ClawHub
Back to skill

Security audit

alibabacloud-oss-cross-account-auth-diagnosis

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a read-only Alibaba Cloud OSS diagnostic, but it needs review because it can reveal bucket inventory and emits broad write/delete authorization templates.

Install only if you are comfortable using a scoped Alibaba Cloud diagnostic credential that can read OSS bucket metadata and list bucket names. Review any generated policy template before applying it manually, especially write actions such as oss:PutObject and delete-related actions such as oss:ReplicateDelete. Fix the empty manifest version before expecting the scripts to run.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/oss_cross_account_auth_diagnosis.py:1343
Finding

Account-wide bucket enumeration occurs when the required bucket name is absent

Content
View full analysis

Vulnerability Details

File Location: scripts/oss_cross_account_auth_diagnosis.py:1343-1364
Vulnerability Type: Excessive cloud-resource enumeration
Risk Level: Medium

Vulnerable Code

python
# Missing-bucket guard: most real tickets never name a bucket, so a bare
# argparse exit 2 leaves the customer with no next step. Ask for the name
# and surface the buckets this credential can actually see.
if not (args.bucket or "").strip():
    _hint = []
    _herrs = []
    try:
        try:
            _all = _oss_client.list_buckets()
        except TypeError:
            _all = _oss_client.list_buckets(prefix="")
        _hint = [b["name"] for b in _all][:30]
    except Exception as e:
        _herrs.append({"category": "degraded", "code": "ListBucketsFailed",
                       "message": str(e)[:200]})
        print(f"[WARN] ListBuckets bucket-name hint degraded: {e}",
              file=sys.stderr)
    _rep = {
        "skill": globals().get("_SKILL_NAME", "alibabacloud-oss-cross-account-auth-diagnosis"),
        "bucket": "",
        "buckets_in_account": _hint,
        "errors": _herrs,
        "auto_filled": [],
    }

The corresponding policy in references/ram-policies.md grants oss:ListBuckets on "Resource": "*", allowing account-wide enumeration.

Technical Analysis

A missing required input does not require access to cloud inventory. The least-privilege response would be to request the exact bucket name and optionally its region. Instead, the script calls ListBuckets, retrieves account-wide bucket metadata, and includes up to 30 bucket names in the generated report.

Bucket names can disclose customer identifiers, project names, deployment environments, internal naming conventions, and other operational information. This also makes oss:ListBuckets part of the recommended core permission set even though a targeted diagnosis can ordinarily operate ...[truncated 977 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the ListBuckets call from the missing---bucket branch.
  2. Return STATUS: FAIL and ask the user for the exact bucket name and region.
  3. Make oss:ListBuckets an optional permission rather than one of the four core permissions.
  4. Require an explicit option such as --discover-bucket before performing account-wide enumeration.
  5. Clearly warn that discovery returns account inventory before making the request.
  6. Do not include unrelated bucket names in Agent-visible reports.
  7. Where possible, scope normal operation to oss:GetBucketInfo and oss:GetBucketPolicy for the explicitly named bucket.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/oss_cross_account_auth_diagnosis.py:610
Finding

Cross-account access template grants unverified object write permission

Content
View full analysis

Vulnerability Details

File Location: scripts/oss_cross_account_auth_diagnosis.py:610-635
Vulnerability Type: Overprivileged generated authorization policy
Risk Level: Medium

Vulnerable Code

python
def cross_account_access_ram_policy_template(bucket: str) -> dict:
    """RAM permission policy template attached to the cross-account role in
    the BUCKET-OWNER's account (official least-privilege shape)."""
    b = (bucket or "").strip() or "<bucket-name>"
    doc = {
        "Version": "1",
        "Statement": [
            {"Effect": "Allow",
             "Action": ["oss:ListObjects"],
             "Resource": [f"acs:oss:*:*:{b}"]},
            {"Effect": "Allow",
             "Action": ["oss:GetObject", "oss:PutObject"],
             "Resource": [f"acs:oss:*:*:{b}/*"]},
        ],
    }
    return {
        "json": json.dumps(doc, indent=2, ensure_ascii=False),
        "notes": [
            "Attach this policy to the RAM role created in the "
            "bucket-OWNER's account; the peer account assumes the role via "
            "STS and accesses the bucket with the temporary credential.",
            "Resource granularity is the classic pitfall: the bucket-level "
            "ARN (no trailing /*) covers ListObjects, the object-level ARN "
            "with /* covers GetObject/PutObject -- one missing ARN fails "
            "the whole flow.",
        ],
    }

Technical Analysis

The generic access scenario does not distinguish read access from upload access. Nevertheless, the generated policy always includes oss:PutObject over every object key in the selected bucket.

