alibabacloud-nginx-ingress-to-alb-ingress

• Outcome: Pass
• Latest audit: Oct 9, 2026 · 6:51 AM UTC
• Version: 0.0.1

Overview

This skill is an offline Kubernetes Ingress migration assistant that generates manifests and user-run deployment guidance without taking cloud credentials or executing cluster changes itself.

Use this skill for offline migration planning only. Before running any generated commands yourself, replace all placeholders including addressType, region, and vSwitch IDs; review every unsupported or downgraded item; and remember that kubectl apply and DNS changes can create billable resources or change production traffic.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a migration skill that not only assesses compatibility but also generates the target Alibaba Cloud ALB resources and a migration/cutover report. The actual code chunk is narrower: it is an offline analysis script that reads YAML files/directories, inspects annotations and path semantics, and outputs findings in stderr/JSON. This matches part of the declared scope—offline compatibility analysis and some annotation/path semantics—but not the core claimed generation/migration capabilities. There is no code to emit AlbConfig, IngressClass, transformed Ingress YAML, DNS weighted cutover plans, or any cluster/cloud interaction. So the description materially overstates the implemented functionality in this chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

md

it if they inherited that label. Full rules, with the live-verified basis, in `references/generated-resources.md` §4.1.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

md

it if they inherited that label. Full rules, with the live-verified basis, in `references/generated-resources.md` §4.1.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 312)May include surrounding context.

md

it if they inherited that label. Full rules, with the live-verified basis, in `references/generated-resources.md` §4.1.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 357)May include surrounding context.

md

it if they inherited that label. Full rules, with the live-verified basis, in `references/generated-resources.md` §4.1.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 359)May include surrounding context.

md

it if they inherited that label. Full rules, with the live-verified basis, in `references/generated-resources.md` §4.1.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 373)May include surrounding context.

md

it if they inherited that label. Full rules, with the live-verified basis, in `references/generated-resources.md` §4.1.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 382)May include surrounding context.

md

it if they inherited that label. Full rules, with the live-verified basis, in `references/generated-resources.md` §4.1.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.

md

it if they inherited that label. Full rules, with the live-verified basis, in `references/generated-resources.md` §4.1.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 486)May include surrounding context.

md

it if they inherited that label. Full rules, with the live-verified basis, in `references/generated-resources.md` §4.1.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/ram-policies.md (reported line 9)May include surrounding context.

md

- **never** calls Alibaba Cloud OpenAPI
- **never** uses the aliyun CLI / SDK
- **never** accesses a Kubernetes cluster
- **never** reads credentials (AccessKey / kubeconfig)

A read-only probe is not an exception, and a generic instruction to "always make real calls instead of simulating them" does not license one — there is nothing here to simulate, since every conclusion is derived from the user's YAML. Enumerating the account's clusters, VPCs or vSwitches cannot decide which vSwitch belongs to the target cluster (that is knowable only from the cluster itself, which this skill does not touch), so a candidate list invites precisely the wrong guess, and it copies real account inventory into a report that gets shared onward. Leave `<VSW_ID_ZONE_A>` / `<VSW_ID_ZONE_B>` in place and explain how the user looks them up.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/ram-policies.md (reported line 21)May include surrounding context.

md

- **never** calls Alibaba Cloud OpenAPI
- **never** uses the aliyun CLI / SDK
- **never** accesses a Kubernetes cluster
- **never** reads credentials (AccessKey / kubeconfig)

A read-only probe is not an exception, and a generic instruction to "always make real calls instead of simulating them" does not license one — there is nothing here to simulate, since every conclusion is derived from the user's YAML. Enumerating the account's clusters, VPCs or vSwitches cannot decide which vSwitch belongs to the target cluster (that is knowable only from the cluster itself, which this skill does not touch), so a candidate list invites precisely the wrong guess, and it copies real account inventory into a report that gets shared onward. Leave `<VSW_ID_ZONE_A>` / `<VSW_ID_ZONE_B>` in place and explain how the user looks them up.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document mandates that every human-readable word in the reply must be in Chinese, regardless of the user's preferred language. This is a natural-language locale policy constraint applied unconditionally, and the file does not offer the user a language choice or opt-in.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

