Security audit

alibabacloud-openagent-chat

Security checks for vulnerabilities and agentic risk

Overview

The skill’s cloud access and approval controls fit its stated purpose, with dependency updates advisable but no demonstrated malicious behavior.

Use narrowly scoped cloud permissions and authorize exact resource changes. For query-only work, restrict execution permissions to reads; conversation messaging alone does not enforce that limit. Keep secrets out of chat and prefer a release with refreshed dependency pins. Requests go to Alibaba Cloud in your chosen service region, and closing observation does not cancel cloud work.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (103)

Known Vulnerable Dependency: aiohttp==3.14.3 — 3 advisory(ies): GHSA-2g87-pp6c-29x5 (aiohttp: Multiple instances of excessive or unbounded memory/CPU use); CVE-2026-111063 (AIOHTTP: Secure attribute not enforced for shared cookie); CVE-2026-111064 (aiohttp server lacks an initial request/header timeout)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: The manifest pins aiohttp to a version reported as affected by resource-exhaustion, Secure-cookie enforcement, and server request-timeout vulnerabilities; hashes protect artifact integrity but do not fix vulnerable code. If affected paths are reachable, exploitation could exhaust the agent's resources or expose cookies under the conditions described by the cookie advisory, which is consequential for a cloud-connected agent. Its apparent client-side use through Alibaba Cloud SDK dependencies reduces the relevance of server-only issues, and neither advisory applicability nor runtime reachability can be independently established from this manifest alone.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: multidict==6.8.0 — 2 advisory(ies): CVE-2026-104874 (Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtract); CVE-2026-104874 (Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtract)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: The manifest pins multidict to a version reported as affected by a reference leak in items-view union and subtraction operations; the duplicate CVE entries describe one issue, not two independent vulnerabilities. Repeated affected operations could accumulate memory and eventually disrupt a long-running cloud-agent process, but merely processing HTTP headers does not establish that these specific operations occur. The manifest shows dependency exposure, not an attacker-controlled execution path, and the reported affected-version range has not been independently verified.
Content: No source excerpt is available for this finding.

os.system() or os exec-family call

High

Category: Dangerous Code Execution
Confidence: 85% confidence
Finding: os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.
Content: Scanner excerpt · scripts/openagent.py (reported line 58)May include surrounding context.
python
from bootstrap import PYTHON, ready redirect = ready() and Path(sys.prefix).resolve() != PYTHON.parent.parent.resolve() if redirect: os.execv(str(PYTHON), [str(PYTHON), str(Path(__file__).resolve()), *sys.argv[1:]]) with installation(package): sys.exit(run_entry()) except ClientError as exc:

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
md
Resolve `scripts/openagent.py` relative to this skill, then invoke its absolute path with the host's Python 3.11 or later. Run `bootstrap` if dependencies need preparation; it installs locked dependencies outside the skill. Keep using this entry from any working directory. Use `version` to read the installed version without cloud access. Before accessing an account, run `setup status`. Reuse an existing valid connection without asking again. Otherwise, ask once for the OpenAgent service region and credential source, reusing choices already explicitly made. The service regions are Hangzhou (`cn-hangzhou`) and Singapore (`ap-southeast-1`); this choice is independent of the resource regions in a task. Identify this as **OpenAgent Skill connection configuration**. Save the choices with `setup configure`; no separate configuration-plan approval is needed. Read [setup](references/setup.md) for the JSON format and credential guidance. Connection setup only saves local connection settings.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/openagent_client/cli.py (reported line 105)May include surrounding context.
python
'input_example': setup_proposal_example(), 'service_regions': SERVICE_REGIONS, 'instructions': ['Ask once for the OpenAgent service region: ' + region_choices() + ', and the credential source, unless already selected.', 'Save their explicit choices using setup configure. This only writes local connection settings; no cloud configuration is read or changed.', 'Reuse an existing connection without asking again. No separate configuration-plan confirmation is required.', 'The endpoint is derived from the selected region. Never put secret values in connection input.']}, 'credentials': {'sources': SOURCES, 'environment_variables': ENVIRONMENT, 'profile_default_paths': {'cli-profile': '~/.aliyun/config.json', 'sdk-profile': '~/.alibabacloud/credentials'},

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/bootstrap.py (reported line 30)May include surrounding context.
python
# A failed install never leaves the old ready marker behind. STAMP.unlink(missing_ok=True) venv.EnvBuilder(with_pip=True, symlinks=os.name != 'nt', clear=True).create(RUNTIME) result = subprocess.run([str(PYTHON), '-m', 'pip', 'install', '--disable-pip-version-check', '--require-hashes', '-r', str(LOCK)], capture_output=True) if result.returncode: print(json.dumps({'ok': False, 'code': 'DependencyInstallFailed',

Unbounded Resource Access

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
Content: Scanner excerpt · scripts/openagent_client/common.py (reported line 317)May include surrounding context.
python
for root in dict.fromkeys((self.legacy_root, self.state_root)): for path in [root / '.lock', *sorted(root.glob('operation-*.lock'))]: require(not path.is_symlink(), 'UnsafePath', 'Legacy locks must not be symbolic links.') held.enter_context(FileLock(str(path), timeout=0, mode=0o600)) self._migrate_legacy_locked(sources, snapshot) except Timeout: raise ClientError('MigrationBusy', 'A previous OpenAgent process is using local state. Retry after it completes; no state was moved.') from None

