alibabacloud-flink-workspace-ops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:14 AM UTC
• Version: 0.0.2

Overview

This skill is for Alibaba Cloud Flink workspace operations, but it pushes agents toward live cloud changes with guessed IDs and has several under-scoped credential and installation risks.

Review before installing. Use only with a least-privilege Alibaba Cloud identity in a non-production workspace, avoid the curl-to-bash installer, do not store access keys in shell profiles, and do not let the agent run mutating or destructive commands until you have verified the exact workspace, region, namespace, and resource IDs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/cli-installation-guide.md:37

Finding

Optional Alibaba Cloud CLI installation executes an unverified remote script

Content

View full analysis

= 3.3.1) aliyun version ``` ### Technical Analysis The command streams content retrieved from a mutable external URL directly into Bash. The remote response is neither saved for inspection nor verified against a pinned cryptographic hash or vendor signature before execution. Although the hostname appears associated with Alibaba Cloud, the effective payload can change after this Skill has been reviewed. Compromise of the distribution server, CDN, DNS resolution, release process, or TLS trust chain could consequently turn the installation instruction into arbitrary local code execution. This behavior also exceeds the minimum privileges needed by the Skill. The installation guide describes the Alibaba Cloud CLI as optional, while `SKILL.md` and `scripts/client.py` state that the actual Skill uses the Alibaba Cloud Python SDK directly. ### Attack Path 1. An attacker compromises or gains control over the remote installer response, its distribution infrastructure, or a relevant trust dependency. 2. A user follows the installation guide and invokes the documented command. 3. `curl` downloads the attacker-controlled response. 4. The shell begins interpreting the response immediately, without integrity verification or an opportunity for review. 5. The payload executes with the privileges of the user running Bash. 6. It can inspect accessible cloud credential files, alter local files, install persistence, or execute additional payloads. ### Impact Assessment Successful exploitation provides arbitrary command execution in the invoking user's security context. The accessible scope may in ...[truncated 445 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:133

Finding

Skill instructions coerce live cloud operations with fabricated resource identifiers

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/w5_workspace_admin.py:202

Finding

Workspace variable responses are printed without sensitive-field redaction

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:48

Finding

Installation guide recommends plaintext persistence of long-lived cloud credentials

Content

View full analysis

> ~/.bashrc echo 'export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret' >> ~/.bashrc source ~/.bashrc ``` ### Technical Analysis The instructions encourage users to store a long-lived access key ID and secret in plaintext in `~/.bashrc` or a similar startup file. Shell profiles are loaded into every interactive shell and are frequently included in backups, diagnostic archives, dotfile repositories, development containers, and support bundles. Any user-context process capable of reading the profile can recover the credentials. Every child process of the shell may also inherit the exported values, expanding the exposure boundary. Persistent access keys are not required by the implementation. `scripts/client.py` uses Alibaba Cloud's default credential chain, which can support RAM roles and other mechanisms with shorter credential lifetimes and narrower exposure. ### Attack Path 1. A user follows the guide and writes an access key secret into `~/.bashrc`. 2. The credential remains stored across sessions and is exported into subsequently launched processes. 3. Malware, a compromised development dependency, an overly broad backup, a diagnostic tool, or another user-context process reads the file or inherited environment. 4. The attacker extracts the access key ID and secret. 5. The attacker authenticates to Alibaba Cloud outside the affected host. 6. The attacker exercises all permissions assigned to the compromised RAM identity until the key is revoked or expires. ### Impact ...[truncated 554 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: assets/requirements.txt:1

Finding

Python dependency installation lacks artifact hash verification

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description claims a bounded set of workspace operations, but the instructions indicate broader product-surface actions such as metadata browsing and potentially additional management domains not clearly disclosed in the top-level description. That kind of scope drift increases the chance of overbroad execution and users invoking capabilities they did not intend to authorize.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill description claims a bounded set of workspace operations, but the instructions indicate broader product-surface actions such as metadata browsing and potentially additional management domains not clearly disclosed in the top-level description. That kind of scope drift increases the chance of overbroad execution and users invoking capabilities they did not intend to authorize.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This line fetches an external script from the internet and executes it locally. Any compromise of the hosting source or delivery path would allow arbitrary command execution, which is especially dangerous in an installation guide because users are primed to run the command verbatim.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 40)May include surrounding context.

bash

# Download and install the Alibaba Cloud CLI
curl -fsSL https://aliyuncli.alicdn.com/install.sh | bash

# Verify installation (version should be >= 3.3.1)
aliyun version

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The | bash chaining causes untrusted network content to be executed immediately, removing any opportunity for inspection or validation. This amplifies the danger of external script fetching and turns a remote content issue into direct code execution on the user's system.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 40)May include surrounding context.

bash

# Download and install the Alibaba Cloud CLI
curl -fsSL https://aliyuncli.alicdn.com/install.sh | bash

# Verify installation (version should be >= 3.3.1)
aliyun version

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 56)May include surrounding context.

