alibabacloud-idaas-create-saml-idp

• Outcome: Review
• Latest audit: Oct 28, 2026 · 9:42 AM UTC
• Version: 0.0.1-beta.1

Overview

The SAML setup requires user approval, but download safeguards can be bypassed and existing agent session identifiers are sent to Alibaba Cloud without notice.

Before installing, ask the publisher to validate redirect destinations and remove existing agent-session identifiers from request metadata or provide explicit consent controls. Use a narrowly scoped RAM profile and request disabled creation for a staged rollout. The scanner's critical rating does not establish malicious behavior; the concrete download and privacy gaps justify Review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

--profile --instance-id --idp-id

text

Translate every failed check item into an actionable explanation. If the service returns `UnsupportedAction`, treat the script's result as a non-blocking capability warning: continue to `show`/`sp-metadata` and advise console verification. Use `check --skip-check` only when the user explicitly chooses to skip an unsupported or unavailable check. A successful configuration check does not prove browser SSO, account matching, NameID mapping, or authorization succeeds.

### 8. Complete external IdP setup and test login

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/idaas_saml_idp.py (reported line 134)May include surrounding context.

python

# EIAM expects flat SamlConfig.* keys, while CLI metadata exposes only
        # the top-level object. --force forwards those service-defined keys.
        command.append("--force")
    env = dict(os.environ)
    env["ALIBABA_CLOUD_USER_AGENT"] = (
        f"AlibabaCloud-Agent-Skills/alibabacloud-idaas-create-saml-idp/{invocation_session} "
        f"skill-version/{version}"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/idaas_saml_idp.py (reported line 1312)May include surrounding context.

python

identity_target(check_parser)
    check_parser.add_argument("--timeout", type=int, default=45)
    check_parser.add_argument("--interval", type=float, default=2.0)
    check_parser.add_argument("--skip-check", action="store_true")
    check_parser.set_defaults(handler=check)

    enable_parser = commands.add_parser("enable")

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

## Safety rules

- Run `doctor`, `instances`, `list`, `show`, `resolve`, and `plan` without confirmation because they are read-only.
- Before `create`, `update`, or `enable`, show a concise preview and obtain explicit user confirmation in the current conversation.
- Pass `--confirm CREATE`, `--confirm UPDATE`, or `--confirm ENABLE` only after that confirmation.
- Pass `--accept-warnings` only after showing every warning and receiving explicit acceptance.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

| 1 | | <instanceId> | RUNNING | EIAM 2.0 | |

text

After the table, ask the user to reply with the **number**. Also accept a complete Instance ID, exact instance name, or SSO domain when the user provides one. Resolve the chosen row to its Instance ID internally; never ask the user to look it up elsewhere or type it again.

Clearly mark non-running instances. Do not recommend or automatically select an instance merely because its name appears suitable. Use `instances --running-only` only when the user explicitly requests active instances only, and state when filtering is applied. Never infer an ambiguous instance.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

2. downloaded IdP metadata XML: `--metadata-file <local-path>`
3. manual fields: `--entity-id`, `--sso-url`, and one or two `--certificate-file` values

Require an identity-provider display name. Do not ask the user to copy Entity ID, SSO URL, and certificates when metadata is available. Metadata contains public certificates, never the private key.

Preserve the supplied metadata bytes and public certificate; do not regenerate a certificate, substitute a bundled lab asset, or silently repair a fingerprint discrepancy. When the user supplies an expected certificate fingerprint, pass `--expected-certificate-sha256 <fingerprint>` on `resolve`, `plan`, `create`, and `update` (repeat for two certificates). A mismatch must stop before cloud write and be resolved from the original source. The fingerprint is a constraint, not a value to copy into a computed result.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md

- Import signing certificates from metadata, deduplicate them, and accept at most two because EIAM supports at most two. If more are present, stop and ask which active/rollover certificates to use.
- Allow the user to change binding, request-signing requirement, clock skew, selected certificates, network access endpoint, and initial authentication status.
- Default the initial authentication status to `enabled`. Use `disabled` only when the user explicitly asks to create first and enable later.
- Accept “Continue with the recommended settings” as one confirmation without asking about every item separately.

