alibabacloud-migration-cas-cutover-review

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 6:44 AM UTC
• Version: 0.0.1

Overview

This skill is a disclosed local Excel cutover-plan reviewer that reads a user-provided .xlsx file and writes local reports, with no evidence of network calls, credential access, persistence, or destructive behavior.

Install only if you are comfortable letting the skill read the specific cutover manual you provide and write review reports locally. Keep redaction enabled unless the output will remain encrypted and internal, and review the generated report manually because the skill is rule/keyword based rather than a final migration approval authority.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The description and behavioral contract materially conflict: it says the skill is limited, non-interactive, and not applicable to certain migration/database domains, yet the body documents broader checks, interactive scenario selection, and implicit sensitive-data handling. Security controls and operator expectations depend on accurate declarations; when behavior exceeds the stated scope, users may expose data or permit actions they did not intend.

Ae1

High

• Category: analysis-evasion

Content

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

See [references/usage-guide.md](references/usage-guide.md) for detailed installation steps.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

See [references/usage-guide.md](references/usage-guide.md) for detailed installation steps.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

nge the working directory to the skill root first (the directory that contains `SKILL.md`), then invoke exactly `python3 scripts/cutover_reviewer.py`. Never wri

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- Version history: [references/changelog.md](references/changelog.md)

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

### 3. Does not read credential files

- The code **does not contain** logic to read `~/.aliyun/config.json` / `~/.aws/credentials` /
  environment variables `ALIBABA_CLOUD_ACCESS_KEY_*` / `AK` / `SK`, etc.
- It never touches any of the user's credential files

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

continue
                only = rule.get('only_messages_any') or []
                if not only or any(kw.lower() in message.lower() for kw in only):
                    return rule
            return None

        # --- 2. Group by topic ---

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill claims no required permissions and no external interfaces, yet the documented behavior includes writing review reports to disk and references external destinations and network-related constraints. This mismatch weakens least-privilege controls and can cause an agent platform to grant or assume broader capabilities than the manifest declares, reducing enforceability and auditability.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The instruction says the final answer 'must be written in the user's language,' which forces a language choice rather than offering user selection or documenting a justified locale restriction. This is a natural-language policy issue because it imposes a locale behavior across all uses of the skill.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The sheet-mapping flow both says not to re-run after fallback and says to immediately re-run when auto-mapping yields zero or implausibly low step counts. That contradiction can produce either incomplete analysis or repeated execution against sensitive files, undermining reliability and increasing the chance that the wrong Sheets are reviewed without clear operator awareness.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: Conflicting instructions about unclear scenarios—ask the user versus default to '--scenario other'—create nondeterministic execution paths. In an agent setting, ambiguity can lead to inconsistent reviews, wrong risk profiles, or unnecessary prompts that stall automation and cause operators to trust results produced under the wrong scenario.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: This markdown file defines the review standard entirely in English and prescribes English report sections and keywords, but it does not indicate that language selection is optional or that English is required for a specific compliance or regional reason. Under the natural-language policy rule, a fixed language/locale without user opt-in or justification can be a policy violation.

Static analysis

No suspicious patterns detected.