Alibabacloud Mongodb Health Inspect

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:49 AM UTC
• Version: 0.0.1-beta.1

Overview

This skill is a plausible MongoDB health-inspection tool, but it asks for risky installation/update steps and performs a cloud-side task creation while presenting itself as read-only.

Review before installing. Use a preinstalled, verified Aliyun CLI instead of letting an agent run curl-to-bash or update plugins automatically. Run with a dedicated least-privilege, preferably short-lived Alibaba Cloud identity, understand that the default inspection can create a DAS storage-analysis task, and store generated reports in a protected location because they may contain sensitive infrastructure, session, alert, and query details.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:114

Finding

Mutable Remote Installer Is Piped Directly into Bash

Content

View full analysis

= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see `references/cli-installation-guide.md` for installation instructions. > Then [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > Then [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ``` ### Technical Analysis The Skill instructs the Agent to retrieve a mutable shell script from an external URL and execute it immediately through Bash. The script is not saved for inspection, pinned to a specific version, checked against a cryptographic digest, or validated with a vendor signature. The hostname appears related to Alibaba Cloud, but domain reputation alone does not establish the integrity of the payload over time. The effective code can change after this Skill has been reviewed. Compromise of the hosting infrastructure, DNS or TLS trust chain, publishing account, or setup script would consequently provide a direct code-execution channel. The subsequent mandatory commands increase supply-chain exposure by enabling automatic plugin installation and updating existing plugins to whatever versions are current at execution time. These executable components are also not pinned to audited versions. Installing or updating the CLI is a prerequisite operation rather than part of the declared MongoDB health-inspection functionality. Automatically executing mutable installation code therefore exceeds the minimum privileges and behavior required to produce a read-only report. ### Attack Path 1. The Agent loads the Skill and determines that Aliyun CLI ...[truncated 1274 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:39

Finding

Unverified “Latest” CLI Archives Are Installed into a System-Wide Executable Path

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/health-inspect.py:1334

Finding

Sensitive HTML Reports Execute JavaScript from a Third-Party CDN

Content

View full analysis

MongoDB (DDS) Health Inspection Report - {instance_id} ``` ### Technical Analysis Generated HTML reports load and execute ECharts from `cdn.jsdelivr.net` whenever the report is opened with network access. Although the dependency includes a version string, the report does not include Subresource Integrity, a restrictive Content Security Policy, or a locally bundled reviewed copy. The remote script executes in the same document context as the report. It can therefore read report DOM content, including instance metadata, database and collection names, session details, client identifiers, alerts, and slow-query text. Pinning only the package version in the URL does not cryptographically bind the response to a reviewed file. HTML escaping is applied to many cloud-derived values, reducing direct stored HTML injection risk. It does not, however, protect the report from a compromised external script that is intentionally granted execution privileges by the `