>    The user-facing output **is the body of this reply**, not a file you wrote. A Chinese report in `outputs/*.md` plus an English reply does **not** satisfy this — the reply is what gets read; a file is only a copy and its language cannot stand in. The scope is **every human-readable word in the message**: the opening note, the closing file list, outstanding-confirmation sections, transitions. Never "Chinese report with an English open and close". Failure messages included.
> 2. **Copy the four markers literally** — 🟢 / 🟡 / 🔴 / 🚫. Never substitute ✅ / ❌ / ⚠️ or words like "supported / unsupported" (Step 2).
> 3. **The deliverable goes in the reply.** The compatibility table, all three resources' YAML and the summary must appear in the response body; writing a copy to disk is optional, and the reply may not degrade into "written to xxx.md". **The three resources may be neither omitted nor truncated**: each carries its own `kind:` line, every generated Ingress appears (including the `defaultBackend` catch-all), and nothing stands in for a block — no "rest omitted", no "same as above", no "…" (Step 5).
> 4. **Say it all in one go** — no asking for approval before producing.
>    This holds for a **correction round** too. After the user confirms or corrects something, **re-send all three resources in full**; do not reply with a list of which lines in which files changed. That is the same degradation as "written to xxx.md" wearing another shape. The user must finish every round holding one appliable copy instead of mentally merging last round's YAML with this round's diff. Re-send even when only comments moved, and say the semantics did not change.
> 5. **Never present an inference as a measurement.** Only conclusions this document or `references/` explicitly marks as measured may be called measured or verified in the report. Everything else is "the rule says" or "must be verified". In particular do not dress up an offline `re.fullmatch`, a paper argument, or "the 
...[truncated 25 chars]

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

>    This holds for a **correction round** too. After the user confirms or corrects something, **re-send all three resources in full**; do not reply with a list of which lines in which files changed. That is the same degradation as "written to xxx.md" wearing another shape. The user must finish every round holding one appliable copy instead of mentally merging last round's YAML with this round's diff. Re-send even when only comments moved, and say the semantics did not change.
> 5. **Never present an inference as a measurement.** Only conclusions this document or `references/` explicitly marks as measured may be called measured or verified in the report. Everything else is "the rule says" or "must be verified". In particular do not dress up an offline `re.fullmatch`, a paper argument, or "the rule implies it" as a cloud-side test: this environment usually has **neither a cluster nor internet access**, so any claim of having hit a real ALB is false. A wrong attribution is worse than a wrong conclusion, because the user skips verification on the strength of it.
>
> **Given YAML, run Step 1→5 to completion in a single response.** No confirmation between steps, no pausing to ask. The migration report, cutover plan and checklist are standard output, not optional extras. Unspecified parameters become `<REGION>` / `<VSW_ID_ZONE_A>` placeholders. The only required input is the Ingress YAML itself.

### Step 1: Parse Ingress YAML

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 430)May include surrounding context.

md

>    This holds for a **correction round** too. After the user confirms or corrects something, **re-send all three resources in full**; do not reply with a list of which lines in which files changed. That is the same degradation as "written to xxx.md" wearing another shape. The user must finish every round holding one appliable copy instead of mentally merging last round's YAML with this round's diff. Re-send even when only comments moved, and say the semantics did not change.
> 5. **Never present an inference as a measurement.** Only conclusions this document or `references/` explicitly marks as measured may be called measured or verified in the report. Everything else is "the rule says" or "must be verified". In particular do not dress up an offline `re.fullmatch`, a paper argument, or "the rule implies it" as a cloud-side test: this environment usually has **neither a cluster nor internet access**, so any claim of having hit a real ALB is false. A wrong attribution is worse than a wrong conclusion, because the user skips verification on the strength of it.
>
> **Given YAML, run Step 1→5 to completion in a single response.** No confirmation between steps, no pausing to ask. The migration report, cutover plan and checklist are standard output, not optional extras. Unspecified parameters become `<REGION>` / `<VSW_ID_ZONE_A>` placeholders. The only required input is the Ingress YAML itself.