A peer reporting an inability to list or read objects ordinarily requires only oss:ListObjects and oss:GetObject. Adding oss:PutObject grants an integrity-affecting capability that is not established by the diagnostic evidence.

Although the Skill does not apply the poli ...[truncated 1238 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add an explicit access mode such as --access-mode read|write|read-write.
  2. Default to the read-only combination of oss:ListObjects and oss:GetObject.
  3. Include oss:PutObject only after the user explicitly confirms that upload access is required.
  4. Generate separate read-only and read-write templates rather than combining both use cases.
  5. Clearly label every template containing write actions as integrity-affecting and subject to manual security review.
  6. Support an optional object-key prefix so write permissions can be narrowed below the entire bucket.
  7. Validate the requested operation against the original failure evidence before selecting policy actions.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/oss_cross_account_auth_diagnosis.py:679
Finding

Replication bucket policy always grants destination deletion capability

Content
View full analysis

Vulnerability Details

File Location: scripts/oss_cross_account_auth_diagnosis.py:679-710
Vulnerability Type: Overprivileged generated authorization policy
Risk Level: Medium

Vulnerable Code

python
def replication_bucket_policy_template(src_uid: str, role_name: str,
                                       dest_uid: str,
                                       dest_bucket: str) -> dict:
    """Bucket Policy template for the DESTINATION bucket (cross-account
    replication dual-grant requirement, official doc shape)."""
    su = (src_uid or "").strip() or "<src-uid>"
    rn = (role_name or "").strip().lower() or "<role-name>"
    du = (dest_uid or "").strip() or "<dest-uid>"
    db = (dest_bucket or "").strip() or "<dest-bucket>"
    doc = {
        "Version": "1",
        "Statement": [
            {"Effect": "Allow",
             "Action": ["oss:ReplicateList", "oss:ReplicateGet",
                        "oss:ReplicatePut", "oss:ReplicateDelete"],
             "Principal": [f"arn:sts::{su}:assumed-role/{rn}/*"],
             "Resource": [f"acs:oss:*:{du}:{db}", f"acs:oss:*:{du}:{db}/*"]},
        ],
    }
    return {
        "json": json.dumps(doc, indent=2, ensure_ascii=False),
        "notes": [
            "Cross-account replication is a DUAL grant: the source account "
            "gives the role a RAM Policy, the destination account adds THIS "
            "Bucket Policy on the destination bucket -- one side missing "
            "fails with NoPermission.",
            "Bucket Policy Principal syntax differs from RAM Policy: here "
            "it is the assumed-role ARN arn:sts::<src-uid>:assumed-role/"
            "<role>/*; the role name is all-lowercase and must match "
            "exactly.",
        ],
    }

The accompanying reference documentation states that oss:ReplicateDelete is needed only for add/delet ...[truncated 1808 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove oss:ReplicateDelete from the default replication template.
  2. Add a dedicated option such as --sync-deletions that must be explicitly enabled.
  3. Generate separate append/update-only and delete-synchronizing policies.
  4. Require explicit confirmation that source deletions must propagate before including delete permission.
  5. Add a prominent warning describing the potential for destination data loss.
  6. Recommend versioning, retention, or backup controls whenever deletion synchronization is enabled.
  7. Restrict the resource and principal to the exact destination bucket and exact replication role, as the existing template otherwise attempts to do.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (24)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill is described as a narrow read-only cross-account auth diagnostic, but the content authorizes external doc retrieval and broader question-routing/consultation behavior. Description-behavior drift is dangerous because operators may approve or invoke the skill under a narrower risk assumption than what it actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill is described as a narrow read-only cross-account auth diagnostic, but the content authorizes external doc retrieval and broader question-routing/consultation behavior. Description-behavior drift is dangerous because operators may approve or invoke the skill under a narrower risk assumption than what it actually does.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The module-level security claims are inaccurate: it says only three OSS metadata queries are ever issued, but the code also invokes external STS and RAM CLI commands. Misstated security boundaries are dangerous because operators may grant execution approval or credentials under false assumptions, and hidden cross-service calls can leak metadata, fail unexpectedly, or violate least-privilege expectations in restricted environments.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · scripts/oss_cross_account_auth_diagnosis.py (reported line 165)May include surrounding context.

