Security audit

Alibabacloud Lindorm Agent Skill

Security checks across malware telemetry and agentic risk

Overview

This Lindorm skill is mostly coherent for Alibaba Cloud database help, but it gives agents high-impact database, credential, and local tool-install authority with several under-scoped or conflicting safety boundaries.

Install only if you are comfortable with an agent using Alibaba Cloud credentials and Lindorm database access. Use least-privilege read-only RAM credentials where possible, avoid pasting secrets into chat or shell commands, verify any downloaded CLI manually, and require explicit human review before any SQL that creates users, changes permissions, writes data, deletes data, disables SSL, or removes safe-mode protection.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The quick-start guide includes a Streaming Engine workflow even though the skill metadata does not describe streaming capabilities. This scope mismatch can cause the agent to answer outside its declared authority, increasing the chance of unsafe or incorrect operational guidance being provided to users.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The guide is primarily framed around search and inspection use cases, but it also includes document write and refresh operations without clearly separating them as state-changing actions. In an agent skill context, this can cause the agent to modify production index data when a user expected read-only diagnostics, increasing the risk of unintended data tampering.

Intent-Code Divergence

Low

Confidence: 79% confidence
Finding: The evidence output format documents only connectivity and read actions even though the guide includes write and refresh examples. This creates an audit gap where destructive or state-changing actions may occur without standardized reporting, making misuse or accidental writes harder to detect and investigate.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The file establishes a safety boundary that the agent must not directly create users or change permissions, but the surrounding content still gives prescriptive operational guidance for those privileged actions. This creates a policy-to-behavior contradiction that can cause an agent to facilitate sensitive IAM changes anyway, increasing the chance of privilege escalation or unauthorized access.

Intent-Code Divergence

Low

Confidence: 90% confidence
Finding: The example response tells the user 'I can help you create a read-only account,' which undermines the earlier restriction that the agent must not directly create users or grant permissions. Even if framed as assistance, this wording trains the agent toward operational execution rather than safe deferral for a sensitive access-control task.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: These sections provide executable CREATE USER and GRANT commands despite the document's explicit rule against directly creating users or modifying permissions. In a security-sensitive skill, supplying ready-to-run privilege management commands materially lowers the barrier for unauthorized or mistaken account changes.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The file explicitly states an agent rule to never use `aliyun configure set` with literal credentials, then later provides multiple examples that do exactly that. In an agent skill context, these examples are likely to be copied into responses or automation, causing credential disclosure in chat logs, shell history, CI logs, and process listings.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The guide directs the agent to automatically download, unpack, chmod, and replace a local executable, which exceeds a documentation/query skill’s expected scope and creates a host-modification capability. This is dangerous because it enables untrusted remote code delivery and persistence on the user machine without strong provenance verification, signature checking, or explicit constrained consent.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill grants host-level execution for OS/architecture detection, downloading artifacts, extracting archives, moving binaries into PATH-like locations, and probing local state. For a knowledge-oriented database assistant, these capabilities materially expand the attack surface and could be abused to alter the host environment or stage further execution beyond answering Lindorm questions.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The guide explicitly authorizes removing `--safe-mode` after confirmations, enabling destructive operations such as DROP/DELETE that the tool otherwise blocks. In the context of a skill primarily framed as knowledge/reference assistance, embedding a sanctioned bypass for destructive execution increases the risk of irreversible data loss from prompt mistakes, social engineering, or ambiguous user intent.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger list contains broad terms such as "HBase", "embedding", "rerank", and generic operational phrases that can match unrelated user requests. This can cause the skill to activate outside the intended Lindorm context, increasing the chance of incorrect tool routing, over-collection of context, or execution of cloud-oriented guidance when the user meant a different product or task.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to retrieve and surface privileged database credentials, including the V2 `InitialRootPassword` and the V1 default `root/root` credentials, directly in the conversation. Exposing root credentials in chat materially increases the risk of unauthorized access, lateral misuse, logging leakage, and accidental disclosure to users who may not be fully authenticated or authorized for secret access.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation instructs sending raw chunk text to an embedding API, which can expose private knowledge-base contents to another service boundary without any warning, minimization guidance, or consent checks. In a knowledge-base workflow, chunk text is likely to contain proprietary or sensitive data, so normalizing this as a default step increases the risk of unintended data disclosure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document instructs users to provide credential references, endpoints, and to send image URLs, query text, and dataset content to Lindorm Search and AI engine services, but it does not include an explicit privacy or data-transmission warning. This can lead operators to disclose sensitive business data or credentials to remote services without understanding retention, access scope, or network exposure, especially because the workflow includes multimodal AI enrichment and search over uploaded content.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger language is very broad for a quick-start guide and overlaps with common developer questions such as creating tables or writing data. In an agentic system, broad triggers can cause unintended invocation, leading the agent to provide direct operational code or make assumptions in contexts where a narrower, safer workflow should apply.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The guide presents destructive actions such as deleting indexes, deleting rows, and dropping ETLs as normal examples without prominent warnings about irreversible data loss or environment isolation. Users may copy-paste these commands into production or a shared environment, causing accidental service disruption or loss of data.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill includes write operations against the search index but does not provide a clear warning that these commands modify stored data. In a database administration skill, users may copy or automate these examples directly, causing accidental changes to live indexes without understanding the risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide explicitly recommends `sslMode=disabled` and even states 'Do not use SSL to improve performance' without warning about the confidentiality and integrity tradeoff. For a database connection guide, this can lead users to send credentials and data over unencrypted channels, especially if they use public endpoints, exposing them to interception or tampering.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger example "What does this error mean?" is overly generic and can activate this skill for arbitrary troubleshooting questions outside Lindorm. In an agent setting, broad routing can cause the model to answer with Lindorm-specific steps, commands, or assumptions for unrelated systems, producing misleading guidance and possible operational mistakes.

