Alibabacloud Lindorm Vector Migrate Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:42 AM UTC
• Version: 0.0.1-beta.1

Overview

This migration skill is coherent for its purpose, but it needs Review because it can run live database migrations while repeatedly encouraging plaintext HTTP and inline Basic Auth credential patterns.

Install only if you are prepared to review generated commands before execution. Use HTTPS or private trusted networking, avoid inline credentials, use least-privilege migration accounts, run dependencies in an isolated environment, and clean up CSV exports and checkpoint logs after migration.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/01-dev/workflow.md:121

Finding

Third-Party Dependencies Installed Without Artifact Integrity Verification

Content

View full analysis

**Version conflict note**: If the user's environment already has a different version of `elasticsearch` (e.g. 8.x), installing `7.17.13` will downgrade it. Suggest using a virtual environment for isolation: `python -m venv venv && source venv/bin/activate && pip install "elasticsearch==7.17.13"` ``` Related installation instructions also appear in: - `references/01-dev/milvus-migrate.md:6` - `references/01-dev/qdrant-migrate.md:262-268` - `references/01-dev/csv-import.md:349` ### Technical Analysis The dependencies are pinned to specific versions, which provides reproducibility and limits unintentional version drift. However, the installation commands do not verify package artifact hashes, pin transitive dependencies, require an approved package repository, or validate package signatures. `pip` uses the active package-index configuration. That configuration may point to PyPI, an enterprise mirror, or a user-controlled index. A compromised release, malicious mirror, altered dependency, or unsafe index configuration could therefore supply executable attacker-controlled code. Python packages and their transitive dependencies execute with the privileges of the account running the migration environment. Malicious behavior may occur during installation or when the installed module is imported by a generated migration script. The ...[truncated 1644 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/01-dev/lindorm-migrate.md:7

Finding

Basic Authentication Credentials Transmitted Over Plaintext HTTP to a Public Endpoint

Content

View full analysis

: \ "http://-proxy-search-vpc.lindorm.aliyuncs.com:30070/" # Public address curl -s -u : \ "http://-proxy-search-pub.lindorm.aliyuncs.com:30070/" ``` The plaintext HTTP pattern is also used for schema retrieval, TTL checks, validation, index administration, and bulk writes, including: - `references/01-dev/lindorm-migrate.md:29-30` - `references/01-dev/workflow.md:163` - `references/01-dev/workflow.md:228` - `references/02-ops/ttl-config.md:56-57` - `references/02-ops/postcheck.md:12-18` - `references/03-ref/bulk-write.md:7-29` ### Technical Analysis HTTP Basic Authentication encodes the username and password but does not encrypt them. When transmitted through an `http://` endpoint, the Authorization header, request content, response content, index names, mappings, and migrated records are exposed to interception and modification by an on-path attacker. The risk is particularly significant because the documented public endpoint uses plaintext HTTP. Public or otherwise untrusted network paths may permit traffic inspection, DNS manipulation, gateway compromise, or man-in-the-middle attacks. The same transport pattern is used for operations with materially different privilege levels, including: - Reading schemas, settings, and records. - Creating target indexes. - Writing migrated records. - Deleting indexes. - Triggering vector-index builds. - Performing post-migration validation. Using `curl -u :` also encourages users to place credentials directly in command arguments. This can persist credentials in shell history and may expose them through process inspection on some systems. ### Attack Path 1. A user follow ...[truncated 1539 chars]

Remediation

View remediation

-proxy-search-pub.lindorm.aliyuncs.com:30070/" ``` 2. Fail closed if TLS is unavailable. Do not automatically downgrade from HTTPS to HTTP. 3. Restrict plaintext HTTP, if technically unavoidable, to explicitly trusted private networks and display a clear warning requiring user confirmation. 4. Verify the server certificate and hostname. Do not recommend `curl -k`, `--insecure`, or disabling certificate verification in generated clients. 5. Avoid literal credentials in command lines. Obtain credentials through protected environment variables or interactive input that is not recorded in shell history. 6. Ensure generated scripts never print passwords, authorization headers, AccessKeys, or complete authenticated request objects. 7. Redact credentials from errors and logs while retaining sufficient diagnostic information. 8. Use a dedicated least-privilege migration account: - Read-only access on the source. - Only required create, mapping, bulk-write, build, and validation permissions on the target. - Delete-index permission granted only when deletion is explicitly required. 9. Rotate credentials immediately if they may previously have been transmitted over an untrusted plaintext connection. 10. Prefer private connectivity, VPN, or VPC routing in addition to TLS for migration traffic. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output

Findings (25)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/01-dev/workflow.md (reported line 106)May include surrounding context.

md

| Public network | Suitable for small data volumes (< 100,000 records) import or demos |
| Internal network (VPC) | Suitable for production environments & large batch migration imports |

- When **public network** is selected, MUST output prompt:
  > Currently using public network connection, suitable for small data volume imports or demos. For production large batch migrations, internal network (VPC) connection is recommended for higher bandwidth and lower latency.
- When **internal network** is selected, output confirmation:
  > Currently using internal network (VPC) connection, suitable for production large batch migrations.

