Alibabacloud Network Health Inspection

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:36 AM UTC
• Version: 0.0.1

Overview

The skill mostly performs the advertised Alibaba Cloud network inspection, but it understates local and external side effects such as dependency installation, CLI plugin updates, file creation, and optional DingTalk publishing.

Install only if you are comfortable with local environment changes and handling sensitive Alibaba Cloud inventory data. Use a narrowly scoped read-only RAM identity, run it in an isolated virtual environment or container, review any `pip3 install` or `aliyun plugin update` step before allowing it, keep reports local unless you explicitly want DingTalk publishing, and clean up generated files after use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:220

Finding

Unpinned Automatic Installation of a Runtime Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 220-223
Vulnerability Type: Unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

python3 -c "import matplotlib; print('matplotlib', matplotlib.__version__)" 2>&1

# If matplotlib is not installed, install it automatically
pip3 install matplotlib

Technical Analysis

The Skill instructs the Agent to install matplotlib automatically from the active Python package index without pinning a version, verifying package hashes, using a lockfile, or requesting explicit user approval.

A package installation can execute package build and installation logic with the privileges of the user running the Agent. The effective dependency and its transitive dependencies may change after the Skill has been audited. The configured pip index could also be a compromised or attacker-controlled mirror.

This behavior exceeds the Skill's stated read-only cloud inspection scope because it modifies the local Python environment and introduces remotely retrieved executable code.

Attack Path

1. The user invokes the network inspection Skill.
2. The environment does not contain matplotlib, or the Agent follows the installation instruction without reliably confirming its presence.
3. The Agent executes pip3 install matplotlib.
4. pip retrieves the current package and transitive dependencies from its configured index.
5. If the package source, release, dependency, or configured mirror is compromised, attacker-controlled installation code executes locally.
6. The malicious code runs with the Agent process's user privileges and may access files, environment variables, local Alibaba Cloud CLI configuration, or other resources available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the operating-system user running the Agent. The accessible scope ...[truncated 524 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic dependency installation from the Skill's execution workflow.

2. Treat dependency installation as a separate prerequisite and stop with a clear error when the dependency is unavailable.

3. Require explicit user confirmation before making any local environment modification.

4. Pin matplotlib and all transitive dependencies to audited versions.

5. Use a hash-verified requirements file, for example:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

6. Install dependencies in an isolated virtual environment rather than modifying the global or user Python environment.

7. Use a trusted, explicitly configured package index and retain installation errors instead of suppressing relevant diagnostics.

8. Periodically audit and deliberately update pinned dependencies through a controlled review process.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:189

Finding

Automatic Update of Executable Alibaba Cloud CLI Plugins

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 189-196 and 213-217
Vulnerability Type: Unverified runtime supply-chain update
Risk Level: Medium

Vulnerable Code:

bash

# Enable AI-Mode (run once before any aliyun CLI usage)
aliyun configure ai-mode enable

# Set User-Agent to identify this Skill
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-network-health-inspection"

# Update plugins to ensure latest versions
aliyun plugin update 2>/dev/null || true

The command is repeated in the execution workflow:

bash

# Enable AI-Mode and set User-Agent (must run at the start of each Skill execution)
aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-network-health-inspection"

# Update aliyun CLI plugins (ensure latest plugin versions)
aliyun plugin update 2>/dev/null || true

Technical Analysis

The Skill requires an update of executable Alibaba Cloud CLI plugins at runtime. Plugin updates retrieve mutable components that are outside the reviewed project and may subsequently execute during authenticated cloud API operations.

No plugin version is pinned, no artifact integrity or provenance verification is specified, and no user confirmation is required. The command also redirects standard error to /dev/null and forces success with || true, concealing update failures and security-relevant diagnostics.

This behavior contradicts the Skill's statement that Bash is restricted to read-only Alibaba Cloud queries and Python inspection scripts. Updating plugins changes the local toolchain and is not necessary to perform the declared read-only inspection when compatible plugins are already installed.