python
"ALIBABA_CLOUD_PROFILE) before acting on it")


assert ownership_identity_caveat("1552974654746705", "1552974654746705") == ""  # normal: consistent -> no caveat
assert "identity-chain skew" in ownership_identity_caveat("1772241626973633", "1552974654746705")  # normal: skew -> caveat
assert ownership_identity_caveat("", "1552974654746705") == ""  # boundary: caller degraded
assert ownership_identity_caveat("1552974654746705", "") == ""  # boundary: owner degraded

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares broad operational behavior including shell execution, network access, environment-based credential use, and file reads, but does not define an explicit tool/permission scope. That creates an unnecessary trust gap: even if the prose says the skill is read-only, there is no machine-enforced restriction preventing broader execution if the runtime or downstream scripts change.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

The skill mandates running local scripts and shell commands, but the file does not provide an enforceable sandbox or command allowlist. In a credentialed cloud environment, unrestricted command execution expands the attack surface to arbitrary shell behavior, especially because the scripts interact with networked services and ambient credentials.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
## Absolute Rules

1. **ABSOLUTE PROHIBITION (no authorization changes):** Under **NO** circumstances may you generate, write, or execute any command/script that APPLIES an authorization change - e.g. `PutBucketPolicy`, RAM `CreatePolicy` / `AttachPolicyToRole` / `UpdateRole` (trust-policy edit), `PutBucketReplication`, `ossutil`/console equivalents, or any AssumeRole used to mutate resources. This includes commands "for the user to run" issued from the scripts. Fixes are emitted as JSON TEMPLATES in the report and in `references/auth-config-templates.md`, described in words, and **applied by the user manually**. If the user asks to apply an authorization, only output the template + manual steps and declare this skill is read-only.
2. **MANDATORY entry-point enforcement:** All OSS diagnostics MUST be performed by running the scripts under `scripts/` (`oss_cross_account_auth_diagnosis.py` as the entry, `sts_token.py` for identity). The Agent is forbidden from assembling its own ossutil / SDK / curl commands against the OSS control plane or bypassing the scripts - the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or pass AK/SK/STS tokens explicitly. The OSS SDK resolves credentials exclusively from the environment variables of the default credential chain; the identity check uses the aliyun CLI default credential chain. Never accept AK/SK from the user or from another script.
4. **NO FABRICATION:** Every conclusion must be grounded in data actually returned by GetBucketInfo / GetBucketPolicy / ListBuckets / GetCallerIdentity. If a query fails or returns empty, record it and state the limitation - never invent an owner UID, a policy document, or an attribution. When the STS-RequestId evidence is not collected, say the attribution is inconclusive rather tha
...[truncated 24 chars]

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md
- **Role name** (`--role-name`): optional; the replication/migration RAM role name, used in the assumed-role Principal checks and templates.
- **Expected region** (`--region`): optional; used to derive the query endpoint.
- **Encoded diagnostic message** (`--encoded-diagnostic-message`): optional; the `EncodedDiagnosticMessage` from a 403 `AccessDeniedDetail`, or the whole 403 error body (OSS XML / POP JSON). When present the script runs the G3-5 403-localization main path (`ram_403_diagnosis`): it interprets the PLAIN `AccessDeniedDetail` fields (who / which action / which policy layer / deny kind - no extra permission needed) and, when the credential allows `ram:DecodeDiagnosticMessage`, decodes the message for the exact missing action/resource/condition and matched Deny policies. On a credential without that permission it degrades gracefully (`[WARN]` + `manual_decode_guidance`: RAM permission-diagnosis console page / OpenAPI Explorer / administrator handoff) and never flips the core STATUS.
- **UID**: can always be omitted - it is derived via `aliyun sts get-caller-identity` and used as the caller side of the ownership comparison plus a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.

**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted or re-derived from the bucket location, UID derived), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --region provided)".

