alibabacloud-migration-cas-cutover-review

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 6:44 AM UTC
• Version: 0.0.1

Overview

This skill is a disclosed local Excel cutover-plan reviewer that reads a user-provided .xlsx file and writes local reports, with no evidence of network calls, credential access, persistence, or destructive behavior.

Install only if you are comfortable letting the skill read the specific cutover manual you provide and write review reports locally. Keep redaction enabled unless the output will remain encrypted and internal, and review the generated report manually because the skill is rule/keyword based rather than a final migration approval authority.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The description and behavioral contract materially conflict: it says the skill is limited, non-interactive, and not applicable to certain migration/database domains, yet the body documents broader checks, interactive scenario selection, and implicit sensitive-data handling. Security controls and operator expectations depend on accurate declarations; when behavior exceeds the stated scope, users may expose data or permit actions they did not intend.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

md

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

md

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.

md

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

md

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

md

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

md

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

md

e; it does not depend on any MCP tool or external interface, and only executes `scripts/cutover_reviewer.py` via the local Python interpreter. |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md

See [references/usage-guide.md](references/usage-guide.md) for detailed installation steps.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 320)May include surrounding context.

md

See [references/usage-guide.md](references/usage-guide.md) for detailed installation steps.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md

nge the working directory to the skill root first (the directory that contains `SKILL.md`), then invoke exactly `python3 scripts/cutover_reviewer.py`. Never wri

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.

md

- Version history: [references/changelog.md](references/changelog.md)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/ram-policies.md (reported line 46)May include surrounding context.

md

### 3. Does not read credential files

- The code **does not contain** logic to read `~/.aliyun/config.json` / `~/.aws/credentials` /
  environment variables `ALIBABA_CLOUD_ACCESS_KEY_*` / `AK` / `SK`, etc.
- It never touches any of the user's credential files

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/cutover_reviewer.py (reported line 1853)May include surrounding context.

python

continue
                only = rule.get('only_messages_any') or []
                if not only or any(kw.lower() in message.lower() for kw in only):
                    return rule
            return None

        # --- 2. Group by topic ---

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill claims no required permissions and no external interfaces, yet the documented behavior includes writing review reports to disk and references external destinations and network-related constraints. This mismatch weakens least-privilege controls and can cause an agent platform to grant or assume broader capabilities than the manifest declares, reducing enforceability and auditability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction says the final answer 'must be written in the user's language,' which forces a language choice rather than offering user selection or documenting a justified locale restriction. This is a natural-language policy issue because it imposes a locale behavior across all uses of the skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The sheet-mapping flow both says not to re-run after fallback and says to immediately re-run when auto-mapping yields zero or implausibly low step counts. That contradiction can produce either incomplete analysis or repeated execution against sensitive files, undermining reliability and increasing the chance that the wrong Sheets are reviewed without clear operator awareness.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Conflicting instructions about unclear scenarios—ask the user versus default to '--scenario other'—create nondeterministic execution paths. In an agent setting, ambiguity can lead to inconsistent reviews, wrong risk profiles, or unnecessary prompts that stall automation and cause operators to trust results produced under the wrong scenario.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file defines the review standard entirely in English and prescribes English report sections and keywords, but it does not indicate that language selection is optional or that English is required for a specific compliance or regional reason. Under the natural-language policy rule, a fixed language/locale without user opt-in or justification can be a policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.