Attack Path

1. The user starts a network inspection.
2. Before resource enumeration, the Agent runs aliyun plugin update.
3. The CLI contacts its confi ...[truncated 1448 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove aliyun plugin update from the normal Skill execution path.
2. Verify required plugin presence and compatibility without modifying the installation.
3. If an update is required, stop and request explicit user approval before proceeding.
4. Pin plugins to reviewed versions and verify downloaded artifacts using vendor-provided signatures or cryptographic hashes.
5. Perform updates as a separate controlled maintenance operation rather than during an authenticated inspection.
6. Avoid suppressing update errors. Record and present failures so users can investigate unexpected repository, signature, or network behavior.
7. Run the CLI in an isolated environment with a narrowly scoped RAM identity containing only the permissions documented in references/ram-policies.md.
8. Ensure the update process cannot silently alter shared or system-wide CLI installations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code is consistent with a subset of the description: it is read-only and performs health inspection on one network product type, ALB, using Cloud Monitor metrics and basic risk assessment. However, the declared purpose materially overstates scope and output. This chunk does not inspect the wide range of listed network products, does not analyze packet loss, and does not generate a Markdown report with monitoring charts or scaling recommendations. Its primary behavior is a narrower ALB-only metrics collection and risk evaluation tool that prints standardized JSON.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code is consistent with a read-only network inspection utility, and for the CEN subset it does perform bandwidth-related health analysis and risk assessment. However, the declared description describes a much broader, comprehensive multi-product inspection tool with richer analytics (connection count, QPS, packet loss), Markdown reporting with monitoring charts, and scaling recommendations. This specific code chunk only handles CEN resources, queries two bandwidth metrics, and emits JSON output. That makes the actual behavior materially narrower than the declared purpose. While this may be one component of a larger tool, evaluating this supplied code chunk alone, the description does not accurately represent what it actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code aligns with part of the description: it is read-only, uses Cloud Monitor metrics, and handles several listed network products while producing monitoring charts. However, the declared purpose overstates the implemented functionality in this code chunk. This script's actual role is narrower: it fetches metrics and renders PNG charts, then outputs a JSON manifest. There is no logic for producing a Markdown inspection report, computing headroom/over-limit risk, assessing health, or recommending scaling actions. In addition, the declared product coverage includes Transit Router and Physical Connection, neither of which is implemented here as distinct product handlers. VBR metrics are queried from the physical connection namespace, but that is not equivalent to explicit Physical Connection inspection support. Therefore the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code is consistent with part of the description: it is read-only, uses monitoring data, evaluates bandwidth utilization and packet-drop-related risk, and performs a network health inspection. However, the declared purpose describes a much broader multi-product inspection framework with richer metrics and Markdown reporting. This specific code chunk only handles EIP resources via DescribeEipAddresses and Cloud Monitor metrics in the acs_vpc_eip namespace. It computes tx/rx utilization and detects rate-limit drops, but does not inspect NAT Gateway, CEN, CLB, ALB, NLB, or other listed products, nor does it analyze connection counts or QPS. It also prints JSON rather than generating a Markdown report with charts and recommendations. Therefore the supplied code chunk does not accurately match the full declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code is consistent with a subset of the description: it is read-only and does perform network health inspection using Cloud Monitor data. However, the declared purpose describes a broad, comprehensive multi-product inspection/reporting tool, while this code chunk only handles NLB. It also lacks several specifically claimed outputs and analyses, such as Markdown report generation, monitoring charts, packet-loss analysis, and scaling recommendations. Therefore the description does not accurately represent what this particular supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description promises a comprehensive network product inspection workflow driven by Cloud Monitor data and producing rich analytical reports. This code chunk is much narrower: it performs a read-only DescribePhysicalConnections call, extracts basic instance fields, assigns a simple risk level based only on status/business status, and emits standardized JSON. It explicitly states that Physical Connection itself has no Cloud Monitor metrics here and that traffic/loss monitoring must be checked through VBR elsewhere. While the read-only nature is consistent with the description, the implemented behavior in this chunk materially underdelivers versus the declared purpose, especially around metrics analysis, reporting format, and recommendations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code is read-only as declared, but the declared description substantially overstates the functionality. This script is narrowly focused on Transit Router inspection under CEN: it lists CEN instances, transit routers, VPC/VBR attachments, and route table counts, then flags risks based on TR/attachment status. It does not access Cloud Monitor, does not analyze operational metrics like bandwidth/QPS/packet loss, and does not generate the promised Markdown report with charts or scaling advice. Therefore the actual behavior is materially narrower and different from the declared comprehensive network health inspection purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a comprehensive multi-product network inspection tool with Markdown reporting, charts, and capacity/scaling analysis. The supplied code chunk is much narrower: it only inspects VBR instances, retrieves a specific set of VBR-related Cloud Monitor metrics, computes a simple risk level, and prints standardized JSON output. It is consistent with the read-only claim, and the VBR-related health inspection aspect matches part of the description, but the primary scope and outputs are materially narrower than declared. Therefore this code chunk does not accurately represent the full declared functionality.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

## Prerequisites

- **aliyun CLI**: Must be installed and configured with access credentials (`aliyun configure`). If not installed, use `brew install aliyun-cli` (macOS) or download from [GitHub Releases](https://github.com/aliyun/aliyun-cli/releases)
- **Python 3.7+**: Required for running inspection scripts and generating monitoring charts
- **matplotlib**: Python charting library for generating monitoring charts. If not installed, run `pip3 install matplotlib`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 474)May include surrounding context.