### Step 1: Parse Ingress YAML

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Lines L104-L108 state that the analysis table, summary, and guides must all be in Chinese, and mark English output as wrong. This imposes a fixed language requirement without any user opt-in or documented region-specific justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This is a real safety issue in the skill guidance: it provides live kubectl apply steps that create billable cloud resources, while the recommended placeholder self-check only greps for <VSW_ID and <REGION> and does not check for the critical <ADDRESS_TYPE_Internet_or_Intranet> placeholder discussed in the same document. That gap can let users proceed with partially edited manifests or rely on insufficient validation, increasing the chance of unintended public exposure or accidental creation attempts with unsafe/incomplete configuration.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 23)May include surrounding context.

md

- 🟢 **Auto-converted (20)**: rewritten to the matching ALB annotation — per `pkg/i2alb/providers/ingressnginx/feature_*.go` (`AddInfo`)
- 🟡 **Behaviour change (6 trigger conditions, see §2)**: converted, but the semantics may differ and need human confirmation — same source (`AddError`)
- 🔴 **Unsupported (= the ones that get removed, not limited to the nginx prefix)**: what `feature_not_support.go` (`AddCritical`) reports is exactly what it deletes — `nginx.ingress.kubernetes.io/`, `nginx.org/`, `nginx.com/`, `ingress.kubernetes.io/` (they configure a different ingress controller) plus `cert-manager.io/`, `external-dns.alpha.kubernetes.io/` (they would fight the source Ingress over the same resource during migration). A newly added upstream nginx annotation is therefore reported too — **nothing is silently ignored**
- Every other unconsumed annotation (in-house `<domain>/*`, `prometheus.io/*`, …) is **copied verbatim and reported 🟢 carried over**; packaging / GitOps metadata prefixes (`kubectl.kubernetes.io/`, `app.kubernetes.io/`, `helm.sh/`, `meta.helm.sh/`, `argocd.argoproj.io/`, `fluxcd.io/`, `kustomize.toolkit.fluxcd.io/`) are neither reported nor removed

> ⚠️ What is reported 🔴 and what is removed are now **the same set**, deliberately: calling an annotation that stays on the object "unsupported" is untrue, and any single 🔴 pushes the whole batch to `PartialSuccess`. Full prefix list in `generated-resources.md` §4.1.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/annotation-mapping.md (reported line 7)May include surrounding context.

md

- 🟢 **Auto-converted (20)**: rewritten to the matching ALB annotation — per `pkg/i2alb/providers/ingressnginx/feature_*.go` (`AddInfo`)
- 🟡 **Behaviour change (6 trigger conditions, see §2)**: converted, but the semantics may differ and need human confirmation — same source (`AddError`)
- 🔴 **Unsupported (= the ones that get removed, not limited to the nginx prefix)**: what `feature_not_support.go` (`AddCritical`) reports is exactly what it deletes — `nginx.ingress.kubernetes.io/`, `nginx.org/`, `nginx.com/`, `ingress.kubernetes.io/` (they configure a different ingress controller) plus `cert-manager.io/`, `external-dns.alpha.kubernetes.io/` (they would fight the source Ingress over the same resource during migration). A newly added upstream nginx annotation is therefore reported too — **nothing is silently ignored**
- Every other unconsumed annotation (in-house `<domain>/*`, `prometheus.io/*`, …) is **copied verbatim and reported 🟢 carried over**; packaging / GitOps metadata prefixes (`kubectl.kubernetes.io/`, `app.kubernetes.io/`, `helm.sh/`, `meta.helm.sh/`, `argocd.argoproj.io/`, `fluxcd.io/`, `kustomize.toolkit.fluxcd.io/`) are neither reported nor removed

