alibabacloud-opc-advisor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:07 AM UTC
• Version: 0.0.2

Overview

The skill is mostly a Markdown-based Alibaba Cloud package advisor, but it repeatedly blurs a read-only recommendation role with assisted ordering and resource creation.

Review before installing. It appears non-executable and advisory, but users should understand that choosing the assisted path may hand off to a separate ordering/deployment workflow involving real Alibaba Cloud charges and infrastructure changes. Require clear checkout confirmation and do not provide cloud credentials unless the downstream deploy skill separately explains its permissions and rollback path.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (39)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The template tells the advisor to say '让我帮你下单' and '我直接帮你创建好', which overstates its authority and conflicts with the declared read-only selection scope. In a purchasing context, this can mislead users into believing the agent is authorized to initiate orders or provisioning, increasing the chance of unauthorized actions, consent confusion, or unsafe handoff to a companion deployment flow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This starter_app template repeats the claim that the advisor can directly place orders and create resources, despite the manifest saying it is selection-only. That mismatch is dangerous because it normalizes deceptive capability claims in a workflow involving cloud spend and infrastructure changes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The lite-tier instructions document direct ordering/provisioning assistance beyond the advisor's stated role. Because the skill operates in a cloud purchasing context, users may rely on these statements as if they were contractual or system-backed capabilities, creating risk of unauthorized provisioning paths or deceptive UX.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The pro-tier template also claims the advisor can help place orders and create resources, contradicting the manifest's non-deployment purpose. At the pro tier, the stakes are higher because configurations are more expensive and impactful, so misrepresented authority can lead to larger financial and operational consequences.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The template tells a supposedly read-only advisor to say '让我帮你下单' and '我直接帮你创建好', which crosses from recommendation into procurement/provisioning behavior. In an agent setting, this can cause unsafe capability confusion, where a selection-only skill socially engineers the user into authorizing actions outside its declared scope or triggers downstream order/deploy flows without clear separation or consent boundaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

These migration templates instruct concrete deployment and infrastructure actions such as deployment, database setup, ALB configuration, DNS cutover, and provisioning steps, which exceeds a read-only advisor's declared purpose. In practice this broadens the agent's operational scope and increases the chance of unauthorized changes, destructive migration mistakes, or hidden delegation into provisioning tools under the guise of 'advice'.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The examples instruct the advisor to say it can 'help place orders' or 'directly create' resources, which contradicts the declared read-only, non-deployment scope. That scope drift is dangerous because downstream agents or users may rely on this file as behavioral guidance and grant the skill effective purchasing or provisioning authority it was not supposed to have.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This sample output goes beyond selection into deployment guidance and states the advisor can create resources and help deploy to a server. In a skill ecosystem, example transcripts strongly shape model behavior, so this creates a real risk that the advisor will perform or recommend unauthorized operational actions, including cloud spend or misconfiguration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

These examples repeatedly tell the user the advisor can place orders or directly create cloud resources, despite the manifest saying the skill is read-only and does not deploy. Repetition across examples makes the unsafe behavior more likely to generalize, turning a documentation flaw into a systematic capability escalation risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction 'All user-facing output MUST be in Chinese (zh-CN)' forces a specific language for all interactions. The file does not offer user opt-in, fallback behavior, or a clearly documented region-specific compliance reason for this restriction.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is configured to trigger very broadly for common deployment and migration phrases, including ambiguous or potentially out-of-scope requests. This can cause unintended invocation and overtake more appropriate skills, leading users into a cloud-purchase recommendation flow when they only wanted general guidance, which is a scope/routing safety issue rather than a direct exploit.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