md

## Prerequisites

- **aliyun CLI**: Must be installed and configured with access credentials (`aliyun configure`). If not installed, use `brew install aliyun-cli` (macOS) or download from [GitHub Releases](https://github.com/aliyun/aliyun-cli/releases)
- **Python 3.7+**: Required for running inspection scripts and generating monitoring charts
- **matplotlib**: Python charting library for generating monitoring charts. If not installed, run `pip3 install matplotlib`

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The safety statement says Bash is never used for write operations, but later sections direct installations, configuration changes, directory creation, and file writes. False safety claims are especially risky in agent skills because they can bypass human caution and policy checks that depend on honest disclosure of side effects.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill repeatedly asserts that operations are read-only, yet the documented workflow performs system changes such as enabling/disabling CLI AI mode, updating plugins, and installing Python packages. This is dangerous because users and approval systems may authorize the skill under a low-risk read-only assumption while it actually mutates host configuration and software state.

Content

No source excerpt is available for this finding.

Scope Creep

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill declares only Bash and Read with a read-only posture, but instructs Bash to create directories, write JSON/report files, and modify global environment state. This mismatch defeats trust boundaries around tool permissions and can cause reviewers or orchestrators to underestimate the skill's ability to persist data locally or alter execution state.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The script reads environment variables such as ALIYUN_CLI_PROFILE and ALIBABA_CLOUD_REGION, giving it environment-access capability that is reportedly undeclared. In an agent skill, undeclared access to environment-derived configuration can bypass permission transparency, influence which credentials/profile are used, and cause the skill to operate against unintended cloud accounts or regions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

This is a true tool-parameter abuse risk because the function accepts multiple dynamic inputs and forwards them into a shell-based subprocess invocation. In an agent setting, parameters may be indirectly influenced by prompts, tool chaining, or hostile input, so using a shell can turn a read-only cloud inspection helper into an arbitrary command execution primitive on the host.

Content

Scanner excerpt · scripts/inspect_common.py (reported line 70)May include surrounding context.

python

shell_cmd = " ".join(shlex.quote(c) for c in cmd)
    try:
        result = subprocess.run(shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    except subprocess.TimeoutExpired:
        return {"error": f"API 调用超时: {product} {api}"}
    except FileNotFoundError:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/inspect_common.py (reported line 269)May include surrounding context.

python

has_cli_profile = False
    if HAS_CLI:
        try:
            result = subprocess.run("aliyun configure list", shell=True,
                                    capture_output=True, text=True, timeout=10)
            if result.returncode == 0 and result.stdout.strip():
                has_cli_profile = True

Lp1

High

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The script can write arbitrary files via the --output argument and also creates parent directories automatically. In a skill advertised as read-only, undeclared file-write capability expands the trust boundary: a caller or orchestration layer may assume no persistent side effects, but the code can still modify the local filesystem and overwrite accessible paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest says the skill is triggered by phrases such as "network health check," "capacity assessment," and "network utilization analysis," which are broad descriptions rather than narrowly scoped invocation terms. Because the file does not provide exclusion conditions or negative examples, these phrases could match ordinary diagnostic conversations and cause unintended activation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow creates temporary directories, JSON files, charts, and Markdown reports, but the description does not clearly warn users about local artifact creation. This can expose potentially sensitive infrastructure data on disk longer than expected, especially on shared or monitored systems.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The optional DingTalk publishing flow expands the skill from read-only inspection into external document creation and bulk upload of report content and images. This is dangerous because network topology, utilization, instance identifiers, and charts may be transmitted to an external service outside the original inspection scope, increasing confidentiality risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The documented parallel curl uploads send generated charts and report-related artifacts to external URLs. Even if intended for DingTalk Docs, this is an outbound data transfer path that can expose internal inventory, identifiers, performance patterns, and topology information if used without strict consent and validation.

Content

Scanner excerpt · SKILL.md (reported line 372)May include surrounding context.

md

> **Performance critical**: Issue **all** `get_doc_attachment_upload_info` MCP calls **in a single message** (do not call them one by one waiting for each return before calling the next). DingTalk MCP supports concurrent calls, so all credentials can be returned in parallel.

**Phase 2: Parallel curl upload**

Put all `curl -X PUT` commands into **a single Bash call** for parallel execution:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language content in the module docstring and argument descriptions that is exclusively Chinese. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring explicitly says the script involves no write operations, and the CLI description at L519 labels it as read-only. In practice, L526 creates the output directory and L114 writes chart files, so the documentation actively contradicts the code's side effects.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill manifest centers on read-only API inspection, and this file's module docstring at L007 says all operations are read-only with no write operations. However, the implementation saves generated charts as PNG files and creates an output directory, which is a write side effect outside a purely read-only interpretation of the described behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring, CLI description, and argument help text are all written only in Chinese, which imposes a specific language on users without offering an alternative or documenting that the skill is intentionally limited to Chinese-speaking users. This matches the language/locale policy concern for natural-language content in code files.

Content

No source excerpt is available for this finding.