Alibabacloud Migration Mas Solution

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:37 AM UTC
• Version: 0.0.1

Overview

This skill is a disclosed Alibaba Cloud migration-plan helper with local document conversion, and its risks are mostly normal dependency and web-research considerations.

Install this only if you are comfortable with the agent searching Alibaba Cloud documentation online using your migration context. For the DOCX step, prefer a controlled environment with a trusted Python package index or preinstalled python-docx, especially for sensitive business plans.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:123

Finding

Runtime Installation and Execution of an Unverified Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 123–132
Vulnerability Type: Runtime dependency resolution without integrity verification
Risk Level: Medium

Vulnerable code snippet:

bash

timeout 60 uv run --with python-docx==1.2.0 python3 scripts/md_to_docx.py <plan.md> <plan.docx>

The related documentation states:

text

- Uses `uv run --with python-docx==1.2.0` for automatic dependency management, no manual installation needed

Technical Analysis

The documented conversion workflow directs uv to resolve and install python-docx dynamically before executing scripts/md_to_docx.py. Pinning the package to version 1.2.0 limits version drift but does not establish artifact integrity.

The project does not provide a reviewed lockfile, cryptographic package hashes, a vendored dependency, or an explicitly trusted package index. Dependency resolution therefore relies on mutable external package infrastructure and the runtime environment's package-index configuration. A compromised registry, mirror, transitive dependency, or local index configuration could substitute malicious package content.

The converter subsequently executes:

python

from docx import Document

Importing a substituted package can execute attacker-controlled Python initialization code with the same privileges as the conversion process.

Attack Path

1. An attacker compromises a configured package registry, mirror, resolved artifact, or dependency in the resolution chain.
2. The user or Agent invokes the documented uv run --with python-docx==1.2.0 command.
3. uv retrieves and installs the externally supplied package artifacts without verification against project-controlled hashes.
4. Python starts scripts/md_to_docx.py and imports the docx package.
5. Malicious package initialization code executes with the privileges and environment access of the invoking process.

...[truncated 492 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed uv.lock or equivalent dependency lockfile containing cryptographic artifact hashes.
2. Execute dependency installation in locked or frozen mode so unexpected resolution changes cause failure.
3. Configure an explicitly trusted package index and prevent fallback to unapproved indexes or mirrors.
4. Prefer preinstalling dependencies in a controlled, reproducible build environment rather than acquiring them during normal Skill execution.
5. Where practical, vendor and review required artifacts or maintain them in an organization-controlled package repository.
6. Scan direct and transitive dependencies and periodically review lockfile updates before deployment.
7. Run document conversion in a sandbox with minimal filesystem, credential, and network access to reduce the impact of a supply-chain compromise.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill should analyze competitor cloud product lists and generate Alibaba Cloud migration mappings and detailed migration plans. The supplied code does none of that. It contains no logic for AWS/Azure/华为云/腾讯云 product recognition, no Alibaba Cloud mapping knowledge, no planning engine, and no user-intent handling for migration scenarios. Instead, it is purely a Markdown-to-DOCX conversion script with formatting logic for titles, tables, lists, quotes, and paragraph styling. While the script name and docstring mention '迁云方案', that is only the presumed content of the Markdown being formatted, not functionality to create such a plan. Therefore the primary purpose and actual capabilities materially differ from the declared description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest description is written as an instruction to generate migration plans in Chinese, while the rest of the file does not offer the user any language or locale choice. This creates a language/locale policy concern because the skill appears to impose a specific language by default without opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a skill focused on producing migration mappings and plans for moving from other cloud providers to Alibaba Cloud. This file instead implements a generic local formatter/converter that reads Markdown files and writes DOCX documents, which is not part of generating migration方案 itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and usage text are written only in Chinese, and the tool is explicitly described as a Chinese-formatted document converter. Under the policy for natural-language constraints, this imposes a language/locale choice without offering the user an alternative or opt-in path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.