alibabacloud-oss-browser-upload-cors-diagnosis

• Outcome: Pass
• Latest audit: Oct 9, 2026 · 11:52 AM UTC
• Version: 0.0.1

Overview

This skill is a disclosed read-only Alibaba Cloud OSS CORS diagnostic tool that uses cloud credentials to read metadata and produce manual guidance, not to change resources.

Install only if you intend to let the agent use your Alibaba Cloud credential chain for read-only OSS metadata and CORS checks. Prefer a temporary RAM role or RAM user with only sts:GetCallerIdentity, oss:GetBucketInfo, oss:GetBucketCors, and oss:ListBuckets, and do not grant CORS mutation or administrator permissions. Review any suggested aliyun CLI install or upgrade before allowing it, because that changes local tooling even though the diagnostic scripts themselves are read-only.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill diagnoses browser direct-upload and OSS CORS problems, specifically issues like rejected preflight OPTIONS, missing Access-Control-Allow-Origin, expose-headers gaps, and PostObject policy problems. The supplied code does none of that. It only calls STS GetCallerIdentity via a shared client, derives the AccountId, and outputs identity details and next steps. While it is read-only, its primary purpose is materially different: verifying which Alibaba Cloud account the current CLI credential belongs to. That is a separate identity-checking capability and not a supporting implementation detail of the declared CORS diagnosis behavior in this code chunk itself. Therefore the description does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares broad operational behavior including shell execution, network access, environment-based credential resolution, and references to file-writing capable tooling, but it does not define any explicit tool/permission scope. That creates a governance gap: an agent runtime may grant more capability than is minimally required, increasing the blast radius if the skill is misused or the referenced scripts are compromised.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 83% confidence

Finding

The skill explicitly instructs the agent to execute local scripts and shell commands, but it does not pair that with a hard technical sandbox or command allowlist in the skill metadata. Even though the text tries to constrain behavior to read-only scripts, natural-language restrictions are weaker than enforced runtime controls, so a compromised script or prompt-influenced execution path could lead to unintended command execution or sensitive environment access.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

## Absolute Rules

1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating OSS API — e.g. `PutBucketCors`, `DeleteBucketCors`, `PutBucket*`, `DeleteBucket*`, `PutObject*`, `DeleteObject*`, or any ACL/policy/configuration change. This includes commands "for the user to run manually". When a CORS change is needed, only output the standard template as text and manual guidance, and declare this skill is read-only.
2. **MANDATORY entry-point enforcement:** All diagnostics MUST be performed by running the scripts under `scripts/` (`oss_cors_diagnosis.py` as the entry, `sts_token.py` for identity). The Agent is forbidden from assembling its own ossutil / SDK / curl commands against the OSS control plane or bypassing the scripts — the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or pass AK/SK/STS tokens explicitly. The OSS SDK resolves credentials exclusively from the environment variables of the default credential chain; the identity check uses the aliyun CLI default credential chain. Never accept AK/SK from the user or from another script. This prohibition covers the **command line itself**: never prefix a command with inline credential assignments such as `ALIBABA_CLOUD_ACCESS_KEY_ID=... ALIBABA_CLOUD_ACCESS_KEY_SECRET=... python3 ...`, and never pass credentials as CLI arguments, in heredocs, or in any echoed/executed command text — an inline assignment lands verbatim in the execution log and counts as a credential leak. The diagnosis environment already has the credential chain in place: run `python3 scripts/oss_cors_diagnosis.py ...` exactly as written (bare command, no credential prefix) and the scripts resolve credentials on their own. If a run fails with 
...[truncated 25 chars]

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md

- **Query endpoint** (`--endpoint`): optional; the endpoint of the region where the bucket was created.
- **Expected region** (`--region`): optional; used to derive the query endpoint when `--endpoint` is absent.
- **Policy expiration** (`--policy-expiration`): optional; a PostObject policy `expiration` value (ISO8601 GMT, e.g. `2023-02-19T13:19:00.000Z`). Checked **offline** against the current UTC time (no network, no write) to attribute EC 0006-00000213 — see the timezone anti-pattern in Important Notes.
- **UID**: can always be omitted — it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.

**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted, UID derived), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --endpoint/--region provided)".

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

md

- **Query endpoint** (`--endpoint`): optional; the endpoint of the region where the bucket was created.
- **Expected region** (`--region`): optional; used to derive the query endpoint when `--endpoint` is absent.
- **Policy expiration** (`--policy-expiration`): optional; a PostObject policy `expiration` value (ISO8601 GMT, e.g. `2023-02-19T13:19:00.000Z`). Checked **offline** against the current UTC time (no network, no write) to attribute EC 0006-00000213 — see the timezone anti-pattern in Important Notes.
- **UID**: can always be omitted — it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.

**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted, UID derived), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --endpoint/--region provided)".

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module docstring frames this file as official-doc verification for the browser-upload CORS diagnosis skill. Yet the inline examples and self-test use lifecycle consultation queries, which contradict the stated intent by demonstrating and validating behavior for unrelated OSS topics.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest says this skill is specifically for read-only diagnosis of browser/mini-program direct-upload failures and OSS CORS issues, and explicitly excludes unrelated domains. However, the embedded topic table and self-test/example logic include generic OSS consultation topics such as lifecycle/configuration wording, which would make the module match and retrieve documentation for topics outside the declared CORS/upload scope.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_oss_client.py (reported line 596)May include surrounding context.

python

"--endpoint", _STS_ENDPOINT,
           "--user-agent", user_agent()]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True,
                                timeout=timeout, stdin=subprocess.DEVNULL)
    except subprocess.TimeoutExpired:
        raise CliError(f"aliyun sts get-caller-identity timed out after "

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes a read-only skill for diagnosing OSS browser/mini-program upload failures and CORS configuration issues, but this file is dedicated to verifying Alibaba Cloud CLI caller identity via STS. While read-only, identity inspection is a separate operational purpose not mentioned in the manifest’s described capabilities or triggers.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/_oss_client.py (reported line 296)May include surrounding context.

python

def __getattr__(self, name):
        handle = object.__getattribute__(self, "_handle")
        attr = getattr(handle, name)
        if name.startswith("_") or not callable(attr):
            return attr

Static analysis

No suspicious patterns detected.