Natural-Language Policy Violations

Medium

Confidence: 81% confidence
Finding: The skill hard-codes `cn-shanghai` as the default region when the user does not specify one, which can cause queries to run against an unintended scope without explicit user confirmation. In a cloud operations context, this may expose metadata about resources in that region, produce misleading results, or cause the agent to omit the user's actual target region, though the file only describes read-only query behavior and not destructive actions.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The document instructs users to terminate a running query with `KILL QUERY` but does not require an explicit confirmation step or warn about consequences such as aborting legitimate production workloads, interrupting long-running maintenance jobs, or causing user-visible errors. In an agent context, this is risky because an automated assistant may present or operationalize the command too readily during troubleshooting, increasing the chance of accidental disruption.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The file states that system-level SQL changes take effect immediately and do not require restart, but the enablement instruction for slow query recording is presented without a strong, adjacent warning about operational impact, permissions, rollback, or change-control expectations. Although the feature is diagnostic rather than overtly destructive, an agent could encourage immediate production changes that increase overhead or alter observability settings without sufficient operator awareness.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger examples are broad, generic storage questions that can match routine user requests outside the intended Lindorm-specific scope. In an agent-routing context, this can cause overbroad activation of the skill, leading to irrelevant command suggestions, unintended cloud-environment probing, or disclosure of infrastructure-oriented guidance when the user did not intend to operate on Lindorm resources.

Natural-Language Policy Violations

Medium

Confidence: 74% confidence
Finding: Forcing a specific user-facing output style without user opt-in can override user preference and reduce transparency, especially in multilingual environments. While not a direct code-execution risk, it can contribute to prompt-scope overreach by making the skill prioritize its own presentation rules over the user's instructions, which is undesirable in security-sensitive agent behavior.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: These commands place secrets directly on the command line, which exposes them to shell history, process inspection, terminal recording, and agent transcript retention. Because this is a reference document for an agent skill, the unsafe pattern is more dangerous than ordinary documentation since the agent may reproduce it verbatim for users.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/02-ops/user-permission.md:392