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 89% confidence

Finding

The Milvus query-back example constructs a filter expression with an f-string using pk_field and pk_val, which can enable expression or query injection if either value is attacker-controlled or insufficiently validated. In this skill's context, many parameters are collected conversationally and then used to generate/execute code, making unvalidated interpolation materially more dangerous than a static documentation snippet in isolation.

Content

Scanner excerpt · references/02-ops/postcheck.md (reported line 68)May include surrounding context.

md

| Source | Query-back method | Notes |
|--------|-------------------|-------|
| Milvus | `client.query(collection_name, filter=f"{pk_field} == {repr(pk_val)}", output_fields=["*"], limit=1)` | Lindorm `_id` is string; Milvus primary key may be int, need `int(doc_id)` conversion. Requires PyMilvus SDK |
| Elasticsearch | `curl -s -u user:pass "http://<es_host>:9200/<source_index>/_doc/<doc_id>"` | Direct lookup by `_id` |
| Lindorm | `curl -s -u user:pass "http://<src_host>:30070/<source_index>/_doc/<doc_id>"` | Same as ES |
| Qdrant | `curl -s "http://<qd_host>:6333/collections/<col>/points/<point_id>"` | point id may be int or UUID str |

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/02-ops/ttl-config.md (reported line 56)May include surrounding context.

bash

# Pre-check: read source TTL configuration
curl -s -u <user>:<pass> "http://<source_host>:30070/<index>/_settings" \
  | python3 -c "import sys,json; d=json.load(sys.stdin); idx=list(d.values())[0]; print(idx.get('settings',{}).get('index',{}).get('doc_ttl.field','')); print(idx.get('settings',{}).get('index',{}).get('doc_ttl.unit',''))"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The description is written to strongly bias interaction toward Chinese without indicating multilingual fallback or user choice. In a skill that performs infrastructure and data migration, language forcing can cause users to misunderstand confirmations, DDL review, deletion prompts, or credential-handling instructions, weakening informed consent and increasing the chance of operator error.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list contains highly generic terms such as "迁移", "migration", "vector database", and "数据迁移", which can cause the skill to activate for broad, unrelated user requests. Because this skill is designed to collect parameters, generate code, and execute migration operations against databases and cloud services, overbroad activation increases the chance of unintended invocation in sensitive contexts and could lead to accidental data-handling or risky operational actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document explicitly instructs exporting source data "as-is" to a local CSV file, which can include sensitive fields, metadata, vectors, or identifiers without any mandatory warning, minimization, masking, or confirmation step. In a migration skill that directly generates and executes code, this increases the chance of accidental plaintext data exposure on disk, backup systems, shared workstations, or logs during normal operation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes a migration assistant that collects parameters and generates/executes migration code for moving vector data to Lindorm, including OSS-based CSV import. However, this file additionally mandates access to process environment variables for OSS AK/SK rather than limiting credentials to user-provided parameters or a declared secret-handling mechanism. Reading ambient environment secrets is a broader capability that is not explicitly justified in the stated skill purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The instruction says the Agent MUST display pre-check output using a fixed English message format, which imposes a specific language on user-facing output. The file does not offer localization, opt-in, or justification for restricting the interface language.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/01-dev/elasticsearch-migrate.md (reported line 167)May include surrounding context.

Document Count

bash

curl -s -u elastic:password "http://localhost:9200/<index_name>/_count" \
  -H "Content-Type: application/json" \
  -d '{"query": {"match_all": {}}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/01-dev/elasticsearch-migrate.md (reported line 329)May include surrounding context.

PIT + search_after method:

bash

curl -s -u elastic:password "http://localhost:9200/_search" \
  -H "Content-Type: application/json" \
  -d '{
    "size": 1000,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation demonstrates authenticated requests using plain HTTP with -u <username>:<password>, which exposes credentials to interception by anyone with network visibility. In a migration skill that may generate and run commands directly, users are likely to copy these examples verbatim, increasing the chance of credential leakage in transit and via shell history/process inspection.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/01-dev/lindorm-migrate.md (reported line 80)May include surrounding context.

