Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a legitimate Alibaba Cloud Live diagnostic tool, but it has a few under-disclosed behaviors users should review before installing.
Install only if you are comfortable granting read-only Alibaba Cloud Live log/config access through your local aliyun CLI and creating local recordings. Avoid verbose node geolocation if you do not want CDN node IPs sent to ipinfo.io, and use recorder stop commands only for recordings created by this tool.
Claiming security-analysis, URL-authentication, and signed URL generation capabilities that are not actually implemented undermines trust and can produce incomplete or misleading security outcomes. In a security troubleshooting context, missing controls or absent functionality are especially risky because users may rely on the skill instead of performing necessary validation elsewhere.
Claiming security-analysis, URL-authentication, and signed URL generation capabilities that are not actually implemented undermines trust and can produce incomplete or misleading security outcomes. In a security troubleshooting context, missing controls or absent functionality are especially risky because users may rely on the skill instead of performing necessary validation elsewhere.
Claiming security-analysis, URL-authentication, and signed URL generation capabilities that are not actually implemented undermines trust and can produce incomplete or misleading security outcomes. In a security troubleshooting context, missing controls or absent functionality are especially risky because users may rely on the skill instead of performing necessary validation elsewhere.
Claiming security-analysis, URL-authentication, and signed URL generation capabilities that are not actually implemented undermines trust and can produce incomplete or misleading security outcomes. In a security troubleshooting context, missing controls or absent functionality are especially risky because users may rely on the skill instead of performing necessary validation elsewhere.
The skill metadata claims a read-only, non-modifying diagnostic capability, but this code can terminate local ffmpeg recording processes via stop --all or by PID file. That mismatch is dangerous because downstream agents or users may trust the skill as harmless diagnostics while it actually performs state-changing local actions, enabling denial of service against recordings started by this tool.
The skill declares broad operational capabilities through shell, file, network, and environment access but does not define an explicit tool scope such as allowed-tools or permissions. That creates a larger-than-necessary execution surface and weakens enforcement of the skill's claimed read-only and least-privilege behavior.
Although the text tries to prohibit mutating cloud APIs, it still authorizes command and script execution in a broad way without a hard technical sandbox. In practice, broad shell execution combined with network and file access can be abused if implementation or orchestration deviates from the documented rules.
## Absolute Rules
1. **ABSOLUTE PROHIBITION (read-only cloud enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating Live API — e.g. `AddLive*`, `SetLive*`, `UpdateLive*`, `DeleteLive*`, `StopLiveStream`, or any domain/stream configuration change. This includes scripts "for the user to run manually". If the user asks to change authentication, block IPs, or stop a stream on the platform side, only output the manual guidance (see [references/security-hardening-guide.md](references/security-hardening-guide.md)) and declare this skill is read-only.
2. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or pass AK/SK/STS tokens explicitly. Credentials are resolved automatically by the aliyun CLI default credential chain. Never accept AK/SK from the user or from another script. Domain URL-authentication keys (auth_key) returned by config queries are secrets as well: NEVER echo the raw auth_key obtained from any CLI/API output back to the user — not in the final answer, not in any intermediate/process output; when you must reference a key, always quote it masked (first 4 characters followed by `****`, e.g. `vqEf****`). Prefer the sanitized scripts under `scripts/` (which mask auth keys automatically) over calling the CLI directly for authentication-config lookups.
3. **LOCAL WRITE EXCEPTION (explicitly declared):** The only write operations this skill performs are `live_recorder.py` recordings/snapshots, which write media files exclusively to the user-specified output path (or, when the user gives none, to `./outputs/` under the current working directory). No other file, directory, or system state is ever modified.
4. **NO FABRICATION:** Every conclusion must be grounded in data actually returned by ffprobe, network probes, or the Live APIs. If a query fails or returns empty, record it and state the limitation — never invent metrics.
The skill explicitly permits persistent local writes for recordings and snapshots, which means it is not stateless and may leave potentially sensitive media artifacts on disk. In diagnostic workflows, recorded streams can contain confidential or regulated content, so persistence increases exposure if storage is not controlled.
