Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed Alibaba Cloud ChatOps bridge, but it can trigger high-impact cloud operations through OOS without narrow action limits or built-in confirmation.
Review this before installing in any Alibaba Cloud environment with production or billing impact. Use least-privilege RAM and OOS service-role permissions, prefer read-only testing first, and require human confirmation in your workflow before start, stop, restart, scale, batch, or billing-related operations.
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
| Action | Service | Description |
|--------|---------|-------------|
| `oos:Chat` | OOS (Operation Orchestration Service) | Send chat messages to OOS ChatOps Agent |
## Minimal RAM Policy
The skill declares no explicit tool scope or permissions despite being designed to read credentials from the environment and perform cloud operations. In a high-impact cloud-management skill, missing tool/permission boundaries increases the chance of over-broad execution, accidental credential exposure through auxiliary commands, or unintended access to sensitive runtime capabilities.
The trigger set includes broad everyday phrases such as 'ECS', 'RDS', '运维', '帮我操作', and 'list instances', which can cause the skill to activate in contexts where the user did not intend to perform cloud operations. Because this skill can initiate operational actions against Alibaba Cloud resources, unintended activation materially raises the risk of unauthorized or accidental management actions.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
)
def _create_client(self) -> OpenApiClient:
"""Create OpenAPI client with credentials."""
access_key_id = os.environ.get("ALIBABA_CLOUD_ACCESS_KEY_ID")
access_key_secret = os.environ.get("ALIBABA_CLOUD_ACCESS_KEY_SECRET")
security_token = os.environ.get("ALIBABA_CLOUD_SECURITY_TOKEN")
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
## Invocation
**[ABSOLUTE RULE] Tool whitelist**: The ONLY permitted tool for all cloud resource queries, O&M operations, and resource management tasks is `scripts/call_oos_chatops_agent.py`. For any scenario involving Alibaba Cloud resources — including but not limited to ECS, RDS, SLB, VPC, security groups, monitoring, billing, and batch operations — this script is the mandatory and exclusive entry point. If `aliyun` CLI, direct SDK calls, `curl`, or any other API tool is detected, the task is immediately treated as FAILED.
**`--pipe` is mandatory for all agent invocations.**
The file includes Chinese-only example prompts and describes the SSE response text as incremental Chinese text, which signals a language-specific interaction pattern. There is no accompanying statement that users may choose another language or that the tool is intentionally limited to a Chinese locale for compliance or regional reasons.