ClawHub
Back to skill

Security audit

alibabacloud-lb-healthcheck

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed read-only diagnostic skill for Alibaba Cloud load balancer health checks, with expected use of existing cloud credentials and local report files.

Install only if you intend to let the agent inspect Alibaba Cloud load balancer health-check metadata through your aliyun CLI profile. Use the provided read-only RAM policy, keep generated reports secure, and review any customer-facing shell commands before running them on backend servers.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill directs use of shell, network, file read/write, and environment-derived credentials, but it declares no explicit permissions or trust boundaries. That creates an authorization gap: a host agent may run broad CLI/API calls and write reports to disk without a least-privilege contract, increasing the chance of unintended access or data exposure.

Intent-Code Divergence

Medium
Confidence
83% confidence
Finding
The module documentation asserts it never reads credentials or config, but the code later reads `~/.aliyun/config.json` to resolve the active region. This is a trust and transparency issue: misleading security claims can cause operators to approve or deploy the skill under false assumptions about local data access.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The script advertises itself as a read-only diagnostics tool that never changes configuration, but it does perform local filesystem writes when --output is supplied, including creating parent directories and writing the generated report. This is not a cloud-side mutating action, but it is still a side effect that can overwrite files or place sensitive infrastructure data on disk if an untrusted path is provided by a caller.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- TCP/HTTP/HTTPS: `ss -tlnp | grep ':<PORT>'`
   - UDP: `ss -ulnp | grep ':<PORT>'`
2. Verify local connectivity (pick by health-check protocol):
   - HTTP: `curl -v -X <METHOD> http://127.0.0.1:<PORT><PATH>`
   - HTTPS: `curl -v -k -X <METHOD> https://127.0.0.1:<PORT><PATH>`
   - TCP: `telnet 127.0.0.1 <PORT>`
   - UDP: skip this step
Confidence
90% confidence
Finding
The skill template constructs shell commands using untrusted placeholders such as <METHOD>, <PORT>, <PATH>, and <PROBE_IP>. If those values come from cloud metadata, user input, or a compromised upstream source and are inserted without strict validation/escaping, they can produce command injection, argument injection, or unsafe command behavior when copied or executed by an operator.

Static analysis

No suspicious patterns detected.