Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed read-only diagnostic skill for Alibaba Cloud load balancer health checks, with expected use of existing cloud credentials and local report files.
Install only if you intend to let the agent inspect Alibaba Cloud load balancer health-check metadata through your aliyun CLI profile. Use the provided read-only RAM policy, keep generated reports secure, and review any customer-facing shell commands before running them on backend servers.
The skill directs use of shell, network, file read/write, and environment-derived credentials, but it declares no explicit permissions or trust boundaries. That creates an authorization gap: a host agent may run broad CLI/API calls and write reports to disk without a least-privilege contract, increasing the chance of unintended access or data exposure.
The module documentation asserts it never reads credentials or config, but the code later reads ~/.aliyun/config.json to resolve the active region. This is a trust and transparency issue: misleading security claims can cause operators to approve or deploy the skill under false assumptions about local data access.
The script advertises itself as a read-only diagnostics tool that never changes configuration, but it does perform local filesystem writes when --output is supplied, including creating parent directories and writing the generated report. This is not a cloud-side mutating action, but it is still a side effect that can overwrite files or place sensitive infrastructure data on disk if an untrusted path is provided by a caller.
The skill template constructs shell commands using untrusted placeholders such as , , , and <PROBE_IP>. If those values come from cloud metadata, user input, or a compromised upstream source and are inserted without strict validation/escaping, they can produce command injection, argument injection, or unsafe command behavior when copied or executed by an operator.
- TCP/HTTP/HTTPS: `ss -tlnp | grep ':<PORT>'`
- UDP: `ss -ulnp | grep ':<PORT>'`
2. Verify local connectivity (pick by health-check protocol):
- HTTP: `curl -v -X <METHOD> http://127.0.0.1:<PORT><PATH>`
- HTTPS: `curl -v -k -X <METHOD> https://127.0.0.1:<PORT><PATH>`
- TCP: `telnet 127.0.0.1 <PORT>`
- UDP: skip this step