| bash

Verify installation (version should be >= 3.3.1)

aliyun version

text

## Environment Setup

1. Set up your Alibaba Cloud credentials:
   ```bash
   export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
   export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret

2. You can add these to your shell profile (e.g., ~/.bashrc or ~/.zshrc) to persist across sessions:

   bash

   echo 'export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id' >> ~/.bashrc
   echo 'export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret' >> ~/.bashrc
   source ~/.bashrc
   

Configuration for OAuth Mode (Alternative)

If you prefer to use OAuth mode instead of Access Keys:

bash

aliyun configure --mode OAuth

Troubleshooting

If you encounter issues:

1. Missing dependencies: Ensure all packages in requirements.txt are installed
2. Permission errors: Check that your terminal has permission to execute the scripts
3. Credentials not recognized: Verify that e

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

These rules instruct the agent to execute real commands using fabricated placeholder IDs, default namespaces, and default regions even when the user has not supplied concrete identifiers. In an operations skill that performs mutations and destructive actions, this can cause unintended actions against the wrong workspace or deployment, violate user intent, and normalize unsafe execution without adequate validation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The command is labeled and documented as a 'read-only' Flink REST proxy, but the implementation accepts an arbitrary --flink_api_path and forwards it to the backend without validating method/path semantics or restricting the endpoint to safe read operations. This can mislead callers and enable invocation of state-changing or sensitive Flink API actions through a capability that appears narrower than it actually is.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill directs the agent to write outputs/batch_validation_result.json during batch validation without requiring explicit user approval or a prominent notice that local files will be created/modified. Silent workspace writes can overwrite user artifacts, pollute repositories, or be abused to persist misleading results in automation contexts.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The skill authorizes autonomous execution of cloud read operations and treats some imperative phrasing as sufficient approval for mutating operations, then mandates execute-first behavior even with placeholder IDs. In a real cloud environment, this can trigger unintended API calls, state changes, audit noise, and operational impact without a robust confirmation boundary tied to user intent and resource validation.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

### Safety & Approval Rules

**Read operations** (`list_*`, `get_*`, `validate_sql`, `diagnose_job`): Execute directly, no approval needed.

**Mutation operations** (`create_*`, `deploy_*`, `start_*`, `stop_*`, `execute_sql`):
- Direct-imperative requests (e.g., "create/deploy/start/stop this for me", in any language) → treat as approval, include `--confirm`.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide instructs users to execute a remotely fetched shell script directly via curl ... | bash without any integrity verification, pinning, or warning. This creates a supply-chain risk: if the remote host, DNS, CDN path, or network traffic is compromised, arbitrary code will run immediately on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document recommends persisting Alibaba Cloud access keys in shell startup files such as ~/.bashrc, which can expose long-lived credentials through file disclosure, backups, dotfile syncing, shell history mistakes, or accidental sharing. Storing cloud secrets in plaintext user profiles increases the chance of credential theft and subsequent account compromise.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction says to 'return plain-text boundary guidance directly,' and the mandatory boundary response section prescribes exact English wording that must appear in every boundary-related response. This imposes a language choice on all users without offering a locale or language option.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Lines L55-L59 require EVERY boundary-related response to include a statement asserting that drafts, deployments, jobs, session clusters, namespaces, tables, members, and variables belong to this skill. That contradicts the manifest and earlier routing rules, which say the skill should not trigger for unrelated contexts and should only be used for explicit workspace-ops requests; forcing this statement into all boundary responses changes the behavior from narrow routing guidance to promotional self-routing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

These lines require two exact statements to appear in every boundary-related response, which effectively forces English output regardless of the user's language preference. The file does not provide any opt-in, locale selection, or justification for this restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file documents permissions for operations including deletion, deployment, job control, and workspace administration, but it does not clearly warn users that these actions can modify or remove resources and affect running systems. Under the markdown-specific missing-warning rule, descriptions of behaviors that can affect user data or system integrity should include an explicit caution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The troubleshooting advice says to use '*' resource for testing, which normalizes temporarily broadening scope to all resources without emphasizing the risk. In a skill centered on live workspace and job operations, this can lead operators to attach overbroad permissions that enable unintended modification, deletion, or execution across all Flink workspaces if the temporary policy is not promptly removed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file documents skill-related APIs and includes destructive operations such as deleting deployments, savepoints, and session clusters, including one explicitly marked irreversible, but provides no overall warning about impact on user data or system integrity. Under the markdown-specific SQP-2 criteria, the description should disclose that the skill may perform destructive operations affecting production resources.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/e2e_test.py (reported line 34)May include surrounding context.

python

"""Run flink_ververica_ops.py and return parsed JSON."""
    cmd = [sys.executable, "flink_ververica_ops.py"] + list(args)
    try:
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
    except subprocess.TimeoutExpired:
        return {"success": False, "error": {"message": f"CLI timeout after {timeout}s"}, "_timeout": True}
    # Try to parse JSON from stdout

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This skill is described as handling bounded Flink workspace operations, but it also exposes a generic Flink API proxy that can reach arbitrary REST paths. That broad escape hatch bypasses the tighter, explicit command model used elsewhere in the file and expands the skill's effective authority beyond the manifest's stated scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes the skill as for Flink Console workspace operations such as drafts, SQL validation/execution, deployments, jobs, session clusters, namespaces, tables, members, variables, and checkpoint-timeout diagnosis. In contrast, this file adds management of UDF artifacts/functions and custom connectors, which are distinct development-resource capabilities not mentioned in the manifest examples or scope statement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The guardrail testing protocol requires the agent to emit an exact English line, SafetyCheckRequired: This operation requires --confirm flag to proceed., for every tested operation. This mandates a specific language in user-facing output without offering a language choice or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/client.py (reported line 298)May include surrounding context.

python

Returns None if OK, or an error-dict describing the first missing param.
    """
    for name in names:
        val = getattr(args, name, None)
        if val is None or (isinstance(val, str) and val.strip() == ""):
            return error_response(
                getattr(args, "subcommand", "unknown"),

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This Python file contains natural-language docstrings, comments, assertions, and user-facing print messages entirely in Chinese, including the success output shown at runtime. For a general-purpose conversion script, this imposes a specific language/locale without offering user choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.