Alibabacloud Network Eip Associate

• Outcome: Review
• Latest audit: May 29, 2026 · 9:36 PM UTC
• Version: 0.0.1-beta.2

Overview

This Alibaba Cloud EIP skill has a legitimate core workflow, but its supporting docs broaden into risky cloud creation/deletion and credential practices that need review before use.

Install only if you intend to let an agent operate Alibaba Cloud networking resources. Use a dedicated least-privilege RAM user or short-lived credentials, an isolated Aliyun CLI profile, explicit non-production testing where possible, and manual confirmation before any bind, unbind, release, create, or delete action. Avoid following the broader VPC/ECS/NAT/ALB create/delete reference commands unless you deliberately need them in a disposable environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The acceptance criteria broadens an EIP-association skill into creating and deleting additional infrastructure such as VPC, VSwitch, NAT Gateway, ALB, ECS instances, and security groups. This is dangerous because it increases the blast radius, cost exposure, and risk of unintended destructive actions beyond the skill’s stated scope, especially if an agent follows the criteria literally.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The document claims support for ECS, ENI, CLB, NAT Gateway, HAVIP, and IP-address binding, but the acceptance criteria test ALB instead and omit CLB/IP-address workflows. This mismatch can cause an agent to execute operations on unintended resource types or mislead reviewers about what the skill actually does, undermining scope control and safe validation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file is a general-purpose Aliyun CLI installation and account-configuration guide, not documentation narrowly scoped to EIP allocation/association. In an agent skill that claims EIP-only behavior, bundling broad CLI, authentication, IAM role assumption, plugin, endpoint, and proxy guidance expands the operational surface and can enable actions well beyond the declared capability, increasing the risk of misuse or over-privileged execution.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The guide explicitly encourages installing arbitrary product plugins and exploring commands for unrelated services such as ECS and FC. For an EIP-association skill, this unjustifiably broadens the reachable command surface and can lead an agent or user to enable and invoke non-EIP capabilities that are outside intended scope.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The authentication section teaches long-lived access key setup, multiple profile management, and cross-account/elevated role assumption patterns that provide broad account access far beyond EIP association. In the context of an automation skill, this increases the chance of over-privileged credentials being provisioned and reused for unintended resource access or modification.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The document for an EIP-only skill enumerates creation and deletion commands for VPCs, vSwitches, NAT gateways, security groups, ECS instances, and load balancers, which expands the operational scope far beyond simple EIP allocation and association. In an agent setting, this can enable unintended provisioning or destructive cleanup actions, increasing risk of infrastructure modification, cost exposure, and accidental outages.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The resource mapping is inconsistent with the skill metadata: the skill claims support for CLB, HAVIP, and IP addresses, while the table documents NAT, ECS, and ALB instead. This mismatch can cause an agent or operator to apply the wrong association method or target the wrong resource class, leading to failed actions or unintended network changes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The markdown instructs credential validation and creation/deletion of real cloud resources without an explicit warning about financial cost, service disruption, or destructive consequences. In a cloud automation context, this omission is dangerous because users or agents may run the workflow against production credentials and incur charges or delete active infrastructure without informed consent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The file documents an EIP unbind operation that can immediately remove public reachability from a production resource, but it provides no warning, confirmation guidance, or note about service disruption. In an agent skill context, concise command references are likely to be copied or executed directly, which increases the chance of accidental outages caused by routine-looking instructions.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The release command permanently relinquishes the EIP allocation, which can break connectivity and may result in loss of the address with limited or no recovery options, yet the documentation gives no user-facing warning. Because this skill is specifically focused on EIP lifecycle actions, users may treat the command list as operational guidance, making accidental destructive execution more likely and more dangerous.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The examples place access key ID and secret directly on the command line, which can leak through shell history, process listings, telemetry, CI logs, and agent execution traces. Because these are cloud credentials, disclosure can immediately enable unauthorized access to Alibaba Cloud resources according to the permissions attached to the key.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The recommendation to prefer non-interactive configuration for scripts, CI/CD, and agent-driven automation omits critical warnings about secret exposure in build logs, trace output, environment dumps, and workflow artifacts. In an agent context, this is especially risky because automated systems often persist prompts, commands, and outputs, turning credential handling mistakes into broad secret disclosure events.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation grants and normalizes use of `vpc:UnassociateEipAddress` and `vpc:ReleaseEipAddress` for cleanup, but it does not explicitly warn that these actions can disrupt live connectivity or permanently release a public IP. In an infrastructure automation skill focused on EIP operations, omission of this warning increases the chance of accidental service interruption or loss of an address still in operational use.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The command list includes destructive operations like delete-vswitch, delete-vpc, delete-nat-gateway, delete-security-group, delete-instance, and release-eip-address without any warning, confirmation guidance, or statement about impact. In an agent skill, presenting destructive commands as ordinary related operations increases the chance of accidental execution that deletes active infrastructure or public IP resources.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.