Document Count

bash

curl -s -u <username>:<password> "http://<host>:30070/<index_name>/_count" \
  -H "Content-Type: application/json" \
  -d '{"query": {"match_all": {}}}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document directs the agent to fetch full payloads and vectors from the source Qdrant collection, which can include sensitive application data, embeddings, identifiers, and metadata, without any data-minimization, sensitivity warning, or redaction guidance. In this skill's context, the migrated data is later exported to CSV, uploaded to OSS, and imported elsewhere, so indiscriminate full extraction increases the chance of unnecessary exposure and broader downstream leakage.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/01-dev/qdrant-migrate.md (reported line 121)May include surrounding context.

bash

# First request (no authentication)
curl -s "http://localhost:6333/collections/<collection_name>/points/scroll" \
  -H "Content-Type: application/json" \
  -d '{
    "limit": 1000,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly relies on creating local log files that persist migration progress, cursors, and potentially source-specific identifiers for later resume operations, but it provides no requirement to notify the user, minimize retained data, or control where and how long the file is stored. In a data-migration context, these logs can contain sensitive operational metadata and possibly record identifiers, so silent local persistence increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document instructs users to run credentialed curl commands against a live Lindorm endpoint without an explicit warning that the command will contact an external system and expose credentials via shell history, process listings, logs, or screenshots. In an agent skill that can guide or automate operational actions, this increases the risk of inadvertent credential disclosure and unintended execution against production systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This command performs an authenticated POST to an external Lindorm endpoint and embeds credentials directly in the command line. That can leak secrets through terminal history and system process inspection, and in the skill context it may also trigger state-changing actions on the target cluster if executed automatically or copied blindly.

Content

Scanner excerpt · references/02-ops/postcheck.md (reported line 12)May include surrounding context.

Written data may still be in the refresh interval and not yet visible; force refresh first:

bash

curl -s -u <username>:<password> -X POST "http://<host>:30070/<index_name>/_refresh"

Row Count Validation

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This example sends an authenticated search request to an external system and includes credentials inline. Even though it is a read-style validation command, it still risks credential exposure and operational data disclosure, especially in an agent-driven migration workflow where commands may be generated and executed with user-supplied endpoints.

Content

Scanner excerpt · references/02-ops/postcheck.md (reported line 47)May include surrounding context.

Use function_score + random_score to randomly sample from the target, then compare against source data:

bash

curl -s -u <username>:<password> "http://<host>:30070/<index_name>/_search" \
  -H "Content-Type: application/json" \
  -d '{
    "size": <sample_size>,

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/02-ops/ttl-config.md (reported line 5)May include surrounding context.

md

## Overview

Lindorm search engine supports **row-level TTL**: each row carries an independent expiration timestamp and is automatically deleted after the expiration time.

> **Kernel version requirement**: `lindorm-lvector >= 1.3.3-20250519`, `lindorm-lsearch >= 1.3.3-20250519`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The example uses Basic Auth credentials directly in a curl command over plain HTTP, which can expose secrets to network interception, shell history, process listings, logs, or copied transcripts. In a migration assistant that may generate executable commands, this insecure pattern is more dangerous because users are likely to run it as-is against production systems.

Content

Scanner excerpt · references/03-ref/bulk-write.md (reported line 7)May include surrounding context.

bash

# Search engine port is fixed at 30070
curl -s -u <username>:<password> "http://<host>:30070/"

Create Index

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document includes a direct DELETE command for an index without any embedded warning, confirmation gate, or guidance to verify the target index before execution. In a migration skill that can generate and execute code, this materially increases the chance of accidental destructive operations and irreversible data loss if the wrong index is specified.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/03-ref/bulk-write.md (reported line 281)May include surrounding context.

After triggering build, MUST poll until status is ready or failed; MUST NOT exit polling while status=building.

bash

curl -s -u <username>:<password> -X GET \
  "http://<host>:30070/_plugins/_vector/index/tasks" \
  -H "Content-Type: application/json" \
  -d '{"indexName": "<index_name>", "fieldName": "<vector_field>", "taskIds": "[]"}'

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The text explicitly directs agent-generated scripts to automatically execute build and polling actions after writes complete. In the context of a skill that collects parameters and directly generates and executes code, this reduces human review over consequential operations on remote infrastructure and can amplify mistakes, misconfiguration, or abuse if parameters are wrong or user intent is misunderstood.

Content

Scanner excerpt · references/03-ref/bulk-write.md (reported line 291)May include surrounding context.

md

#### Polling Best Practices

Migration scripts generated by the Agent for IVFPQ/IVFBQ **MUST** automatically execute Build + polling after data write completes, following these rules:

| Rule | Requirement |
|------|-------------|

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/03-ref/bulk-write.md (reported line 309)May include surrounding context.

md

auth = (username, password) if username else None

    # Trigger build
    resp = requests.post(
        f"{base_url}/_plugins/_vector/index/build",
        json={"indexName": index_name, "fieldName": vector_field},
        auth=auth

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/03-ref/official-refs.md (reported line 84)May include surrounding context.

md

| Payload Schema (type inference) | https://qdrant.tech/documentation/manage-data/payload/ |
| Vector search | https://qdrant.tech/documentation/search/search/ |
| Bulk upload | https://qdrant.tech/documentation/tutorials-develop/bulk-upload/ |
| REST API reference (OpenAPI) | https://api.qdrant.tech/ |
| API & SDKs | https://qdrant.tech/documentation/interfaces/ |
| Python Client (GitHub) | https://github.com/qdrant/qdrant-client |

Static analysis

No suspicious patterns detected.