Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed read-only Alibaba Cloud OSS diagnostic tool that reads the user's own cloud logs and configuration and writes a local report, with no evidence of hidden mutation, exfiltration, or persistence.
Install only if you are comfortable giving the agent read-only access to the relevant Alibaba Cloud OSS, SLS log, and optional RAM policy data. Use a scoped, short-lived role where possible, narrow resources to the target bucket/log project, and handle generated reports as sensitive because they may include request IDs, IP addresses, object keys, account IDs, and AccessKey IDs. Do not use this skill for incident mitigation such as blocking IPs, disabling keys, or changing ACLs.
The skill explicitly says it should not be used for traffic-abuse scenarios, yet the detected behavior includes top-IP and leaked-key style investigations. This scope creep is dangerous because abuse investigations often require different safeguards, evidence handling, and escalation paths than ordinary troubleshooting.
The skill explicitly says it should not be used for traffic-abuse scenarios, yet the detected behavior includes top-IP and leaked-key style investigations. This scope creep is dangerous because abuse investigations often require different safeguards, evidence handling, and escalation paths than ordinary troubleshooting.
The skill explicitly says it should not be used for traffic-abuse scenarios, yet the detected behavior includes top-IP and leaked-key style investigations. This scope creep is dangerous because abuse investigations often require different safeguards, evidence handling, and escalation paths than ordinary troubleshooting.
The skill explicitly says it should not be used for traffic-abuse scenarios, yet the detected behavior includes top-IP and leaked-key style investigations. This scope creep is dangerous because abuse investigations often require different safeguards, evidence handling, and escalation paths than ordinary troubleshooting.
The skill explicitly says it should not be used for traffic-abuse scenarios, yet the detected behavior includes top-IP and leaked-key style investigations. This scope creep is dangerous because abuse investigations often require different safeguards, evidence handling, and escalation paths than ordinary troubleshooting.
The skill explicitly says it should not be used for traffic-abuse scenarios, yet the detected behavior includes top-IP and leaked-key style investigations. This scope creep is dangerous because abuse investigations often require different safeguards, evidence handling, and escalation paths than ordinary troubleshooting.
Referenced artifact was not completely inspected
pts remain available for a focused re-run: `log_source_check.py` (probe only), `trace_request.py` (trace or `--generate-only` for statements without executing),
Referenced artifact was not completely inspected
pts remain available for a focused re-run: `log_source_check.py` (probe only), `trace_request.py` (trace or `--generate-only` for statements without executing),
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
9. State that the run was read-only and changed nothing.
10. When the request concerns deletion (who deleted an object, objects that disappeared, or a `--batch-delete` run), the answer **MUST** use these canonical spellings verbatim: `batch delete` (two words) for the operation, `oss_batch_delete_log` for the topic that holds the removed keys, and `request_id` for the field that joins that topic to the access-topic row. Do not write them as `batch-delete` or `requester_id` -- `requester_id` is a different field (the caller), and a hyphenated form makes the handover ambiguous. Also name lifecycle expiry (`ExpireObject`) as the other deletion source the customer must rule out. State this deletion model even when no log row could be read: it is domain knowledge about where the evidence lives, not a claim about who deleted anything.
**MANDATORY OUTPUT VERIFICATION:** before replying, you **MUST** confirm the output contains all of: `STATUS`, the conclusion, the root cause (or ranked candidates when verdict is B), the verdict class in words, the recommendations, `NEXT_ACTION`, the auto-fill declarations, and the two lists (verified / could not verify). If any part is missing, you **MUST** explicitly append it. Never present raw JSON to the user. Never omit ranked candidates for a class-B verdict even when the rule engine did not run. **Before sending, re-scan your own answer: every configuration value you state MUST appear as a verified value in the script output; if the script marked it `UNAVAILABLE`, delete your stated value and replace it with "could not be verified". Also confirm no credential file was read and no secret appears anywhere in the answer.** **Two token checks before sending:** if any bucket read failed, the answer must contain the literal `not found` together with the non-existence disclaimer; if the request concerns deletion, it must contain `batch delete`, `oss_batch_delete_log` and `request_id` spelled exactly so.
## Available Scripts
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Each generated entry carries the **topic** it must be run against. Statements
for `T6b` run against the batch-delete topic; every other statement runs
against the access topic. Running a batch-delete statement against the access
topic returns nothing and looks like "no deletion happened".
### T0 — trace one request ID
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Each generated entry carries the **topic** it must be run against. Statements
for `T6b` run against the batch-delete topic; every other statement runs
against the access topic. Running a batch-delete statement against the access
topic returns nothing and looks like "no deletion happened".
### T0 — trace one request ID
The skill declares no explicit tool scope even though it is designed to use shell, network, file write, and environment-backed credentials. In an agent setting, missing an allowlist increases the chance of unintended tool use or privilege expansion beyond the stated read-only intent.
The document authorizes command execution in general and relies on textual prohibitions to prevent mutating operations, but there is no technical enforcement shown here. In an agentic environment, broad shell access without hard constraints can be bypassed by prompt mistakes or tool misuse, leading to unintended reads, writes, or cloud actions.
## Absolute Rules
1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write or execute any command calling a mutating operation — no change to a bucket ACL, a bucket policy, block public access, a referer list, a lifecycle rule, a logging configuration, a website configuration, an object ACL, or an object itself. This includes commands "for the user to run manually" that you execute on their behalf. Enabling realtime log query is console guidance only. Report findings and hand over guidance; the customer applies changes.
