alibabacloud-mtr-network-diagnosis-customer

• Outcome: Review
• Latest audit: Jul 30, 2026 · 9:23 AM UTC
• Version: 0.0.1

Overview

This Alibaba Cloud network diagnostic skill has a coherent purpose, but it also exposes broad remote command execution on ECS instances with weak guardrails.

Review this skill before installing. Use only tightly scoped Alibaba Cloud credentials, restrict ecs:RunCommand to the specific ECS instances needed, require explicit confirmation for every remote command or package install, and consider removing or disabling the raw run-command path and automatic ipinfo.io enrichment in sensitive environments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

shell_cmd = " ".join(shlex.quote(c) for c in cmd)
    try:
        result = subprocess.run(
            shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout,
        )
    except subprocess.TimeoutExpired:

• Confidence: 93% confidence
• Finding: The code builds a shell command string and executes it with shell=True. Although arguments are shell-quoted, product/api/params can still be influenced by upstream inputs and shell invocation unnecessarily expands the attack surface, making command execution semantics dependent on the shell and increasing risk of command or parameter injection if quoting assumptions ever fail.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"[WARNING] Transient error for {product} {api}, retrying...",
                  file=sys.stderr)
            try:
                retry_result = subprocess.run(
                    shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout)
                if retry_result.returncode == 0:
                    try:

• Confidence: 93% confidence
• Finding: This retry path repeats the same shell=True execution of a constructed command string. The same injection and shell-abuse risk applies here, and retrying can amplify the impact of a bad invocation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to use shell commands, read environment-derived credentials, access local files/scripts, and make network/API calls, but it does not declare any permissions. This creates a transparency and governance gap: the runtime may grant broad capabilities without users/reviewers being clearly informed, increasing the risk of unintended command execution, credential use, and remote ECS operations.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The code explicitly falls back to an unverified TLS context after a certificate validation failure, disabling both certificate verification and hostname checking for requests to ipinfo.io. This enables man-in-the-middle interception or spoofing of ISP lookup responses, undermining transport security and potentially causing incorrect diagnostics or disclosure of queried IP metadata to an attacker on the network path.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The CLI exposes a generic `run-command` subcommand that accepts arbitrary shell script content and executes it remotely on ECS instances via Cloud Assistant. That capability materially exceeds the stated MTR/network-diagnosis scope and turns the skill into a general-purpose remote code execution wrapper, which could be abused to run destructive commands, exfiltrate data, or change system state on target instances.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: `run_remote_command` is a reusable primitive for executing arbitrary shell scripts on remote ECS instances, with no validation, scoping, or restriction to MTR-related commands. In the context of a public network diagnosis skill, this creates an unnecessary high-risk execution surface that can be leveraged for arbitrary remote actions well beyond troubleshooting.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: If the hook cannot parse the incoming JSON or extract the command, it returns an automatic allow decision instead of failing closed or prompting the user. Because this script is meant to gate potentially dangerous cloud actions, an attacker or malformed caller could bypass the write-operation check by supplying unexpected input structure or malformed data, leading to unauthorized remote command execution or resource changes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill sends traceroute/MTR hop IPs to a third-party service (ipinfo.io) for enrichment without any visible consent gate, warning, or privacy control in this code path. In a network-diagnosis tool, hop IPs can reveal internal infrastructure relationships, customer traffic paths, and target systems, so silent external transmission creates a real data exposure and compliance risk.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The environment-check feature enumerates credential-related configuration and returns profile names, modes, regions, and role ARN presence without an explicit warning. Even without printing raw secrets, this exposes sensitive operational metadata that can help an attacker map cloud access paths and target privileged profiles.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The `run-command` code path exposes remote custom script execution directly from CLI arguments without any in-code confirmation gate, warning, or authorization check. Because the underlying action executes on user infrastructure, lack of an explicit confirmation flow increases the likelihood of accidental or socially engineered misuse.

Unvalidated Output Injection

High

• Category: Output Handling

Content

shell_cmd = " ".join(shlex.quote(c) for c in cmd)
    try:
        result = subprocess.run(
            shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout,
        )
    except subprocess.TimeoutExpired:

• Confidence: 89% confidence
• Finding: Unvalidated command construction combined with shell=True allows externally derived values to influence a shell-executed command path. In a cloud-diagnostic skill that may accept instance IDs, regions, and API parameters from user-driven workflows, this creates a meaningful risk of unintended command execution or unsafe CLI invocation.

Unvalidated Output Injection

High

• Category: Output Handling

Content

print(f"[WARNING] Transient error for {product} {api}, retrying...",
                  file=sys.stderr)
            try:
                retry_result = subprocess.run(
                    shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout)
                if retry_result.returncode == 0:
                    try:

• Confidence: 89% confidence
• Finding: The retry branch repeats the same shell-executed command with the same externally influenced parameters. That preserves the same injection risk and can compound operational harm by reissuing a malicious or malformed command.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

shell_cmd = " ".join(shlex.quote(c) for c in cmd)
    try:
        result = subprocess.run(
            shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout,
        )
    except subprocess.TimeoutExpired:

• Confidence: 92% confidence
• Finding: The skill exposes a generic CLI wrapper that accepts product, api, and arbitrary params and then executes them through the shell. In an agent context, broad parameter pass-through to a cloud CLI is dangerous because malformed or adversarial inputs can alter command behavior and potentially drive unauthorized cloud operations.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

print(f"[WARNING] Transient error for {product} {api}, retrying...",
                  file=sys.stderr)
            try:
                retry_result = subprocess.run(
                    shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout)
                if retry_result.returncode == 0:
                    try:

• Confidence: 92% confidence
• Finding: The same generic, shell-backed CLI wrapper is used in the retry path, so parameter abuse remains possible there as well. Because this skill can automate diagnostics against cloud instances, abuse of wrapper inputs could lead to unintended remote actions or broadened reconnaissance.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/mtr_analyze.py:261