### 5. Produce a creation plan

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md

ted SP handoff, even if the same information appeared earlier or is stored in files. Use the rendered Markdown above: all three labeled endpoint values for fields mode, or the complete validated XML for raw mode. An action summary saying “SP information delivered” is not the handoff.

Prepare this handoff after the last check or write, rather than replacing it with an action summary. For fields, run `sp-metadata --output-mode fields --output-format markdown` after the check and include its three endpoint values in the final answer. After a staged enable, include the returned `spHandoffMarkdown` verbatim: it repeats the same target's validated handoff without another download. In raw mode, if that block is unavailable, use `sp-metadata --output-mode raw --raw-input-file <previously-validated-file> --output-format markdown` for the same target and include the complete output. Preserve the selected output mode; do not ask the user to choose it again.

### 7. Run the official status check

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/idaas_saml_idp.py (reported line 78)May include surrounding context.

python

def require_cli(executable: str) -> str:
    result = subprocess.run([executable, "version"], capture_output=True, text=True, check=False)
    output = (result.stdout or result.stderr).strip()
    if result.returncode or parse_cli_version(output) < MINIMUM_CLI_VERSION:
        raise SkillError(

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/idaas_saml_idp.py (reported line 140)May include surrounding context.

python

f"skill-version/{version}"
    )
    env["ALIBABA_CLOUD_CLI_AI_MODE"] = "1"
    result = subprocess.run(command, capture_output=True, text=True, env=env, check=False)
    if result.returncode:
        raise SkillError((result.stderr or result.stdout or "Alibaba Cloud CLI call failed").strip())
    output = result.stdout.strip()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/idaas_saml_idp.py (reported line 328)May include surrounding context.

python

executable = shutil.which("curl")
        if not executable:
            raise urllib_error
        result = subprocess.run([
            executable,
            "--fail",
            "--silent",

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/test_run32294_regressions.py (reported line 30)May include surrounding context.

python

source=Path(d)/'idp.xml'; source.write_text(METADATA)
            r=m.resolve(args_for(str(source)))
            self.assertEqual(r['metadata']['entityId'], r['entityId'])
            self.assertEqual(hashlib.sha256(__import__('base64').b64decode('MAMCAQE=')).hexdigest(), r['certificateSha256'])
            self.assertTrue(r['ssoUrl'])
            self.assertIn('metadata',r)

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/test_run32294_regressions.py (reported line 64)May include surrounding context.

python

with patch.object(m,'cli',side_effect=[{'IdentityProviderStatusCheckJobId':'job'}, {'Status':status}]):
                    self.assertEqual('failed',m.check(self.args(d))['outcome'])
            with patch.object(m,'cli',return_value={'IdentityProviderStatusCheckJobId':'job'}):
                self.assertEqual('failed',m.check(self.args(d,timeout=0))['outcome'])

    def test_waf_then_enable_confirmation_still_blocks_without_cloud_write(self):
        with tempfile.TemporaryDirectory() as d:

Session identifiers are added to outbound CLI requests without disclosure.

Low

• Category: Output Handling
• Confidence: 94% confidence

Finding

The wrapper reads agent session identifiers from environment variables and embeds them in the CLI user-agent environment setting for outbound cloud requests. Reusing an existing agent session identifier unnecessarily exposes cross-system correlation information to the cloud service and its request logs, without disclosure in the supplied source.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/test_idaas_saml_idp.py (reported line 166)May include surrounding context.

python

args = args_for(self.metadata_file(), confirm=operation.upper(), idp_id="idp_test",
                                expected_certificate_sha256=["00" * 32])
                with self.assertRaisesRegex(MODULE.SkillError, "Certificate SHA-256 mismatch"):
                    getattr(MODULE, operation)(args)
        mocked_cli.assert_not_called()

    def test_certificate_pin_accepts_colon_case_and_rejects_extra_certificate(self):

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_idaas_saml_idp.py:13