Alibabacloud Migration Mas Product Mapping

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:40 AM UTC
• Version: 0.0.1

Overview

The skill performs cloud migration mapping and pricing, but its local pricing service exposes Alibaba Cloud credential-backed API access too broadly.

Review before installing. Use a dedicated least-privilege Alibaba Cloud RAM identity, bind the pricing service to 127.0.0.1 only, disable broad CORS, add authentication, avoid non-local pricing URLs unless HTTPS and trusted, and stop the service after use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/pricing_service.py:2121

Finding

Unauthenticated Credential-Backed Pricing Service Exposed on All Network Interfaces

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/excel_mapping.py:526

Finding

Unrestricted Pricing URL Permits Plaintext Disclosure of Cloud Infrastructure Metadata

Content

View full analysis

bool: """检查询价服务是否可用""" try: resp = requests.get(f"{url}/health", timeout=5) return resp.status_code == 200 except Exception: return False def batch_pricing(url: str, items: list, region_id: str = "cn-beijing", period: int = 1) -> dict: """调用批量询价 API""" try: resp = requests.post( f"{url}/api/pricing/batch", json={"region_id": region_id, "period": period, "items": items}, timeout=120, ) result = resp.json() if result.get("success"): return result["data"] except Exception as e: print(f" [WARN] 询价调用失败: {e}") return {"prices": [], "summary": {}} ``` The transmitted ECS payload is constructed as follows: ```python item = { "product_code": "ecs", "instance_spec": spec, "count": count, "disk_category": "cloud_essd", "disk_size": max(sys_size, 20), # 系统盘最低20GB } if dd_size > 0: item["data_disk_category"] = "cloud_essd" item["data_disk_size"] = dd_size item["data_disk_pl"] = dd_pl items.append(item) ``` The destination is accepted without scheme or host restrictions: ```python parser.add_argument("--pricing-url", default="http://localhost:5001", help="询价服务 URL") ``` ### Technical Analysis The default pricing destination is localhost, which is appropriate for the declared workflow. However, the command-line option accepts any URL and does not verify that the destination is loopback, trusted, or protected by HTTPS. The script submits derived cloud inventory information to this URL. Payloads can include target regions, mapped instance specifications, resource counts, disk categories and sizes, database classes, cach ...[truncated 1932 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (32)

Tainted flow: 'headers' from os.environ.get (line 107, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/pricing_service.py (reported line 109)May include surrounding context.

python

url = f"https://{endpoint}/"
    headers = {"User-Agent": _USER_AGENT}
    try:
        resp = requests.get(url, params=all_params, headers=headers, timeout=30)
        return resp.json()
    except requests.RequestException as e:
        return {"error": f"API call failed: {str(e)}"}

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

该代码块的核心用途与描述部分重合：它确实做了云资源到阿里云的产品/规格映射、调用询价服务、生成成本估算结果，并输出 Excel。因此“映射 + 询价 + 成本估算”这一大方向是匹配的。 但描述中的关键主张是“多厂商”“支持 AWS、腾讯云、华为云、Azure 到阿里云的全量映射”。代码文件名、注释、工作表识别逻辑、映射表和处理函数都明确聚焦 Azure，输入也是假定为 Azure 资源调研 Excel。没有看到任何 AWS、腾讯云、华为云资源解析、工作表识别、映射表或对应处理流程。因此这是实质性能力夸大。 另外，代码确实包含对若干容量/规格的推断与换算（如 vCPU/内存、RU/s、Redis 容量、带宽），但更准确地说是针对特定 Azure 资源类型的规则映射与估价辅助，而不是描述里暗示的跨多云“全量用量换算”能力。 未发现明显与声明无关的恶意或越权行为；网络访问仅用于健康检查和调用 pricing API，属于已声明的实时询价支持实现细节。综合看，应判定为描述与行为不匹配，主要因为多云支持范围被严重高估。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

