Security audit

alibabacloud-opc-advisor

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a cloud package recommendation skill, but it blurs a read-only advisor boundary by repeatedly telling users it can order and create paid cloud resources.

Review before installing. This skill can be useful for Alibaba Cloud SKU guidance, but its wording may make an advisory recommendation feel like approval to create paid resources. Only proceed if you expect a separate deployment flow, require an explicit price/resource confirmation at checkout, and verify any DNS, account ownership, and recurring-billing assumptions yourself.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The reference explicitly instructs the advisor to end with an assisted path that says it can place the order for the user, which conflicts with the declared read-only, non-deploy role. In a cloud-purchasing context, this blurs a critical safety boundary and can lead the agent to initiate billable actions or imply authority to do so without a separate, clearly consented handoff.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: Describing structured output as being produced for a downstream deploy skill shows the advisor is designed to feed an execution path, not remain purely advisory. That coupling increases the chance that recommendations are silently transformed into provisioning actions, especially if later components trust the advisor output as authoritative.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The sample user-facing text says the assistant will directly help create the order, contradicting the documented read-only advisor intent. In a skill that recommends paid cloud SKUs and URLs, such language can mislead users into believing they already authorized real purchases or infrastructure creation.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata says this advisor is read-only and does not deploy, but the template tells the agent to offer '让我帮你下单' and '我直接帮你创建好'. That creates a scope-confusion path where an advisory skill may attempt transactional or provisioning actions the user did not explicitly route to a deploy tool for. In a cloud context, this can lead to unauthorized purchases, unintended resource creation, and unsafe delegation of account actions.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The document says structured fields are meant for a downstream deploy skill and not shown to the user, yet nearby user-facing templates state that this skill itself will create resources. This inconsistency weakens separation of duties and increases the chance an orchestrator or model will conflate advisory output with executable deployment intent. In practice, that can cause accidental privilege escalation across skills or unsafe automatic handoff behavior.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: These templates repeatedly instruct the advisor to act as if it will help '下单', '创建好', and operationally migrate code, deploy services, or configure AI calls. That exceeds the declared read-only advisory scope and encourages the model to present execution as part of this skill's responsibility. In a cloud purchasing and migration scenario, that is dangerous because it can mislead users about what the agent is authorized to do and trigger unauthorized or irreversible account operations.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The examples instruct the advisor to say it can 'help place the order' and 'directly create' resources, which conflicts with the manifest's declared read-only, non-deploy scope. This can cause capability escalation at the prompt layer: users may be misled into authorizing provisioning actions, and a downstream agent/orchestrator might incorrectly attempt account-affecting operations based on these examples.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: Although the file says it is 'only a style and format reference,' the embedded examples prescribe concrete behaviors outside the skill's declared intent, including operational assistance and purchasing flow guidance. In practice, reference examples strongly shape agent behavior, so this disclaimer does not neutralize the risk of scope drift and unsafe action suggestions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The template encourages order placement and creation of cloud resources but does not require a strong user-facing warning that the next step may incur real charges and provision billable services. For cloud infrastructure, that omission can cause accidental purchases, unexpected recurring fees, or mistaken assumptions about what the assistant is authorized to do.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The pro template instructs DNS cutover and go-live validation without warning about propagation delays, rollback planning, or possible service interruption. While less severe than unauthorized purchasing, changing DNS is a production-affecting action that can break live traffic if done incorrectly.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The questionnaire explicitly tells the advisor to infer several recommendation-driving fields, including public exposure, account type, VLM/media workload, and splits of user-data handling, while only asking two user-facing questions. Because these inferred attributes affect SKU eligibility, compliance steps, and deployment validation, a wrong assumption can lead to undersized infrastructure, inappropriate security controls, or incorrect compliance guidance without the user realizing assumptions were made. In this skill context, that is more dangerous because the output is framed as exact package selection and migration advice for non-technical users, who are less likely to detect hidden misclassification.

Static analysis

No suspicious patterns detected.