1. **ABSOLUTE PROHIBITION (read-only cloud enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating Live API — e.g. `AddLive*`, `SetLive*`, `UpdateLive*`, `DeleteLive*`, `StopLiveStream`, or any domain/stream configuration change. This includes scripts "for the user to run manually". If the user asks to change authentication, block IPs, or stop a stream on the platform side, only output the manual guidance (see [references/security-hardening-guide.md](references/security-hardening-guide.md)) and declare this skill is read-only.
2. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or pass AK/SK/STS tokens explicitly. Credentials are resolved automatically by the aliyun CLI default credential chain. Never accept AK/SK from the user or from another script. Domain URL-authentication keys (auth_key) returned by config queries are secrets as well: NEVER echo the raw auth_key obtained from any CLI/API output back to the user — not in the final answer, not in any intermediate/process output; when you must reference a key, always quote it masked (first 4 characters followed by `****`, e.g. `vqEf****`). Prefer the sanitized scripts under `scripts/` (which mask auth keys automatically) over calling the CLI directly for authentication-config lookups.
3. **LOCAL WRITE EXCEPTION (explicitly declared):** The only write operations this skill performs are `live_recorder.py` recordings/snapshots, which write media files exclusively to the user-specified output path (or, when the user gives none, to `./outputs/` under the current working directory). No other file, directory, or system state is ever modified.
4. **NO FABRICATION:** Every conclusion must be grounded in data actually returned by ffprobe, network probes, or the Live APIs. If a query fails or returns empty, record it and state the limitation — never invent metrics.
5. **USER-PROVIDED TARGETS ONLY:** Only probe stream URLs or domains the user expli
...[truncated 25 chars]
This file shells out to ping, curl, and traceroute through subprocess.run rather than using only in-process library calls. While network probing itself fits the skill's purpose, arbitrary local command execution capability is broader than the manifest states and introduces an execution surface unrelated to Alibaba Cloud Live semantics.
The skill sends discovered CDN node IP addresses to ipinfo.io for geolocation lookup, which is an external third party not disclosed in the manifest’s read-only diagnostics description. Even though the data is 'just IPs,' this leaks user-targeted infrastructure details and creates an unnecessary data-sharing path outside Alibaba Cloud diagnostics, especially when users may expect all analysis to remain local.
When verbose mode is enabled, the code automatically transmits discovered node IPs to ipinfo.io without any explicit warning or consent flow. This is a privacy and data-governance issue because infrastructure identifiers derived from the user’s target domain are disclosed to a third party, and the manifest does not clearly communicate that external data transmission occurs.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_cmd(cmd, timeout=10):
"""Run a command and return (stdout, returncode)."""
try:
result = subprocess.run(
cmd, capture_output=True, text=True, timeout=timeout
)
return result.stdout, result.returncode
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_cmd(cmd, timeout=10):
"""Run a command and return (stdout, returncode)."""
try:
result = subprocess.run(
cmd, capture_output=True, text=True, timeout=timeout
)
return result.stdout, result.returncode
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def ffmpeg_available():
"""Return True when the ffmpeg binary can be found and executed."""
try:
proc = subprocess.run(
["ffmpeg", "-version"], capture_output=True, text=True, timeout=5
)
return proc.returncode == 0
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# Use Popen so the recording can be interrupted.
# Recording is intentionally long-running; no timeout applies.
with os.fdopen(stderr_fd, "w") as stderr_fh:
proc = subprocess.Popen( # noqa: timeout
cmd,
stdin=subprocess.DEVNULL,
stdout=subprocess.DEVNULL,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# Capture the snapshot
try:
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
if proc.returncode == 0 and os.path.isfile(output):
result["status"] = "captured"
result["file_size"] = os.path.getsize(output)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"""
cmd = ["aliyun"] + cli_args + ["--user-agent", _USER_AGENT]
try:
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
except subprocess.TimeoutExpired as e:
raise RuntimeError(f"aliyun CLI timed out after {timeout}s: {' '.join(cli_args[:2])}") from e
except FileNotFoundError as e:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"""
cmd = ["aliyun"] + cli_args + ["--user-agent", _USER_AGENT]
try:
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
except subprocess.TimeoutExpired as e:
raise RuntimeError(f"aliyun CLI timed out after {timeout}s: {' '.join(cli_args[:2])}") from e
except FileNotFoundError as e:
No suspicious patterns detected.