alibabacloud-ipsec-vpn-negotiation-doctor

• Outcome: Review
• Latest audit: Oct 27, 2026 · 12:19 PM UTC
• Version: 0.0.1

Overview

The VPN diagnosis is read-only, but setup automatically installs or upgrades local software without a clear user approval step.

Preinstall a reviewed CLI and VPC plugin, require approval for software changes, and limit cloud credentials to the two documented read operations on the target VPN. Treat retrieved network configuration and logs as sensitive.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/diagnostic_patterns.json (reported line 3)May include surrounding context.

json

{
  "version": "1.0",
  "description": "Alibaba Cloud IPSec VPN negotiation failure log pattern matching knowledge base (customer edition)",
  "usage_instruction": "After retrieving VPN negotiation logs, match each error line against categories[].patterns[].regex. On match, output the corresponding cause and solution. If multiple patterns match, sort by priority (lower number = higher priority).",
  "categories": [
    {
      "category": "encryption_algorithm_mismatch",
      "description": "Phase1 or Phase2 encryption algorithm mismatch",
      "phase": "phase1_or_phase2",
      "patterns": [
        {
          "i

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

6. If the wrapper script itself fails to execute (command not found, timeout, connection error), re-run it once -- do NOT fall back to direct CLI. If the wrapper returns a clear API error code such as `Forbidden.RAM`, `InvalidParameter`, `Throttling`, `InternalError`, or `NotFound`, follow Step 0 and do NOT re-run.
7. **Never emit a configuration-changing CLI command in any form** -- not as an example, not as a "for reference" snippet, not inside a code block, and not while explaining what you are declining to do
8. **When you decline a change request, do not name, spell out, quote, or echo the write operation itself.** Describe the required change in plain words and send the user to the Alibaba Cloud console
9. **Do NOT ask the user more than one clarifying question when data cannot be obtained.** State what is missing, make one concise request if needed, then stop.

---

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md

fy and respond as follows:
   - **Permission error** (`Forbidden.RAM`, `NoPermission`, `Unauthorized`): Tell the user the current account lacks read permission and to attach the RAM policy `vpc:DescribeVpnConnection` and `vpc:DescribeVpnConnectionLogs`. Do not fabricate a diagnosis.
   - **Parameter error** (`MissingParameter`, `InvalidParameter`, `InvalidVpnConnectionId.NotFound`) or `[NOT FOUND]`: Tell the user the specified VPN connection ID was not found in the given region. Advise checking the connection ID and region for typos. Do NOT ask the user for a new ID or region; stop here. Do not call other APIs to verify.
   - **Throttling** (`Throttling.User`, `Throttling`): Advise retrying after a few seconds; do not treat it as a VPN negotiation failure.
   - **Internal / service error** (`InternalError`): Advise retrying later or opening an Alibaba Cloud ticket; state that diagnostic data could not be obtained.
5. Never echo raw PSK, AccessKey, or full RequestId in the final answer.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

md

- **Throttling** (`Throttling.User`, `Throttling`): Advise retrying after a few seconds; do not treat it as a VPN negotiation failure.
   - **Internal / service error** (`InternalError`): Advise retrying later or opening an Alibaba Cloud ticket; state that diagnostic data could not be obtained.
5. Never echo raw PSK, AccessKey, or full RequestId in the final answer.
6. Do NOT ask the user any clarifying question. State the blocking reason and stop.

### Step 1: Query Tunnel Status and Config

The diagnostic skill automatically installs or upgrades software on the host, beyond its VPN diagnosis purpose.

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The setup instructions direct the agent to install or upgrade host software without obtaining explicit approval, including a noninteractive upgrade using --yes. Although the CLI is a legitimate diagnostic prerequisite, these persistent host changes exceed a read-only VPN diagnosis and can disrupt other workloads or introduce unreviewed dependencies.

Content

No source excerpt is available for this finding.

The setup workflow installs or upgrades software and executes a remote script without warning the user about system changes.

Medium

• Category: Output Handling
• Confidence: 98% confidence

Finding

The fresh-install command downloads a remote script and immediately executes it with Bash, without integrity verification or a review step. The apparent vendor-hosted HTTPS endpoint reduces suspicion of deliberate exfiltration but does not prevent a compromised distribution source from executing arbitrary code with the agent's host permissions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.