该代码与描述部分重合：确实提供了产品映射、部分规格映射、用量换算/成本估算，以及调用 pricing 服务进行部分实时询价，并生成迁移分析 Excel。但核心不匹配在于声明强调“多厂商云产品映射”，覆盖 AWS、腾讯云、华为云、Azure 到阿里云的全量映射；而实际代码只实现 AWS→阿里云，且只针对特定 Excel 模板中的若干 AWS 服务。没有任何腾讯云、华为云或 Azure 的解析、映射表、处理函数或输出逻辑。其次，‘全量映射’也不成立，代码采用大量静态映射表，仅覆盖有限产品与规格，且不少服务只做产品级映射或参考价估算。故应判定描述高估了能力范围，存在实质性描述与行为不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

该描述与代码存在实质不一致。描述声称该 Skill 支持 AWS、腾讯云、华为云、Azure 到阿里云的多厂商全量映射，但提供的代码仅实现了华为云到阿里云的映射逻辑，且输入格式严格依赖华为云资源导出的特定 Excel Sheet 名称。代码没有任何 AWS、腾讯云或 Azure 的解析、映射或询价逻辑，因此“多厂商”“全量映射”明显被高估。另一方面，描述中提到的规格映射、部分用量换算（如磁盘容量、带宽、存储估算）以及阿里云实时询价，与代码行为基本一致。代码还包含生成多张 Excel 输出报表的能力，这更像一个面向华为云迁移评估的专项工具，而不是通用多云映射 Skill。综上，主用途相近于“云到阿里云映射与报价”，但范围与能力声明明显超出实际实现，应判定为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad multi-cloud mapping skill with full coverage across AWS, Tencent Cloud, Huawei Cloud, and Azure to Alibaba Cloud, including name mapping, instance mapping, usage conversion, and real-time pricing. The supplied code is much narrower: it is a Huawei-vs-Alibaba price comparison script for predefined ECS, RDS, and GaussDB/PolarDB configurations in Beijing-region contexts. It contains hardcoded Huawei prices and static Huawei→Alibaba spec-family mappings, then calls a local batch pricing endpoint to fetch Alibaba prices. There is no evidence of AWS/Tencent/Azure support, no generalized full product mapping engine, no usage conversion logic, and no broad triggerable skill behavior beyond generating a comparison report. This is a material description-behavior mismatch, even though the code does include a limited subset of the declared pricing/spec comparison idea.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个广泛的多云到阿里云映射与询价能力，覆盖 AWS、腾讯云、华为云、Azure，并包括产品名称映射、实例规格映射、用量换算和实时询价。实际代码只处理 AWS 与阿里云的两个特定领域：EC2→ECS 和 Aurora MySQL→RDS/PolarDB。它通过硬编码的 AWS 价格与静态映射关系，调用 localhost 上的批量询价接口获取阿里云价格，输出价格差异报表。没有任何腾讯云、华为云、Azure 相关逻辑，也没有看到通用的产品名称映射、用量换算或“全量映射”实现。因此代码的实际范围和主要用途明显窄于声明，属于实质性描述不符。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description emphasizes a migration/mapping skill across multiple cloud vendors, with 'full mapping' capabilities spanning product mappings, spec mappings, usage conversions, and Alibaba Cloud real-time pricing. The supplied code chunk only covers the last part: Alibaba Cloud pricing lookup and estimation. It contains extensive functions for querying Alibaba Cloud ECS/RDS/Redis/BSS pricing APIs and many reference-price estimators, plus Flask routes such as /api/pricing/*, /api/pricing/batch, /api/pricing/products, and /health. There is no code for ingesting AWS, Tencent Cloud, Huawei Cloud, or Azure product catalogs; no mapping tables or translation logic; no normalization of external cloud instance types; and no usage-conversion engine. Therefore the actual primary behavior is a pricing microservice for Alibaba Cloud products, not a multi-cloud mapping skill. This is a material description-behavior mismatch, even though real-time Alibaba Cloud pricing is one subset of the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

