ClawHub
Back to skill

Security audit

alibabacloud-idaas-ad-ldap-integration

Security checks for vulnerabilities and agentic risk

Overview

The skill’s directory integration capabilities are disclosed and bounded by approval requirements, limited access, and synchronization safeguards.

Use a dedicated cloud identity with only the required permissions and a read-only directory bind account. Start with a small test subtree, review every firewall or synchronization change, and keep passwords outside chat. Synchronization can delete accounts and continues on its configured schedule; deleting the identity provider does not undo imported accounts or organizations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The supplied command changes ECS security-group authorization; it does not check local CLI availability or perform directory integration or offline evidence analysis. Network security-rule modification is not declared, and the snippet provides no context establishing it as a supporting integration step. Although placeholders leave the precise rule and successful execution uncertain, the command's intended capability is materially outside the stated scope.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md
### Credential Handling Rules

- Prefer manual entry in the console, or hand the user a complete command containing `<AD_ADMIN_PASSWORD>`/`<LDAP_ADMIN_PASSWORD>` for them to substitute and execute in their local terminal; you MUST NEVER ask the user to paste the substituted command back into the conversation.
- `ldapsearch` MUST use `-W` for interactive password entry, keeping the password out of the parameters and the shell history.
- When you must run it on the user's behalf, use only a temporary credential file with permissions 600 together with `ldapsearch -y <PASSWORD_FILE>`, set `umask 077`, and securely clean it up immediately after execution; never output the file contents, sensitive values within paths, or environment variable values to the logs.
- If reading silently into a shell variable, bash can use `read -rs`; zsh MUST NOT use the `read -p` form, which triggers `no coprocess` — use zsh's native prompt syntax or switch to bash.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

md
### S5: Configure the Synchronization Cadence

- AD incremental synchronization runs roughly every 10 minutes; the first activation may automatically perform a full synchronization.
- Enabling scheduled reconciliation as compensation for incremental synchronization is recommended.
- AD group synchronization is optional; `GroupObjectClass=top,group` and `GroupMemberAttributeName=member` are commonly used.
- Retain synchronization protection: 30 accounts, 10 organizations, 10 groups; raising the thresholds is NEVER a substitute for a small-scope trial run.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 497)May include surrounding context.

md
- AD inbound: `https://help.aliyun.com/zh/idaas/eiam/user-guide/bind-idaas-to-ad`
- OpenLDAP inbound: `https://help.aliyun.com/zh/idaas/eiam/user-guide/bind-idaas-to-openldap`
- GetIdentityProvider: `https://help.aliyun.com/zh/idaas/eiam/developer-reference/api-eiam-2021-12-01-getidentityprovider`
- Eiam OpenAPI portal: `https://api.aliyun.com/product/Eiam`
- Internal parameter verification portal: `https://apiworkbench.aliyun-inc.com`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/identity-provider-mapping-api.md (reported line 76)May include surrounding context.

md
Preserve the full old mapping, including optional fields and identity matching configuration. Show the full intended replacement and explain username/primary-key mismatch, deletion/recreation, and downstream authorization risks. Obtain authorization, write the complete configuration, then read back and compare every item. Do not trigger a synchronization merely because the mapping write succeeded. Organization/group mappings and the other S6 gates must be verified separately; this user-profile response does not establish them.

Authoritative portals: https://api.aliyun.com/product/Eiam and https://apiworkbench.aliyun-inc.com .

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/eiam_read.py (reported line 118)May include surrounding context.

python
if args.action in SCOPED_ARGUMENTS:
        required.append(SCOPED_ARGUMENTS[args.action])
    for name in required:
        value = getattr(args, name)
        if not isinstance(value, str) or not re.fullmatch(r"[A-Za-z0-9_-]{1,64}", value):
            parser.error(name.replace("_", "-") + " is required and must be a valid resource ID")
    if not re.fullmatch(r"eiam\.[a-z0-9-]+\.aliyuncs\.com", args.endpoint):

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/eiam_read.py (reported line 138)May include surrounding context.

python
# Exception messages/data may include request values or credentials.
        safe = {"error_type": type(error).__name__}
        for key in ("code", "request_id", "status_code"):
            value = getattr(error, key, None)
            if value is not None and re.fullmatch(r"[A-Za-z0-9_.:-]{1,128}", str(value)):
                safe[key] = value
        print(json.dumps(safe), file=sys.stderr)

The renderer fixes the handover report language to Chinese without offering a language choice.

Low
Category
Output Handling
Confidence
94% confidence
Finding

The report headings and guidance are hardcoded in Chinese, regardless of the user's language. The script provides no locale option, user opt-in, or documented justification for this language constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.