alibabacloud-mtr-network-diagnosis-customer

• Outcome: Review
• Latest audit: Jul 30, 2026 · 9:23 AM UTC
• Version: 0.0.1

Overview

This Alibaba Cloud network diagnostic skill has a coherent purpose, but it also exposes broad remote command execution on ECS instances with weak guardrails.

Review this skill before installing. Use only tightly scoped Alibaba Cloud credentials, restrict ecs:RunCommand to the specific ECS instances needed, require explicit confirmation for every remote command or package install, and consider removing or disabling the raw run-command path and automatic ipinfo.io enrichment in sensitive environments.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

shell_cmd = " ".join(shlex.quote(c) for c in cmd)
    try:
        result = subprocess.run(
            shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout,
        )
    except subprocess.TimeoutExpired:

• Confidence: 93% confidence
• Finding: result = subprocess.run( shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout, )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"[WARNING] Transient error for {product} {api}, retrying...",
                  file=sys.stderr)
            try:
                retry_result = subprocess.run(
                    shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout)
                if retry_result.returncode == 0:
                    try:

• Confidence: 93% confidence
• Finding: retry_result = subprocess.run( shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to use shell commands, read environment-derived credentials, access local files/scripts, and make network/API calls, but it does not declare any permissions. This creates a transparency and governance gap: the runtime may grant broad capabilities without users/reviewers being clearly informed, increasing the risk of unintended command execution, credential use, and remote ECS operations.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The code explicitly falls back to an unverified TLS context after a certificate validation failure, disabling both certificate verification and hostname checking for requests to ipinfo.io. This enables man-in-the-middle interception or spoofing of ISP lookup responses, undermining transport security and potentially causing incorrect diagnostics or disclosure of queried IP metadata to an attacker on the network path.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The CLI exposes a generic `run-command` subcommand that accepts arbitrary shell script content and executes it remotely on ECS instances via Cloud Assistant. That capability materially exceeds the stated MTR/network-diagnosis scope and turns the skill into a general-purpose remote code execution wrapper, which could be abused to run destructive commands, exfiltrate data, or change system state on target instances.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: `run_remote_command` is a reusable primitive for executing arbitrary shell scripts on remote ECS instances, with no validation, scoping, or restriction to MTR-related commands. In the context of a public network diagnosis skill, this creates an unnecessary high-risk execution surface that can be leveraged for arbitrary remote actions well beyond troubleshooting.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: If the hook cannot parse the incoming JSON or extract the command, it returns an automatic allow decision instead of failing closed or prompting the user. Because this script is meant to gate potentially dangerous cloud actions, an attacker or malformed caller could bypass the write-operation check by supplying unexpected input structure or malformed data, leading to unauthorized remote command execution or resource changes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill sends traceroute/MTR hop IPs to a third-party service (ipinfo.io) for enrichment without any visible consent gate, warning, or privacy control in this code path. In a network-diagnosis tool, hop IPs can reveal internal infrastructure relationships, customer traffic paths, and target systems, so silent external transmission creates a real data exposure and compliance risk.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The environment-check feature enumerates credential-related configuration and returns profile names, modes, regions, and role ARN presence without an explicit warning. Even without printing raw secrets, this exposes sensitive operational metadata that can help an attacker map cloud access paths and target privileged profiles.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The `run-command` code path exposes remote custom script execution directly from CLI arguments without any in-code confirmation gate, warning, or authorization check. Because the underlying action executes on user infrastructure, lack of an explicit confirmation flow increases the likelihood of accidental or socially engineered misuse.

Unvalidated Output Injection

High

• Category: Output Handling

Content

shell_cmd = " ".join(shlex.quote(c) for c in cmd)
    try:
        result = subprocess.run(
            shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout,
        )
    except subprocess.TimeoutExpired:

• Confidence: 89% confidence
• Finding: subprocess.run( shell_cmd, shell=True, capture_output

Unvalidated Output Injection

High

• Category: Output Handling

Content

print(f"[WARNING] Transient error for {product} {api}, retrying...",
                  file=sys.stderr)
            try:
                retry_result = subprocess.run(
                    shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout)
                if retry_result.returncode == 0:
                    try:

• Confidence: 89% confidence
• Finding: subprocess.run( shell_cmd, shell=True, capture_output

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

shell_cmd = " ".join(shlex.quote(c) for c in cmd)
    try:
        result = subprocess.run(
            shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout,
        )
    except subprocess.TimeoutExpired:

• Confidence: 92% confidence
• Finding: subprocess.run( shell_cmd, shell=True

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

print(f"[WARNING] Transient error for {product} {api}, retrying...",
                  file=sys.stderr)
            try:
                retry_result = subprocess.run(
                    shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout)
                if retry_result.returncode == 0:
                    try:

• Confidence: 92% confidence
• Finding: subprocess.run( shell_cmd, shell=True

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/mtr_analyze.py:261