声明描述的是一个覆盖多云厂商、具备全量产品/规格映射、用量换算和实时询价的通用 Skill；而代码只是单个脚本，针对腾讯云与阿里云的部分计算与数据库实例做价格比较。它使用硬编码的腾讯云价格和少量映射表，再查询本地阿里云定价服务生成文本报告。代码没有体现 AWS、华为云、Azure 支持，也没有通用迁移映射、全量产品目录、用量换算或广泛触发逻辑。因此描述明显夸大且与实际行为的主要用途不一致，属于实质性不匹配。

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

- Pass confirmed region as `--region` parameter to `excel_mapping.py` and pricing service

Known Vulnerable Dependency: flask-cors==5.0.1 — 6 advisory(ies): CVE-2024-6866 (Flask-CORS vulnerable to Improper Handling of Case Sensitivity); CVE-2024-6839 (Flask-CORS improper regex path matching vulnerability); CVE-2024-6844 (Flask-CORS allows for inconsistent CORS matching) +3 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

flask-cors==5.0.1 is flagged with multiple CORS handling vulnerabilities, including case-sensitivity and regex/path-matching issues. CORS misconfiguration or bypass can allow unintended origins to read sensitive API responses, which is especially dangerous for a skill likely to expose migration, pricing, or credential-adjacent APIs to browser-based clients.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill explicitly instructs operators to install dependencies, start a local Flask pricing service, read environment-provided Alibaba Cloud credentials via the default credential chain, and make outbound network calls, yet it declares no tool scope or permission boundaries. In an agent setting, that omission can cause the runtime to grant broader-than-expected access to environment secrets and networking, increasing the chance of unintended credential use, metadata access, or external API calls without clear user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description is written as a direct usage instruction in Chinese and frames when the skill should be used, but nowhere in the file does the skill state that language is user-selectable or limited to a justified region-specific context. Under the policy, forcing or implicitly requiring a specific language without opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The script performs outbound HTTP POST requests to a configurable pricing_url without validating or constraining the destination, and it may use cleartext HTTP. In a migration-assessment context, even derived infrastructure metadata like instance types, capacities, engine versions, and region can be sensitive, so sending it to an untrusted or intercepted endpoint can disclose environment details or enable SSRF-like misuse if an attacker controls the URL.

Content

Scanner excerpt · scripts/azure_mapping.py (reported line 907)May include surrounding context.

python

def batch_pricing(pricing_url: str, items: list, region_id: str) -> dict:
    """调用批量询价 API"""
    try:
        resp = requests.post(
            f"{pricing_url}/api/pricing/batch",
            json={"region_id": region_id, "period": 1, "items": items},
            timeout=120,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code collects resource details parsed from the input workbook and sends them to the pricing API via requests calls in the fill_*_prices functions. Although the script mentions '实时询价' in the docstring and CLI help, it does not clearly warn users that workbook-derived infrastructure metadata will be transmitted over HTTP to another service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

文件级文档明确写的是“AWS → 阿里云 产品映射 Excel 处理脚本”，后续全部产品映射表、sheet 名和处理函数也都围绕 AWS 资源展开，如 EC2、S3、AuroraDB、Lambda 等，没有看到腾讯云、华为云或 Azure 的解析与映射逻辑。对于一个宣称支持多厂商云全量映射的 skill，这个脚本的实际能力明显更窄。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script sends workbook-derived infrastructure metadata to an external pricing service via HTTP requests, but provides no explicit disclosure, consent prompt, or data-minimization controls. In this skill context, the Excel input contains cloud inventory details such as instance IDs, specs, storage, and topology-related attributes, so silent transmission can leak sensitive environment information to an unintended endpoint if the pricing URL is remote or malicious.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The code performs external transmission to a configurable pricing endpoint using requests.post, carrying derived infrastructure/pricing request data from the imported workbook. Because the endpoint is user-configurable and defaults to plain HTTP localhost, the skill context increases risk: users may redirect to non-local services, and unencrypted transport or a rogue local listener could capture sensitive cloud inventory characteristics.

