the declared area: SQL drafts, validation, and deployment, plus folder organization. However, the declared description substantially overstates the implemented scope. This code chunk does not manage jobs directly, savepoints, session clusters, catalogs, connectors, UDFs, variables, deployment targets as first-class resources, Git sync, or troubleshooting/observability features such as logs, metrics, checkpoints, exceptions, plans, or backpressure. It also does not analyze schemas beyond invoking API-side SQL/draft validation. Because the declared purpose presents a broad full-lifecycle management skill while the supplied code chunk only covers a limited subset, the description does not accurately represent what this chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents a broad, end-to-end Alibaba Cloud Flink/VVR/VVP lifecycle and troubleshooting skill. The supplied code chunk is much narrower: it only registers CLI subcommands for metadata browsing, SQL execution, UDF artifact/function management, connector management, and engine version listing. There is no evidence here of deployments, jobs, savepoints, session clusters, Git sync, metrics/cookie handling, troubleshooting, or validation/analysis workflows. This is a material description-versus-behavior mismatch because the declared primary purpose is substantially broader than what this code actually does.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 75% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/diagnosis/job-observability.md (reported line 367)May include surrounding context.

Filtering Logs

For returned logs or local logs supplied by the user, use a read-only search to extract context, for example:

bash

rg -n -C 20 -- 'OutOfMemoryError|CheckpointException|<user-keyword>' <log-file>

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 75% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/diagnosis/job-observability.md (reported line 626)May include surrounding context.

--flink_api_path '/taskmanagers//thread-dump'

text

Extract thread names, states, and relevant frames, preserving waiting objects or lock information when returned. One WAITING/BLOCKED stack is not proof of a deadlock. Stacks from different times can support further analysis, but this query does not itself establish a root cause.

### Sampling Semantics

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/git-sync.md (reported line 7)May include surrounding context.

md

## Configuration

`config_init` saves Git settings with the resource scope. See [configuration.md](configuration.md) for question order, defaults, the configuration file, and overwrite rules. Synchronization is disabled when `git.repo_url` is absent. Repository authentication uses only the local Git/SSH environment; never embed credentials in an HTTP(S) URL.

## Automatic Triggers

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/git_sync.py (reported line 321)May include surrounding context.

python

raise GitSyncError(f"Invalid Git branch name: {self.branch}")

    def _run(self, *arguments, cwd=None, check=True, timeout=120):
        environment = os.environ.copy()
        environment["GIT_TERMINAL_PROMPT"] = "0"
        try:
            result = subprocess.run(

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 76% confidence

Finding

The skill authorizes the agent to perform read-only actions automatically and normal mutations on the basis of an explicit user request, with high-risk actions potentially executed after read-only target resolution 'without asking again.' In a cloud operations skill that can manage deployments, jobs, SQL execution, and related resources, this increases the chance of unintended or over-broad actions if the target is misresolved, the user's request is ambiguous, or context is manipulated. The surrounding gates reduce risk, but the capability is still operationally dangerous because it permits the agent to turn interpreted intent into real platform actions.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

- **Read-only**: execute directly after the scope is clear and `config_doctor` succeeds.
- **Normal mutation**: create, update, deploy after validation, start, register, and similar actions. An explicit request to perform the action is authorization; add `--confirm` to the command. A request for options is not authorization.
- **High risk**: every `stop_*` and `delete_*` command, any restart or deployment flow that includes a stop, and destructive `execute_sql` statements such as `DROP` or `TRUNCATE`. A bare action request is not advance confirmation for a high-risk operation. If the current request explicitly confirms the high-risk action and its impact, and read-only resolution shows that the real target and strategy remain within the confirmed scope, report the resolved target and execute the CLI with `--confirm` without asking again. Otherwise, use [references/output-schemas.md](references/output-schemas.md) to restate the target, impact, strategy or irreversible consequence, and complete command, then wait for explicit confirmation.

Confirmation, including advance confirmation, applies only to the operations and targets in the current request. If multiple targets match, the scope changes, or the strategy is materially ambiguous, ask only for the missing information and do not reuse the confirmation. After a command fails, stop dependent steps. Never fabricate an ID, ticket, state, or successful result.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/configuration.md (reported line 80)May include surrounding context.

md

`region_id` is an API region. For example, the console host `flink-cn-beijing.data.aliyun.com` maps to `cn-beijing`. It is neither an availability zone nor a workspace ID.

Do not ask the user to paste an AccessKey ID or AccessKey secret into the conversation. Do not read or echo credential values, and never put real credentials in command examples.