### Step 1.6 — Clarification & Refusal Handling (MANDATORY when answer is vague or refused)
**Mandatory interrupt rule:** Once Q-scale or Q-userdata is a vague quantifier (`十几` / `十来个` / `几十` / `大概` / `左右` / `一千人`) or a refusal (`不知道` / `随便` / `你定`), IMMEDIATELY interrupt SKU selection — do not map to a bucket or silently default. Call the corresponding script and ask a second round; until the user gives a clear second-round answer, NEVER enter Step 2 or output any default tier. Follow:
- **Cross-tier boundary quantifiers** (e.g., `十几人` / `十来个人` spanning the ≤15 / 15-80 boundary, or self-contradictory ranges like `几百` vs `几十到一百` spanning 15-80 / 80-200) MUST be clarified before mapping — silently picking either tier without asking is a hard failure. The user's second-round answer determines the tier; never take a median or round to either end.
- Vague quantifier → run the second-clarification script in [concurrency-to-sku.md](references/concurrency-to-sku.md) "Second-Clarification Rules".
- Refusal on Q-scale → present the "conservative vs elastic" binary choice from [sku-sizing-questionnaire.md](references/sku-sizing-questionnaire.md) §5; on second refusal, default to Assumption A (most conservative) and state the assumption explicitly.
- Refusal on Q-userdata → re-ask with a concrete example (`有没有登录？有没有人传图？`); **never assume "Yes" for PII/VLM triggers** (must be explicit).

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file mandates a zh-CN disclaimer and repeatedly instructs the skill to render sample wording and final prescriptions in Chinese. This is a natural-language locale policy constraint applied broadly, with no user opt-in or alternative language path documented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guidance specifies sample wording in zh-CN for user-facing questions, and later sections require rendering the prescription in Chinese. Because the file does not state that the skill is region-specific or that users can choose another language, this appears to enforce a locale without opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs the model to introspect its runtime for shell/file-write/local-execution capability and alter its advice based on that result, even though that behavior is not necessary for simple cloud SKU selection. This expands the skill's decision surface into environment-capability probing and can encourage hidden assumptions about what the system can do on the user's machine.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The instruction to infer local-execution capability from runtime context instead of asking the user relies on implicit environmental information and encourages hidden reasoning about user setup. In a security-sensitive agent system, silently deriving such capability can blur consent boundaries and lead to overconfident or invasive guidance.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/a1-zero-start.md (reported line 59)May include surrounding context.

先开套餐也行，回头再装。」

text

Both branches quote the SAME package price — the ¥59 never enters the OPC quote either way. Never ask the
user this question:

```text

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guidance states 'never expose advisor/deploy tool names,' yet the rendered text later instructs users to '打开 QWCN Pro' and '登录 OpenClaw', and repeatedly mentions QoderWork. This is a direct contradiction between the file's own intent documentation and the prescribed output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template explicitly says to render the Chinese prescription below, and the rest of the file provides user-facing sample output entirely in zh-CN. This imposes a specific language on users without indicating any option to choose another language or confirming user preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file prescribes a fixed Chinese response header for advisors, which imposes a specific language in generated user-facing output. There is no indication that the user can opt into another language or locale, so this is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This line requires a specific Chinese-language message when certain conditions are met, but does not provide any alternative language handling. That creates a locale constraint that is not presented as optional or justified within the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

These checklist items prescribe exact Chinese phrases for user-facing output, such as required wording for system disk, login, and network descriptions. Because the file does not indicate that users may choose another language or locale, this natural-language guidance appears to force a specific language/locale in a way that may violate organizational language-choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document repeatedly prescribes Chinese-only user-facing scripts, including labels like 'Sample output (zh-CN)' and exact Chinese wording, while not indicating that another language may be used based on user preference. This creates a natural-language policy concern because it effectively forces a specific language/locale without explicit opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document explicitly labels a 'Unified user-facing script (zh-CN)' and provides a single Chinese response for users. This imposes a specific language on user-facing communication without opt-in or explanation that the skill is limited to Chinese-speaking users, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented principle forbids exposing deploy tool names, yet the examples still name Cursor explicitly. That mismatch weakens safety controls because examples often override abstract policy during generation, increasing the chance of internal-tool disclosure and role confusion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.