Content

Scanner excerpt · scripts/excel_mapping.py (reported line 536)May include surrounding context.

python

def batch_pricing(url: str, items: list, region_id: str = "cn-beijing", period: int = 1) -> dict:
    """调用批量询价 API"""
    try:
        resp = requests.post(
            f"{url}/api/pricing/batch",
            json={"region_id": region_id, "period": period, "items": items},
            timeout=120,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script transmits derived inventory and sizing data to a pricing service over HTTP without explicit consent, a prominent warning, or transport security by default. Even though it sends normalized configuration data rather than raw spreadsheets, those details can still reveal infrastructure topology, capacity, and environment characteristics, which are sensitive in migration contexts.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The requests.post call sends pricing request payloads to a configurable external service, and the default endpoint uses plaintext HTTP to localhost. In agent or enterprise environments, configurable endpoints can be redirected to remote hosts, causing silent exfiltration of infrastructure metadata and exposing it in transit if HTTP is used.

Content

Scanner excerpt · scripts/huawei_mapping.py (reported line 801)May include surrounding context.

python

def batch_pricing(pricing_url: str, items: list, region_id: str) -> dict:
    """调用批量询价 API"""
    try:
        resp = requests.post(
            f"{pricing_url}/api/pricing/batch",
            json={"region_id": region_id, "period": 1, "items": items},
            timeout=120,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python file contains a Chinese-only module description, function docstrings, status messages, table headers, and explanatory output. Under the policy rule for language/locale, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code resolves Alibaba Cloud credentials from the local environment or provider chain and then sends signed HTTP requests to Alibaba Cloud endpoints. Although the behavior is part of the service's function, the file does not provide any user-facing warning that API requests will be made using ambient cloud credentials and that request parameters such as regions and instance specs will be transmitted externally.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: flask==3.1.1 — 2 advisory(ies): CVE-2026-27205 (Flask session does not add `Vary: Cookie` header when accessed in some ways); CVE-2026-27205 (Flask is a web server gateway interface (WSGI) web application framework. In ver)

Medium

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The requirements file pins Flask 3.1.1, which is reported here as affected by a session/caching issue involving a missing Vary: Cookie header in some access paths. If this skill exposes a web service using Flask sessions, intermediary caches could incorrectly reuse responses across users, risking session-related data leakage or improper content serving. In this migration skill context, that is meaningful because the service may handle cloud account, pricing, or mapping requests over HTTP.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: requests==2.32.3 — 4 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs) +1 more

Medium

• Category: Supply Chain
• Confidence: 88% confidence

Finding

requests==2.32.3 is reported as vulnerable, including a .netrc credential leak scenario via malicious URLs. In a cloud migration skill, outbound requests may be made to pricing APIs, cloud endpoints, or user-supplied URLs; if untrusted URLs are ever fetched, this could expose local credentials or otherwise expand SSRF-style risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/hw_price_comparison.py (reported line 106)May include surrounding context.

python

for i in range(0, len(items), batch_size):
        batch = items[i:i+batch_size]
        try:
            resp = requests.post(PRICING_URL, json={"items": batch}, timeout=60)
            data = resp.json()
            if data.get("success") and "data" in data:
                for p in data["data"].get("prices", []):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/price_comparison.py (reported line 163)May include surrounding context.

python

for i in range(0, len(items), batch_size):
        batch = items[i:i+batch_size]
        try:
            resp = requests.post(PRICING_URL, json={"items": batch}, timeout=60)
            data = resp.json()
            if data.get("success") and "data" in data:
                for p in data["data"].get("prices", []):

Static analysis

No suspicious patterns detected.