2. **CHANNEL WHITELIST:** OSS configuration reads go through the Python oss2 SDK (the aliyun CLI carries no OSS control-plane metadata and ossutil is not assumed to be installed). The caller-identity check, log reads and RAM reads go through the aliyun CLI. The permitted actions are exactly those listed in [references/ram-policies.md](references/ram-policies.md). Any other action is forbidden.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, store or pass an AccessKey pair or a security token. The SDK resolves credentials from the `ALIBABA_CLOUD_*` environment variables and the CLI from its own profile. Never accept credentials from the user, and never run a command that echoes them. **This extends to credential FILES and environment dumps: never read, open, `cat`, `head`, grep or otherwise inspect `~/.aliyun/config.json`, `~/.alibabacloud/credentials`, and never run `printenv` / `env` / `set` to view credentials -- NOT EVEN to debug an authentication error such as `InvalidSecurityToken` or `NoCredentials`. When a credential error occurs the ONLY permitted action is: record it, degrade honestly, and tell the user to refresh the credential (`aliyun configure` or re-assume the role). Opening a credential file to "fix" the error leaks secrets and is forbidden.
4. **NO FABRICATION — the honesty contract:** Every conclusion carries a verdict class (see Verdict Classes). A class C cause *
...[truncated 25 chars]
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Absolute Rules
1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write or execute any command calling a mutating operation — no change to a bucket ACL, a bucket policy, block public access, a referer list, a lifecycle rule, a logging configuration, a website configuration, an object ACL, or an object itself. This includes commands "for the user to run manually" that you execute on their behalf. Enabling realtime log query is console guidance only. Report findings and hand over guidance; the customer applies changes.
2. **CHANNEL WHITELIST:** OSS configuration reads go through the Python oss2 SDK (the aliyun CLI carries no OSS control-plane metadata and ossutil is not assumed to be installed). The caller-identity check, log reads and RAM reads go through the aliyun CLI. The permitted actions are exactly those listed in [references/ram-policies.md](references/ram-policies.md). Any other action is forbidden.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, store or pass an AccessKey pair or a security token. The SDK resolves credentials from the `ALIBABA_CLOUD_*` environment variables and the CLI from its own profile. Never accept credentials from the user, and never run a command that echoes them. **This extends to credential FILES and environment dumps: never read, open, `cat`, `head`, grep or otherwise inspect `~/.aliyun/config.json`, `~/.alibabacloud/credentials`, and never run `printenv` / `env` / `set` to view credentials -- NOT EVEN to debug an authentication error such as `InvalidSecurityToken` or `NoCredentials`. When a credential error occurs the ONLY permitted action is: record it, degrade honestly, and tell the user to refresh the credential (`aliyun configure` or re-assume the role). Opening a credential file to "fix" the error leaks secrets and is forbidden.
4. **NO FABRICATION — the honesty contract:** Every conclusion carries a verdict class (see Verdict Classes). A class C cause *
...[truncated 25 chars]
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## User Confirmation
Because every action of this skill is strictly read-only, no confirmation is required before running the scripts. Confirmation discipline applies at the scope boundary instead: when a request requires a mutation (enabling logging through an API, changing an ACL, blocking an IP) or falls into another capability's scope per Absolute Rules 1 and 7, do not proceed with any mutation — state the boundary and give manual guidance only.
Before the first run, confirm the diagnosis scope with the user: which bucket, which region, and which failing request (request ID, object key, or error code). If no bucket was named, ask for it; never guess a bucket name, enumerate buckets to pick a candidate, or scan for one.
The report-delivery instructions explicitly direct writing a diagnosis file and sharing a file link, while the module elsewhere encourages including request IDs, owner UIDs, client IPs, object keys, and hosts in ticket/report artifacts. Without an explicit warning, minimization rule, or handling requirement for sensitive customer metadata, operators may persist or share diagnostic output more broadly than necessary, creating privacy and internal data-exposure risk.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd += [_param_flag(product, key), str(value)]
try:
result = subprocess.run(
cmd,
capture_output=True,
text=True,
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Returns {region, location, source, info, buckets_scanned, warnings}.
`source` is one of: get_bucket_info | list_buckets | user_provided |
unresolved -- the caller must declare it, because a region taken from the
user without verification is an assumption, not a finding.
"""
warnings: list[str] = []
info = read_config("GetBucketInfo", bucket_name, region, timeout=timeout)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"--endpoint", _STS_ENDPOINT,
"--user-agent", user_agent()]
try:
result = subprocess.run(cmd, capture_output=True, text=True,
timeout=timeout, stdin=subprocess.DEVNULL)
except subprocess.TimeoutExpired:
raise CliError(f"aliyun sts get-caller-identity timed out after "
The module docstring states that authentication is resolved exclusively by the aliyun CLI default credential chain. However, the fallback path in probe_log_shipping uses _oss_client.read_config via the oss2 SDK, which is a distinct client/authentication path from the CLI. This is an active documentation contradiction about how the skill authenticates.
The comment explicitly states that an OSS SDK call is intentionally omitted from the documented API surface in related_apis.yaml. In a security-sensitive support skill, hidden or undocumented external API usage weakens reviewability and control boundaries, and could bypass allowlist-based governance or operator expectations about what services and credentials the skill may exercise.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
try:
bucket = _build_bucket(bucket_name, endpoint, timeout)
method = getattr(bucket, method_name, None)
if method is None:
raise OssClientError(
f"oss2 {method_name} is unavailable in this SDK version",
No suspicious patterns detected.