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/health-inspect.py:484

Finding

Cloud-Side Task Creation Is Misclassified as Read-Only and Granted Account-Wide

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared behavior promises a broad, read-only MongoDB health inspection with standardized reporting, but the analyzed behavior reportedly does not implement those functions and appears limited in scope. This mismatch is dangerous because operators may trust the output as a comprehensive inspection, leading to false assurance, missed incidents, and potentially unsafe operational decisions based on incomplete checks.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill instructs users to execute a remote installation script via curl piped directly to bash. This is a classic supply-chain and arbitrary code execution risk: if the remote content, hosting, TLS termination, or delivery path is compromised, the machine running the skill will execute attacker-controlled code immediately.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.
> Then [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> Then [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow includes aliyun das create-storage-analysis-task, which is a state-changing API call that creates a backend task, contradicting the skill’s read-only claim. Even if the operation is low risk compared with deleting or modifying data, it still violates least-privilege expectations and could trigger billable activity, audit noise, or unintended side effects when an agent is expected to perform only passive inspection.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is described as performing a read-only health inspection, but it invokes CreateStorageAnalysisTask, which creates a DAS task and therefore performs a state-changing control-plane action. This violates the read-only contract, can surprise operators, and may have audit, permission, cost, or operational side effects in environments that rely on strict non-mutating diagnostics.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill invokes shell scripts, relies on environment variables, performs network-backed CLI operations, and produces local report files, yet it declares no explicit tool scope or permission boundaries. This increases the chance that an agent executes higher-risk capabilities than the user expects, especially because the skill also instructs local file creation under Downloads and cloud access through the CLI.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger list contains broad phrases like resource usage, alerts, risk assessment, and inspection terms that could activate the skill for ambiguous requests outside a clearly scoped DDS health-check intent. In an agent setting, overbroad triggers can cause unintended cloud-environment enumeration, report generation, or execution of the inspection script when the user did not specifically request this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill states that reports are written to ~/Downloads by default but does not prominently warn users up front that local files will be created. In managed or shared environments, silent artifact creation can leak operational metadata, create forensic residue, or violate user expectations about where sensitive infrastructure reports are stored.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document explicitly warns that agents must never run credential-setting commands, then immediately states that non-interactive aliyun configure flows are recommended for scripts, CI/CD, and agent-driven automation. That contradiction can normalize or justify secret injection during automated runs, increasing the chance an agent or operator provisions long-lived credentials in-session or in logs.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The guide instructs users to create and save long-lived AccessKey secrets, then documents persistent storage in config files and environment variables. In an agent-skill context, normalizing durable credential creation and retention raises the risk of accidental secret persistence, reuse across sessions, and leakage through logs, shell history, or agent-accessible files.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 131)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 421)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill is for MongoDB health inspection, but this guide expands into generic Alibaba Cloud CLI/plugin usage across unrelated services such as ECS, VPC, RDS, and FC. Excess operational scope increases the chance the agent acquires or is instructed to use capabilities beyond least privilege, which can enable unintended reconnaissance or cloud administration actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation frames the commands as internal health-inspection calls while the referenced workflow contains a non-read-only task creation step. This mismatch can mislead operators, reviewers, or downstream agents into granting broader trust and permissions than intended, increasing the chance that a supposedly safe inspection skill performs state-changing actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/check-write-operation.sh (reported line 124)May include surrounding context.

sh

"hookSpecificOutput": {
    "hookEventName": "PreToolUse",
    "permissionDecision": "allow",
    "permissionDecisionReason": "Read operation API ($ACTION), no confirmation needed."
  }
}
EOF

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/find-instance-region.py (reported line 32)May include surrounding context.

python

cmd.extend([f'--{key}', str(value)])

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        if result.returncode == 0:
            return json.loads(result.stdout)
    except (subprocess.TimeoutExpired, json.JSONDecodeError):

Tainted flow: 'cmd' from os.environ.get (line 21, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/find-instance-region.py (reported line 32)May include surrounding context.

python

cmd.extend([f'--{key}', str(value)])

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        if result.returncode == 0:
            return json.loads(result.stdout)
    except (subprocess.TimeoutExpired, json.JSONDecodeError):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/find-instance-region.py (reported line 81)May include surrounding context.

python

# Check if aliyun CLI is available
    try:
        result = subprocess.run(['aliyun', 'version'], capture_output=True, text=True, timeout=5)
        if result.returncode != 0:
            raise FileNotFoundError
    except (FileNotFoundError, subprocess.TimeoutExpired):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/health-inspect.py (reported line 2112)May include surrounding context.

python

# Check if aliyun CLI is available
    try:
        result = subprocess.run(['aliyun', 'version'], capture_output=True, text=True, timeout=5)
        if result.returncode != 0:
            raise FileNotFoundError
    except (FileNotFoundError, subprocess.TimeoutExpired):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/health-inspect.py (reported line 57)May include surrounding context.

python

for key, value in kwargs.items():
        cmd.extend([f'--{key}', str(value)])
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        if result.returncode == 0:
            try:
                return json.loads(result.stdout)

Tainted flow: 'cmd' from os.environ.get (line 47, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/health-inspect.py (reported line 57)May include surrounding context.

python

for key, value in kwargs.items():
        cmd.extend([f'--{key}', str(value)])
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        if result.returncode == 0:
            try:
                return json.loads(result.stdout)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

In batch mode, the tool enumerates all DDS instances and writes one report per instance plus an index file to disk, creating a concentrated local snapshot of account-wide infrastructure and workload data. In this skill's context, bulk export materially increases sensitivity because it aggregates identifiers, regions, node details, slow queries, sessions, and alerts across the whole account, amplifying confidentiality risk if the directory is accessed or synced unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script writes detailed inspection reports to local disk, including instance identifiers, topology, performance trends, session details, slow query text, and alert history, without explicit warning or data-minimization controls. In the context of an account-inspection skill, these reports can contain sensitive operational metadata and query content that may be exposed to other local users, backups, or unintended file-sharing paths.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.