alibabacloud-migration-dbm-redis-shake-migration

• Outcome: Review
• Latest audit: Sep 1, 2026 · 2:08 AM UTC
• Version: 0.0.1

Overview

This Redis migration skill is purpose-built, but it should be reviewed carefully because it gives an agent sensitive SSH, Redis credential, remote command, sudo, and persistence capabilities with some incomplete safeguards.

Install only if you intend to let the agent manage RedisShake on specific servers. Provide only scoped SSH credentials, confirm every host and command before execution, avoid batch operations until the full host list is reviewed, prefer non-root and non-systemd operation unless production persistence is required, and review generated shake.toml because Redis passwords are stored in cleartext.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares and relies on shell, SSH, SCP, file writes, process control, and optional sudo, but the metadata presented to enforcement appears not to declare those permissions explicitly. That creates a governance gap where a reviewer or platform may underestimate the skill's real capabilities, increasing the chance of unsafe execution in environments that enforce permissions from declarations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence
• Finding: The file advertises broad end-to-end capabilities, including parsing inputs, generating configs, and managing remote deployment, while the actual implemented controls/capabilities appear narrower and different. This mismatch is dangerous because users and automated policy systems may authorize the skill based on an inaccurate understanding of what it really does or fails to do, especially around deployment, credential handling, and remote operations.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The file provides batch start/stop loops that execute state-changing commands across multiple remote servers without requiring confirmation, scoping safeguards, or an explicit warning about blast radius. In the context of an agent skill that may act on user-supplied hosts, this increases the risk of accidental mass service disruption or unintended deployment to the wrong systems.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- Kill the **own** redis-shake process (via the PID file)
- Use of the SSH private key (`~/.ssh/id_rsa` or a user-specified path, key-auth mode only)

### sudo permissions (only needed for systemd production mode)
- Write `/etc/systemd/system/redis-shake.service`
- Run `systemctl daemon-reload / enable / start / stop`

• Confidence: 85% confidence
• Finding: The skill explicitly requests sudo permissions to write a systemd unit under /etc/systemd/system and control service lifecycle. If misused or if user-supplied content can influence service definitions or executed paths, this enables privileged system modification and persistence beyond the migration task.

Credential Access

High

• Category: Privilege Escalation

Content

- SSH user's write access to `/opt/redis-shake/`
- Create/overwrite `shake.toml`, `data/shake.pid`, `data/shake.log`
- Kill the **own** redis-shake process (via the PID file)
- Use of the SSH private key (`~/.ssh/id_rsa` or a user-specified path, key-auth mode only)

### sudo permissions (only needed for systemd production mode)
- Write `/etc/systemd/system/redis-shake.service`

• Confidence: 91% confidence
• Finding: The skill explicitly contemplates use of the user's SSH private key at ~/.ssh/id_rsa or another user-specified path. Access to private keys is highly sensitive; a compromised or overly broad skill could read, misuse, or exfiltrate credentials, enabling unauthorized access to other systems beyond the stated migration target.

Session Persistence

Medium

• Category: Rogue Agent

Content

### sudo permissions (only needed for systemd production mode)
- Write `/etc/systemd/system/redis-shake.service`
- Run `systemctl daemon-reload / enable / start / stop`

> Before performing any SSH connection, sudo operation, file write, or process kill, the Agent must clearly explain the operation about to be performed and obtain confirmation. This Skill has a PreToolUse Hook (`scripts/confirm-write.sh`) configured to automatically intercept write-type commands.

• Confidence: 88% confidence
• Finding: Enabling a systemd service creates persistence across reboots. In a benign admin workflow this may be intended, but from a security perspective persistence materially increases blast radius because a misconfigured or maliciously altered redis-shake command would continue running automatically and could survive the end of the interactive session.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Batch start
for HOST in "${HOSTS[@]}"; do
    echo "=== Starting on $HOST ==="
    ssh $SSH_OPTS $USER@$HOST 'cd /opt/redis-shake && mkdir -p data && if [ -f data/shake.pid ] && kill -0 $(cat data/shake.pid) 2>/dev/null; then echo "Already running"; else nohup ./redis-shake shake.toml > data/shake.log 2>&1 & echo $! > data/shake.pid && echo "Started"; fi'
done

# Batch stop

• Confidence: 81% confidence
• Finding: Using nohup with background execution creates a persistent remote process that survives the SSH session, which can outlive operator awareness and continue affecting data migration after disconnect. In a migration skill, this is operationally expected, but without safeguards it can enable unattended long-running actions on multiple hosts and make containment harder if the wrong command or config is deployed.

Static analysis

No suspicious patterns detected.