## Preflight Check

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invocation text says to read this skill when the user wants to complete one or more lifecycle steps 'from natural language,' covering a very wide range of activities such as design, deployment, start/stop, changes, performance assessment, and troubleshooting. It does not define specific trigger phrases, boundaries, or exclusion conditions, so the skill could be invoked for many ordinary Flink-related requests without a clear cutoff.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file documents operations such as deploying to production and, elsewhere in the file, creating, stopping, and deleting resources, but provides no general warning that these actions can affect live systems or user data. Under the markdown-specific SQP-2 criteria, descriptions of behaviors that can affect system integrity should include explicit user-facing cautions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example encourages sending user-generated review text to an external large-model API without any notice about data handling, consent, redaction, or cross-boundary transmission. In a platform operations skill, this can normalize unsafe patterns where potentially sensitive or regulated text is forwarded to third-party inference services, creating privacy, compliance, or data-governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file describes INSERT INTO sink_table writes and later whole-database synchronization patterns, which can affect downstream systems and data integrity. Although the document is instructional, it does not include a clear caution that these examples perform real writes/replication outside of debug mode and may impact production data if run as-is.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/git_sync.py (reported line 324)May include surrounding context.

python

environment = os.environ.copy()
        environment["GIT_TERMINAL_PROMPT"] = "0"
        try:
            result = subprocess.run(
                ["git", "-c", "core.hooksPath=/dev/null", *arguments],
                cwd=cwd,
                text=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This generic proxy exposes broad backend access that exceeds the skill's stated lifecycle and troubleshooting purpose. Because it forwards user-supplied flink_api_path, resource_type, and resource_id with minimal restriction, it creates a capability-escalation surface: users can reach backend Flink APIs not otherwise modeled by safer dedicated commands, bypassing command-specific validation, confirmation, and least-privilege design.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This is a real vulnerability. The command is presented to users as a "read-only" Flink REST proxy, but the implementation accepts an arbitrary --flink_api_path and forwards it through client.flink_api_proxy_with_options without constraining method or path semantics. In a platform-management skill, that mismatch can enable unintended state-changing backend actions through a supposedly diagnostic interface, undermining confirmation and scope controls elsewhere in the CLI.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest example sets region_id to cn-beijing, which imposes a specific locale/region in natural-language/config content. Under the policy, locale constraints should either be user-selectable or clearly documented as region-specific and justified; this file provides neither.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · references/diagnosis/job-observability.md (reported line 606)May include surrounding context.

md

- API absent or rejected by proxy: verify target version, path, and permissions; do not conclude immediately that flame graphs are unsupported.
- Operator feature disabled, target ended, or sampling pending: report the actual state; do not collapse them into “no data.”
- JM/TM profiling failure: inspect the actual error and process logs. It may involve profiling scripts, native tools, event support, or system permissions; do not install tools or elevate permissions automatically.

### Thread Dumps

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown includes table.local-time-zone with the example Asia/Shanghai, which introduces a specific locale setting in natural language guidance. The document does not indicate that this locale is optional, user-selected, or justified as region-specific, so it can be read as prescriptive guidance that forces a locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The official documentation URLs use the /zh/ locale path, which directs users to Chinese-language content. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is documented and justified, which this file does not do.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation section hardcodes zh help URLs, effectively steering users to a specific language locale. There is no indication that Chinese-language documentation is intentional, optional, or paired with alternative locales.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/client.py (reported line 70)May include surrounding context.

python

for attr, env_name, config_key in fields:
        if not hasattr(args, attr):
            continue
        current = getattr(args, attr, None)
        if isinstance(current, str) and current.strip():
            args._scope_sources[attr] = "command line"
            continue

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/client.py (reported line 358)May include surrounding context.

python

missing argument.
    """
    for name in names:
        val = getattr(args, name, None)
        if val is None or (isinstance(val, str) and val.strip() == ""):
            return error_response(
                getattr(args, "subcommand", "unknown"),

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/metric_history.py (reported line 98)May include surrounding context.

python

class ConsoleClient:
    def __init__(self, args, cookie):
        for name in ("region_id", "workspace", "namespace"):
            if not re.fullmatch(r"[a-zA-Z0-9][a-zA-Z0-9_-]*", getattr(args, name) or ""):
                raise MetricError(f"Invalid {name} format.", "ValidationError")
        self.origin = f"https://flink-{args.region_id}.data.aliyun.com"
        self.base = self.origin + f"/api/v2/namespaces/{args.namespace}"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code hard-codes language=zh-CN when requesting the metric dashboard. This is a natural-language/locale policy concern because it enforces a specific locale regardless of user preference, and the file provides no opt-in or justification for the restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.