Security audit

Alibabacloud Mongodb Instances Manage

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for managing Alibaba Cloud MongoDB, but it asks users to run mutable CLI/plugin installation steps and handle powerful cloud credentials and destructive database operations.

Install only if you need broad Alibaba Cloud MongoDB administration. Use a dedicated RAM user with the smallest permissions needed, avoid auto plugin updates where possible, verify CLI/plugin provenance before installing, avoid entering real secrets in agent-visible commands, and require explicit review before deletion, password reset, public endpoint, billing, KMS, or backup-retention changes.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:20
Finding: Automatic Installation and Updating of Unpinned Executable Plugins
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: references/cli-installation-guide.md:20
Finding: Unverified Privileged Installation of Mutable Latest CLI Packages
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/cli-installation-guide.md:128
Finding: Cloud Access Keys, Tokens, and Database Passwords Passed Through Exposed Process Channels
Content: View full analysis
\ --access-key-secret \ --region cn-hangzhou ``` ```bash # references/cli-installation-guide.md:185-193 aliyun configure set \ --mode StsToken \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --sts-token v1.0:XXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` ```bash # references/cli-installation-guide.md:255-269 export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret export ALIBABA_CLOUD_REGION_ID=cn-hangzhou export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token export ALIBABA_CLOUD_REGION_ID=cn-hangzhou ``` ```bash # SKILL.md:342-349 aliyun dds reset-account-password --db-instance-id --account-name root \ --account-password --region --user-agent AlibabaCloud-Agent-Skills/alibabacloud-mongodb-instances-manage aliyun dds reset-account-password --db-instance-id --account-name root \ --account-password --character-type db --region --user-agent AlibabaCloud-Agent-Skills/alibabacloud-mongodb-instances-manage ``` ```bash # references/operations.md:819-825 aliyun dds create-account --db-instance-id --account-name --account-password --region --user-agent AlibabaCloud-Agent-Skills/ ...[truncated 2582 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (46)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
md
> Cross-region lookup scripts and full-region scan scripts: see [references/operations.md § Query Regions and Instances](references/operations.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.
md
> Cross-region lookup scripts and full-region scan scripts: see [references/operations.md § Query Regions and Instances](references/operations.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.
md
> Cross-region lookup scripts and full-region scan scripts: see [references/operations.md § Query Regions and Instances](references/operations.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.
md
> Cross-region lookup scripts and full-region scan scripts: see [references/operations.md § Query Regions and Instances](references/operations.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.
md
> Cross-region lookup scripts and full-region scan scripts: see [references/operations.md § Query Regions and Instances](references/operations.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.
md
> Cross-region lookup scripts and full-region scan scripts: see [references/operations.md § Query Regions and Instances](references/operations.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.
md
> Cross-region lookup scripts and full-region scan scripts: see [references/operations.md § Query Regions and Instances](references/operations.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.
md
> Cross-region lookup scripts and full-region scan scripts: see [references/operations.md § Query Regions and Instances](references/operations.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 424)May include surrounding context.
md
> Cross-region lookup scripts and full-region scan scripts: see [references/operations.md § Query Regions and Instances](references/operations.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 458)May include surrounding context.
md
> Cross-region lookup scripts and full-region scan scripts: see [references/operations.md § Query Regions and Instances](references/operations.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 489)May include surrounding context.
md
> Cross-region lookup scripts and full-region scan scripts: see [references/operations.md § Query Regions and Instances](references/operations.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 494)May include surrounding context.
md
> Cross-region lookup scripts and full-region scan scripts: see [references/operations.md § Query Regions and Instances](references/operations.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 495)May include surrounding context.
md
| [references/related-apis.md](references/related-apis.md) | Complete API and CLI command list with external documentation links |

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Documenting the permanent-destruction API without a safety warning exposes an especially dangerous irreversible capability with no contextual guardrails. In a skill intended for automation, omission of warnings around permanent destroy operations materially raises the risk of catastrophic data loss.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Including KMS key creation, listing, description, and deletion introduces powerful cross-service cryptographic administration unrelated to normal MongoDB lifecycle management as described. If exposed through the skill, an agent could create or destroy keys affecting other services, causing confidentiality loss or operational outages well beyond MongoDB.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The billing API capability to create standalone KMS service instances is unrelated to MongoDB management and materially expands the skill into paid cross-service provisioning. This can lead to unauthorized spend, shadow infrastructure creation, and abuse of billing-authorized credentials.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The examples actively instruct operators or agents to create KMS keys and KMS instances, normalizing unrelated high-privilege actions inside a MongoDB skill. Example code is especially dangerous because it is likely to be copied directly into automation, turning scope creep into executable behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase "list instances" is overly generic and can activate this skill for unrelated requests that merely mention listing instances. In this skill, accidental activation is more dangerous than usual because the skill is capable of high-impact cloud operations such as deletion, password reset, public exposure, and billing changes, so misrouting a conversation into this skill increases the chance of unintended administrative actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrase "reset password" is extremely broad and can match unrelated account-recovery requests outside this specific service. Because this skill includes a root password reset workflow for MongoDB instances, unintended activation could steer an agent toward changing database credentials for the wrong system, creating service disruption or unauthorized lockout.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.
md
> [3] Reset both (execute twice separately) > ``` > > Determine execution count based on user's answer; **do NOT auto-execute twice without user confirmation** > > **Password rules:** 8-32 characters, must contain at least three of: uppercase letters/lowercase letters/digits/special characters (`!@#$%^&*()_+-=`)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 361)May include surrounding context.

[MUST] Before modifying whitelist:

First query current whitelist (describe-security-ips) and display to user

Ask for modification mode: Cover (overwrite, ⚠️ deletes existing IPs) / Append (add, errors on duplicate IPs) / Extend (extend, recommended)

Do NOT use Cover mode without asking the user

bash
aliyun dds describe-security-ips --db-instance-id <id> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-mongodb-instances-manage

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This guide is for installing and configuring the general Aliyun CLI and includes broad cross-service administration material unrelated to MongoDB instance management. In an agent skill scoped to MongoDB lifecycle operations, this unnecessary breadth expands the operational surface and can enable or normalize actions against unrelated Alibaba Cloud services.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 29)May include surrounding context.
Extract

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

Use directly for current session (no sudo or global install required)

./aliyun version

text

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 35)May include surrounding context.
md
### Linux > **Note:** Package manager installation (`dpkg`/`rpm`/`yum`) requires root privileges. Run as root or prepend your preferred privilege escalation method. **Debian/Ubuntu (dpkg)**

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 35)May include surrounding context.
md
### Linux > **Note:** Package manager installation (`dpkg`/`rpm`/`yum`) requires root privileges. Run as root or prepend your preferred privilege escalation method. **Debian/Ubuntu (dpkg)**

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

SkillSpector

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Missing User Warnings

Description-Behavior Mismatch

Context-Inappropriate Capability

Context-Inappropriate Capability

Vague Triggers

Vague Triggers

Autonomous Decision Making

Autonomous Decision Making

Description-Behavior Mismatch

Sudo/Root Execution

Extract

Use directly for current session (no sudo or global install required)

Sudo/Root Execution

Sudo/Root Execution

Static analysis