Security audit

Alibabacloud Kvstore Health Inspection

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for Redis/Tair health reporting, but it uses unsafe installation and dependency behavior and produces sensitive reports with script-injection risks.

Install only in a controlled environment with least-privilege read-only Alibaba Cloud credentials. Avoid the curl-to-bash installer paths, review and pin CLI/plugin versions yourself, disable Aliyun auto plugin installation after use, and treat generated HTML reports as sensitive files that should not be opened with network access or shared broadly.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:173
Finding: Unverified Remote Installation Script Execution
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/health-inspect.py:77
Finding: Automatic Installation of Unpinned Aliyun CLI Plugins
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/health-inspect.py:1620
Finding: Stored HTML Injection Through Unescaped Cloud and Redis Data
Content: View full analysis
{i}{addr}{cmd}{age}{idle}{db}{node_id}{flags}{fd}{events}{name}{sub}{psub}{multi}{obl}{oll}{omem}{qbuf}' ``` ```python for i, nd in enumerate(db_details, 1): node_topology_html += f'{i}{nd.get("node_id", "")}{nd.get("memory", "")}{nd.get("connection", "")}{nd.get("bandwidth", "")}' ``` ```python for i, k in enumerate(large_keys[:10], 1): ds = int(k.get('data_size', 0)) size_str = f'{ds/1024:.1f}KB' if ds < 1024*1024 else f'{ds/(1024*1024):.2f}MB' bigkey_html += f'{i}{k.get("db", 0)}{k.get("type", "")}{size_str}{k.get("key", "")[:60]}' for i, k in enumerate(bk[:10], 1): bigkey_html += f'{i}{k.get("db", 0)}{k.get("type", "")}{k.get("size", 0)}{k.get("key", "")[:60]}' ``` ### Technical Analysis Values retur ...[truncated 1984 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/health-inspect.py:1959
Finding: Mutable Third-Party JavaScript Executes Inside Sensitive Reports
Content: View full analysis
``` ### Technical Analysis Generated HTML reports retrieve ECharts from a public CDN each time a report is opened. The dependency is pinned only to the broad major version `5`, not to an immutable release or reviewed artifact, and no Subresource Integrity hash is supplied. The CDN script executes in the same document as sensitive inspection data. It therefore has normal DOM access to client IP addresses, Redis key names, instance metadata, topology, slow-log information, alerts, and recommendations. A health report should be usable offline and does not need to execute mutable Internet-hosted code. Loading the dependency at viewing time allows the effective report code to change after generation and after this Skill was reviewed. ### Attack Path 1. The Skill generates an HTML report containing the external script reference. 2. An operator opens the report while connected to the Internet. 3. The browser requests the broad-version ECharts asset from the CDN. 4. A compromise of the CDN, package publication account, dependency release, or delivery path supplies malicious JavaScript. 5. The browser executes that JavaScript in the report document. 6. The script reads report contents and can transmit them through outbound requests. ### Impact Assessment Exploitation can disclose all information in every report opened with the compromised dependency. It can also falsify charts and recommendations, inject phishing content, or redirect the operator. The dependency does not directly grant operating-system or Alibaba Cloud API privileges, but it executes within a document containing a concentrated set of sensitive operationa ...[truncated 13 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/check-write-operation.sh:83
Finding: Write-Operation Enforcement Hook Can Be Bypassed
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (72)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents the skill as a Redis/Tair health inspection and HTML report generation tool. However, the provided code does not perform inspection, collect metrics, analyze instances, generate reports, or implement any of the seven described health-check dimensions. Instead, it acts as a command-guard hook that inspects outgoing CLI commands and enforces allow/ask/deny decisions based on whether operations appear read-only or write-capable. While this hook may support a broader health-inspection workflow by preventing accidental writes, its primary behavior is access control and safety enforcement, which is a materially different capability from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description describes a full-featured Redis/Tair health inspection and HTML reporting tool. The supplied code only queries a single API action (describe-instance-attribute) across a hardcoded list of regions to locate one instance by ID and print a few basic attributes. It does not perform diagnostics, trend analysis, slow log analysis, alert retrieval, recommendation generation, or any batch/full-account inspection workflow. This is a clear material mismatch in primary purpose and implemented capabilities.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 309)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 312)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 318)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 321)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 324)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 330)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 333)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 336)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 339)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 353)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 359)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 362)May include surrounding context.
md
> **Core Rule: All inspections MUST be executed via `python3 scripts/health-inspect.py`.**