Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed read-only Alibaba Cloud diagnostic that uses cloud credentials to inspect CDN/OSS metadata but does not modify resources.
Install only with an Alibaba Cloud credential that has the documented read-only RAM actions. Expect the skill to reveal account-level CDN domain metadata, origin configuration, caller UID/ARN, and OSS bucket metadata in its report; do not run the CLI upgrade command unless you intend to update the local aliyun CLI.
The skill claims to diagnose CDN-to-OSS origin configuration, but the finding indicates the practical implementation may perform only STS identity lookup rather than the advertised CDN/OSS checks. In a security-sensitive troubleshooting workflow, that can produce false assurance or incorrect attribution, causing users to act on incomplete evidence while believing a full diagnostic ran.
The skill claims to diagnose CDN-to-OSS origin configuration, but the finding indicates the practical implementation may perform only STS identity lookup rather than the advertised CDN/OSS checks. In a security-sensitive troubleshooting workflow, that can produce false assurance or incorrect attribution, causing users to act on incomplete evidence while believing a full diagnostic ran.
The skill invokes shell commands, uses networked cloud APIs, reads environment-based credentials, and writes local cache/state, but it declares no explicit tool scope or permission boundaries. That increases the blast radius if the skill is misrouted, modified, or prompt-injected, because the runtime may grant broader capabilities than the task actually requires.
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
## Absolute Rules
1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating CDN or OSS API — e.g. origin configuration changes, domain start/stop, `PutBucketPolicy`, ACL changes, or any refresh/preload submission. This includes commands "for the user to run manually". If the user asks to change the origin or enable authorization, only output manual guidance and declare this skill is read-only.
2. **MANDATORY entry-point enforcement:** All diagnostics MUST be performed by running the scripts under `scripts/` (`origin_config_diagnosis.py` as the entry, `sts_token.py` for identity). The Agent is forbidden from assembling its own aliyun CLI / SDK / curl commands against the CDN or OSS control plane or bypassing the scripts — the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or pass AK/SK/STS tokens explicitly. CDN/STS queries rely on the aliyun CLI default credential chain; OSS queries rely on the environment variables of the default credential chain. Never accept AK/SK from the user or from another script.
4. **NO FABRICATION:** Every conclusion must be grounded in data actually returned by the CDN domain queries and OSS GetBucketInfo. If a query fails or returns empty, record it and state the limitation — never invent origin configurations, ACL values, or authorization states. Notably, whether a private-bucket origin authorization is already enabled CANNOT be read by this skill; only advise verifying it.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Accelerated domain** (`--domain`): required; the CDN-accelerated domain to diagnose.
- **User-reported origin host** (`--user-origin-host`): optional; the host the user's traffic is addressed to (e.g. `<bucket>.oss-<region>.aliyuncs.com`). When provided, the bypass-detection branch compares it with the CDN-configured origin.
- **UID** (`--uid`): can always be omitted — the caller UID is derived via `aliyun sts get-caller-identity` and used as a traceability label plus the same/cross-account origin attribution. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (UID derived, origin host inferred), the Agent MUST explicitly declare this in the response or report metadata, e.g. "UID auto-derived via sts GetCallerIdentity: 1552974654746705".
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Accelerated domain** (`--domain`): required; the CDN-accelerated domain to diagnose.
- **User-reported origin host** (`--user-origin-host`): optional; the host the user's traffic is addressed to (e.g. `<bucket>.oss-<region>.aliyuncs.com`). When provided, the bypass-detection branch compares it with the CDN-configured origin.
- **UID** (`--uid`): can always be omitted — the caller UID is derived via `aliyun sts get-caller-identity` and used as a traceability label plus the same/cross-account origin attribution. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (UID derived, origin host inferred), the Agent MUST explicitly declare this in the response or report metadata, e.g. "UID auto-derived via sts GetCallerIdentity: 1552974654746705".
The skill is described as a focused diagnostic tool for CDN back-to-origin to OSS issues, but the embedded topic matching and consultation signals are generic OSS configuration/usage cues. In particular, the self-test and scoring logic are geared toward general OSS topics such as lifecycle/configuration wording, which is not justified by a narrowly scoped CDN-origin diagnosis skill.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"--endpoint", _STS_ENDPOINT,
"--user-agent", user_agent()]
try:
result = subprocess.run(cmd, capture_output=True, text=True,
timeout=timeout, stdin=subprocess.DEVNULL)
except subprocess.TimeoutExpired:
raise CliError(f"aliyun sts get-caller-identity timed out after "
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"""
cmd = ["aliyun"] + args + ["--user-agent", _USER_AGENT()]
try:
proc = subprocess.run(cmd, capture_output=True, text=True,
timeout=_CLI_TIMEOUT, stdin=subprocess.DEVNULL)
except subprocess.TimeoutExpired:
raise RuntimeError("CliError: aliyun CLI request timed out after "
The manifest describes a read-only diagnostic skill focused on checking CDN domains, OSS buckets, origin host/port, and authorization causes for back-to-origin failures. This file instead implements a generic STS caller-identity helper that verifies the current Alibaba Cloud account and credential identity, which is not itself one of the declared diagnostic checks or triggers.
The file-level docstring says this module is for alibabacloud-oss-cdn-origin-config-diagnosis, but the inline self-test uses the question 'OSS生命周期怎么配置' and validates activated keywords for that unrelated topic. This actively documents behavior outside the stated intent and can mislead maintainers about the intended scope.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
def __getattr__(self, name):
handle = object.__getattribute__(self, "_handle")
attr = getattr(handle, name)
if name.startswith("_") or not callable(attr):
return attr
When --domain is missing, the script automatically lists CDN domains visible to the current credential and returns them to the caller. In a diagnostic skill, this can expose account inventory metadata beyond the user's stated request, creating an information disclosure issue if the skill is invoked by a less-trusted user or through an automated agent that surfaces results broadly.
No suspicious patterns detected.