> ⚠️ What is reported 🔴 and what is removed are now **the same set**, deliberately: calling an annotation that stays on the object "unsupported" is untrue, and any single 🔴 pushes the whole batch to `PartialSuccess`. Full prefix list in `generated-resources.md` §4.1.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/annotation-mapping.md (reported line 89)May include surrounding context.

md

- 🟢 **Auto-converted (20)**: rewritten to the matching ALB annotation — per `pkg/i2alb/providers/ingressnginx/feature_*.go` (`AddInfo`)
- 🟡 **Behaviour change (6 trigger conditions, see §2)**: converted, but the semantics may differ and need human confirmation — same source (`AddError`)
- 🔴 **Unsupported (= the ones that get removed, not limited to the nginx prefix)**: what `feature_not_support.go` (`AddCritical`) reports is exactly what it deletes — `nginx.ingress.kubernetes.io/`, `nginx.org/`, `nginx.com/`, `ingress.kubernetes.io/` (they configure a different ingress controller) plus `cert-manager.io/`, `external-dns.alpha.kubernetes.io/` (they would fight the source Ingress over the same resource during migration). A newly added upstream nginx annotation is therefore reported too — **nothing is silently ignored**
- Every other unconsumed annotation (in-house `<domain>/*`, `prometheus.io/*`, …) is **copied verbatim and reported 🟢 carried over**; packaging / GitOps metadata prefixes (`kubectl.kubernetes.io/`, `app.kubernetes.io/`, `helm.sh/`, `meta.helm.sh/`, `argocd.argoproj.io/`, `fluxcd.io/`, `kustomize.toolkit.fluxcd.io/`) are neither reported nor removed

> ⚠️ What is reported 🔴 and what is removed are now **the same set**, deliberately: calling an annotation that stays on the object "unsupported" is untrue, and any single 🔴 pushes the whole batch to `PartialSuccess`. Full prefix list in `generated-resources.md` §4.1.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/analyze-ingress-offline.sh (reported line 304)May include surrounding context.

sh

- 🟢 **Auto-converted (20)**: rewritten to the matching ALB annotation — per `pkg/i2alb/providers/ingressnginx/feature_*.go` (`AddInfo`)
- 🟡 **Behaviour change (6 trigger conditions, see §2)**: converted, but the semantics may differ and need human confirmation — same source (`AddError`)
- 🔴 **Unsupported (= the ones that get removed, not limited to the nginx prefix)**: what `feature_not_support.go` (`AddCritical`) reports is exactly what it deletes — `nginx.ingress.kubernetes.io/`, `nginx.org/`, `nginx.com/`, `ingress.kubernetes.io/` (they configure a different ingress controller) plus `cert-manager.io/`, `external-dns.alpha.kubernetes.io/` (they would fight the source Ingress over the same resource during migration). A newly added upstream nginx annotation is therefore reported too — **nothing is silently ignored**
- Every other unconsumed annotation (in-house `<domain>/*`, `prometheus.io/*`, …) is **copied verbatim and reported 🟢 carried over**; packaging / GitOps metadata prefixes (`kubectl.kubernetes.io/`, `app.kubernetes.io/`, `helm.sh/`, `meta.helm.sh/`, `argocd.argoproj.io/`, `fluxcd.io/`, `kustomize.toolkit.fluxcd.io/`) are neither reported nor removed

> ⚠️ What is reported 🔴 and what is removed are now **the same set**, deliberately: calling an annotation that stays on the object "unsupported" is untrue, and any single 🔴 pushes the whole batch to `PartialSuccess`. Full prefix list in `generated-resources.md` §4.1.

Static analysis

No suspicious patterns detected.