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 69)May include surrounding context.
python
'then': {'properties': {'outcome': {'$ref': '#/$defs/run/$defs/RunFinishedSuccessOutcome'}}, 'required': ['outcome']}}, {'if': {'properties': {'status': {'enum': ['PENDING', 'RUNNING', 'FAILED', 'CANCELLED', 'REJECTED']}},

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 70)May include surrounding context.
python
'required': ['outcome']}}, {'if': {'properties': {'status': {'enum': ['PENDING', 'RUNNING', 'FAILED', 'CANCELLED', 'REJECTED']}}, 'required': ['status']},

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 71)May include surrounding context.
python
{'if': {'properties': {'status': {'enum': ['PENDING', 'RUNNING', 'FAILED', 'CANCELLED', 'REJECTED']}}, 'required': ['status']}, 'then': {'not': {'required': ['outcome']}}}],

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 72)May include surrounding context.
python
'RUNNING', 'FAILED', 'CANCELLED', 'REJECTED']}}, 'required': ['status']}, 'then': {'not': {'required': ['outcome']}}}], 'properties': {'createdAt': {'format': 'date-time', 'type': 'string'},

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 341)May include surrounding context.
python
'ToolCallArgsEvent': {'allOf': [{'$ref': '#/$defs/event-core/$defs/BaseEventFields'}, {'properties': {'delta': {'type': 'string'}, 'toolCallId': {'minLength': 1, 'type': 'string'}, 'type': {'const': 'TOOL_CALL_ARGS'}}, 'required': ['type', 'toolCallId', 'delta'], 'type': 'object'}],

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 499)May include surrounding context.
python
'unevaluatedProperties': False}, 'ReasoningEndEvent': {'allOf': [{'$ref': '#/$defs/event-state/$defs/BaseEventFields'}, {'properties': {'messageId': {'minLength': 1, 'type': 'string'}, 'type': {'const': 'REASONING_END'}}, 'required': ['type', 'messageId'], 'type': 'object'}],

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 790)May include surrounding context.
python
'type': 'object'}, 'AskUserQuestionResumePayload': {'additionalProperties': False, 'properties': {'answers': {'items': {'additionalProperties': False, 'properties': {'questionId': {'minLength': 1, 'type': 'string'}, 'value': {'oneOf': [{'type': 'string'}, {'items': {'type': 'string'},

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 797)May include surrounding context.
python
'minItems': 1, 'type': 'array', 'uniqueItems': True}]}}, 'required': ['questionId', 'value'], 'type': 'object'}, 'minItems': 1,

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 799)May include surrounding context.
python
'uniqueItems': True}]}}, 'required': ['questionId', 'value'], 'type': 'object'}, 'minItems': 1, 'type': 'array'}}, 'required': ['answers'],

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 864)May include surrounding context.
python
'expired', 'failed']}, 'decisionEventId': {'minLength': 1, 'type': 'string'}, 'decisionVersion': {'minimum': 1, 'type': 'integer'}}, 'required': ['approvalId',

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 866)May include surrounding context.
python
'decisionEventId': {'minLength': 1, 'type': 'string'}, 'decisionVersion': {'minimum': 1, 'type': 'integer'}}, 'required': ['approvalId', 'approved', 'decision',

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 967)May include surrounding context.
python
'summary': {'minLength': 1, 'type': 'string'}, 'targetToolCall': {'additionalProperties': False, 'properties': {'arguments': {'type': 'object'}, 'toolCallId': {'minLength': 1, 'type': 'string'}, 'toolName': {'minLength': 1, 'type': 'string'}},

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 969)May include surrounding context.
python
'properties': {'arguments': {'type': 'object'}, 'toolCallId': {'minLength': 1, 'type': 'string'}, 'toolName': {'minLength': 1, 'type': 'string'}}, 'required': ['toolCallId', 'toolName',

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 112)May include surrounding context.
python
'type': 'object'}, 'ListSessionsResult': {'additionalProperties': False, 'properties': {'nextToken': {'oneOf': [{'minLength': 1, 'type': 'string'}, {'type': 'null'}]}, 'sessions': {'items': {'$ref': '#/$defs/api/$defs/Session'}, 'type': 'array'}, 'total': {'minimum': 0, 'type': 'integer'}},

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 917)May include surrounding context.
python
'type': 'object'}}}}, 'then': {'properties': {'interrupts': {'maxItems': 1}}}}], 'properties': {'interrupts': {'items': {'$ref': '#/$defs/run/$defs/Interrupt'}, 'minItems': 1, 'type': 'array'}, 'type': {'const': 'interrupt'}}, 'required': ['type', 'interrupts'],

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 918)May include surrounding context.
python
'then': {'properties': {'interrupts': {'maxItems': 1}}}}], 'properties': {'interrupts': {'items': {'$ref': '#/$defs/run/$defs/Interrupt'}, 'minItems': 1, 'type': 'array'}, 'type': {'const': 'interrupt'}}, 'required': ['type', 'interrupts'], 'type': 'object'},

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · scripts/openagent_client/contract.py (reported line 257)May include surrounding context.
python
{'properties': {'code': {'type': 'string'}, 'durationMs': {'minimum': 0, 'type': 'integer'}, 'errorInfo': {'additionalProperties': True, 'type': 'object'}, 'message': {'type': 'string'}, 'runId': {'minLength': 1, 'type': 'string'}, 'sessionId': {'minLength': 1, 'type': 'string'},

Static analysis

No suspicious patterns detected.