Alibabacloud Flink Workspace Ops

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 0.0.1

Overview

This is a real Alibaba Cloud Flink operations skill, but it gives the agent broad live cloud-changing authority with under-scoped controls and a generic API proxy.

Install only in a sandbox or tightly scoped Alibaba Cloud account unless you are comfortable with the agent making live Flink workspace changes. Use least-privilege RAM policies, avoid production credentials, do not persist long-lived access keys in shell profiles, review any --confirm command before it runs, and avoid the generic Flink API proxy unless you understand exactly which backend endpoint is being called.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: `flink_api_proxy` introduces an open-ended proxy capability that can bypass the skill's narrowly described operation boundaries and potentially expose arbitrary backend API actions. In an agent setting, this is dangerous because a user or prompt-injection chain could leverage the generic proxy to perform unintended reads, mutations, or destructive operations outside the approved workflow catalog.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The file instructs the agent to execute real mutating and destructive commands as the first step, even when identifiers and scope are missing, by substituting placeholder IDs like `w-xxx` and `d-xxx`. That behavior bypasses normal confirmation and validation expectations, and in an operations skill for cloud workspace resources it creates a real risk of unintended API calls, unsafe test execution, or accidental changes if placeholder-like values resolve or if the execution path is reused against live environments.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documented safety labels say mutation and destructive actions need explicit approval, but the mandatory first-call rules earlier instruct immediate execution with `--confirm` and placeholder values. This contradiction weakens guardrails: an orchestrating agent may follow the more forceful execution rule and perform state-changing operations without meaningful user confirmation or validated parameters.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill exposes a generic `flink_api_proxy` that accepts an arbitrary `flink_api_path` and forwards it to the backend, which materially exceeds the narrowly described workspace-operations scope in the manifest. Even if intended for diagnostics, a generic proxy can be used to reach undocumented or sensitive Flink REST endpoints and bypass the safer, purpose-built command surface the skill otherwise provides.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The CLI advertises the Flink API proxy as 'read-only', but the implementation does not enforce read-only semantics at all; it simply accepts a user-supplied path and calls the proxy API. This mismatch is dangerous because operators and higher-level agents may trust the safety claim and invoke an endpoint that can mutate state, stop jobs, trigger actions, or expose sensitive operational data.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill metadata says it should be used for Flink/Ververica workspace operations such as drafts, deployments, jobs, session clusters, namespaces, tables, members, variables, and SQL validation/execution, but this file also exposes UDF artifact/function and custom connector registration/deletion capabilities. That scope expansion is dangerous because it lets the agent perform higher-risk supply-chain style actions—uploading executable artifacts or registering arbitrary connector JARs—under a skill that users and routing logic may trust for narrower workspace administration tasks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide instructs users to export long-lived Alibaba Cloud access keys and persist them in shell profile files without warning about shell history, file permissions, local compromise, or accidental exposure through backups and dotfile sync. While common in quickstart docs, this increases the chance of credential leakage and unauthorized access to cloud resources.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation presents a remote install pipeline directly into bash without any warning, integrity verification, or review step. This normalizes execution of network-fetched code and creates a supply-chain risk if the hosting endpoint, DNS, TLS trust chain, or script content is compromised.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill requires commands to be executed with placeholder resource IDs and default scope values such as `w-xxx`, `default`, and `cn-beijing` without warning the user about possible side effects. In a cloud operations context, this is dangerous because it normalizes best-effort execution against potentially incorrect targets, can generate unintended requests, and may create, start, stop, or deploy resources under the wrong workspace or region.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script is designed to execute real, state-changing Alibaba Cloud API operations using credentials from environment variables, but it provides no in-script interactive warning, dry-run guard, or prominent safety disclosure before doing so. In this skill context, that is more dangerous because the script creates, updates, starts, stops, and deletes live Flink workspace resources, so accidental execution can cause unintended operational impact and cloud-side changes.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.