alibabacloud-flink-workspace-ops

• Outcome: Review
• Latest audit: Aug 17, 2026 · 6:15 AM UTC
• Version: 0.0.2

Overview

This skill is a real Alibaba Cloud Flink operations tool, but it pushes agents toward live cloud changes even when scope is missing or only placeholder IDs are available.

Install only if you intend to let the agent operate Alibaba Cloud Flink resources. Use least-privilege, preferably temporary credentials; avoid storing access keys in shell startup files; verify every workspace, namespace, region, and resource ID before allowing mutation or deletion; and be especially cautious with UDF, connector, execute_sql, deployment-target, and API-proxy commands.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill exposes powerful execution capabilities (shell, file read/write, environment access, MCP) while the finding indicates permissions are not explicitly declared in a dedicated permissions model. In a security-sensitive agent environment, undeclared capabilities reduce transparency and policy enforceability, making it easier for a triggered skill to perform unintended local actions or invoke cloud-affecting commands without clear governance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: This is a real scope-expansion risk: the skill is presented as handling a bounded set of Flink workspace operations, but it apparently supports a much broader and more sensitive command surface including destructive resource management, REST proxy access, UDF/custom connector management, and lineage/savepoint operations. Users, reviewers, and policy systems may authorize the skill based on the narrower description while the implementation can exercise materially more privileged actions than expected.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The command catalog exposes and normalizes operations that exceed the declared skill scope, including broader administrative and extensibility functions such as UDF, connector, deploy-target, and API proxy actions. This creates a scope-expansion risk: an agent or operator may invoke higher-risk capabilities under the guise of a workspace-ops skill, weakening least-privilege boundaries and increasing the chance of unintended or unauthorized changes.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The routing guide goes beyond intent classification and instructs the agent to force real command execution, including with placeholders and retries, even when the user has not supplied concrete scope or identifiers. In an operations skill that can mutate cloud resources, this expands the skill from passive routing into active behavior that can trigger unintended API calls or unsafe test actions.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The document says mutation and destructive actions require explicit user approval, but the command recipes and first-call rules instruct the agent to append `--confirm` immediately. That contradiction can cause the agent to bypass meaningful consent and perform state-changing actions in a live Alibaba Cloud Flink workspace.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The command is advertised as a "read-only" Flink REST proxy, but the implementation accepts an arbitrary --flink_api_path and directly forwards it via client.flink_api_proxy_with_options without any method/path allowlist or semantic enforcement of read-only behavior. In a skill intended for bounded workspace/deployment/job operations, this can expose unintended control-plane actions through hidden or less-reviewed REST endpoints, enabling state changes or access beyond the documented scope.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This file introduces a generic Flink API proxy capability that is broader than the skill metadata, which describes specific workspace/deployment/job lifecycle operations. Scope expansion like this is dangerous because it bypasses the narrower command model and may let users reach backend functionality that was not intended to be exposed, reviewed, or protected by operation-specific safeguards.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Accepting an arbitrary Flink API path is an unjustified capability for a narrowly scoped operational skill because it creates a universal escape hatch around per-operation validation and safety checks. In this context, users can potentially invoke sensitive Flink REST functionality not covered by confirmation prompts, parameter restrictions, or the documented skill contract.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This file adds developer-resource capabilities—UDF artifact upload/update, custom connector registration, and metadata-changing SQL execution—that are broader than the skill manifest’s declared focus on workspace lifecycle operations. That scope mismatch is dangerous because an agent or caller relying on the manifest for authorization/safety expectations could invoke powerful mutation paths that enable code introduction into Flink environments, metadata tampering, or job-affecting changes. The skill context increases risk because these operations directly target a production-like Flink control plane and include explicit bypass flags such as --confirm for destructive or code-loading actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill strongly instructs immediate execution of real cloud commands, including mutating and destructive actions, and even directs use of placeholder IDs when real IDs are missing. Although some later sections mention confirmation rules, the overall design biases the agent toward action-first behavior without a prominent upfront warning about operational impact, increasing the chance of unintended changes or unsafe evaluation behavior in production environments.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The protocol hard-codes `cn-beijing` as the default region when scope arguments are missing, causing commands to run against a specific environment without user selection. In a cloud operations skill, this can direct read or mutating actions at the wrong tenant resources, leading to unintended data exposure, failed operations, or accidental changes in an unexpected region.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: These lines instruct the agent to perform first execution attempts with `-r cn-beijing` even when the user did not specify a region, and to do so for positive or mutating workflows. In this skill context, best-effort execution against a fixed region increases the chance of acting on the wrong environment, especially because the same protocol also encourages execution with placeholder IDs and immediate mutation paths.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide instructs users to persist long-lived Alibaba Cloud access keys in shell startup files without warning about the security implications. Storing secrets in ~/.bashrc or ~/.zshrc increases the chance of credential leakage through backups, dotfile sync, shared accounts, screen sharing, shell history mistakes, or accidental commits, which is especially risky for a skill that operates on cloud workspaces and jobs.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation recommends executing a remote script directly via 'curl ... | bash' without any integrity verification, pinning, or review step. This creates a supply-chain risk: if the distribution endpoint, DNS, TLS trust chain, or script content is compromised, users may execute arbitrary code on their systems.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The instructions explicitly direct execution with placeholder IDs like `w-xxx`, `d-xxx`, and `draft-xxx`, plus default namespace/region values, before clarification. In a cloud operations context, this is dangerous because placeholder or default values can map to real resources in tests, staging, or poorly isolated environments, leading to accidental deployments, job starts/stops, member changes, or other unintended mutations.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: Forcing `cn-beijing` as the default first-call region without user opt-in or environment validation risks directing commands to the wrong tenancy or geography. In a multi-region cloud console, that can expose metadata, operate on unintended resources, or violate user expectations and regional controls.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.