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

md
- **Role name** (`--role-name`): optional; the replication/migration RAM role name, used in the assumed-role Principal checks and templates.
- **Expected region** (`--region`): optional; used to derive the query endpoint.
- **Encoded diagnostic message** (`--encoded-diagnostic-message`): optional; the `EncodedDiagnosticMessage` from a 403 `AccessDeniedDetail`, or the whole 403 error body (OSS XML / POP JSON). When present the script runs the G3-5 403-localization main path (`ram_403_diagnosis`): it interprets the PLAIN `AccessDeniedDetail` fields (who / which action / which policy layer / deny kind - no extra permission needed) and, when the credential allows `ram:DecodeDiagnosticMessage`, decodes the message for the exact missing action/resource/condition and matched Deny policies. On a credential without that permission it degrades gracefully (`[WARN]` + `manual_decode_guidance`: RAM permission-diagnosis console page / OpenAPI Explorer / administrator handoff) and never flips the core STATUS.
- **UID**: can always be omitted - it is derived via `aliyun sts get-caller-identity` and used as the caller side of the ownership comparison plus a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.

**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted or re-derived from the bucket location, UID derived), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --region provided)".

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_oss_client.py (reported line 595)May include surrounding context.

python
"--endpoint", _STS_ENDPOINT,
           "--user-agent", user_agent()]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True,
                                timeout=timeout, stdin=subprocess.DEVNULL)
    except subprocess.TimeoutExpired:
        raise CliError(f"aliyun sts get-caller-identity timed out after "

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a read-only OSS cross-account auth diagnosis focused on OSS trust policy, RAM policy scope, bucket policy dual-grant, and AssumeRole failures. This module additionally implements decode_diagnostic_message() by calling aliyun ram decode-diagnostic-message, which extends behavior beyond OSS control-plane metadata queries into a separate RAM diagnostic API capability.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_oss_client.py (reported line 721)May include surrounding context.

python
"--encoded-diagnostic-message", encoded,
           "--user-agent", user_agent()]
    try:
        proc = subprocess.run(cmd, capture_output=True, text=True,
                              timeout=timeout, stdin=subprocess.DEVNULL)
    except subprocess.TimeoutExpired:
        result["reason"] = "Timeout"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/oss_cross_account_auth_diagnosis.py (reported line 260)May include surrounding context.

python
continue
        effect = str(st.get("Effect") or "").strip().lower()
        p = st.get("Principal")
        plist: list = []
        if isinstance(p, str):
            plist = [p]
        elif isinstance(p, list):

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/oss_cross_account_auth_diagnosis.py (reported line 262)May include surrounding context.

python
continue
        effect = str(st.get("Effect") or "").strip().lower()
        p = st.get("Principal")
        plist: list = []
        if isinstance(p, str):
            plist = [p]
        elif isinstance(p, list):

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/oss_cross_account_auth_diagnosis.py (reported line 264)May include surrounding context.

python
continue
        effect = str(st.get("Effect") or "").strip().lower()
        p = st.get("Principal")
        plist: list = []
        if isinstance(p, str):
            plist = [p]
        elif isinstance(p, list):

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/oss_cross_account_auth_diagnosis.py (reported line 266)May include surrounding context.

python
continue
        effect = str(st.get("Effect") or "").strip().lower()
        p = st.get("Principal")
        plist: list = []
        if isinstance(p, str):
            plist = [p]
        elif isinstance(p, list):

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/oss_cross_account_auth_diagnosis.py (reported line 267)May include surrounding context.

python
continue
        effect = str(st.get("Effect") or "").strip().lower()
        p = st.get("Principal")
        plist: list = []
        if isinstance(p, str):
            plist = [p]
        elif isinstance(p, list):

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/oss_cross_account_auth_diagnosis.py (reported line 270)May include surrounding context.

python
continue
        effect = str(st.get("Effect") or "").strip().lower()
        p = st.get("Principal")
        plist: list = []
        if isinstance(p, str):
            plist = [p]
        elif isinstance(p, list):

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/oss_cross_account_auth_diagnosis.py (reported line 272)May include surrounding context.

python
continue
        effect = str(st.get("Effect") or "").strip().lower()
        p = st.get("Principal")
        plist: list = []
        if isinstance(p, str):
            plist = [p]
        elif isinstance(p, list):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/cross-account-auth-decision-tree.md (reported line 246)May include surrounding context.

md
_RAM_DIAGNOSIS_CONSOLE_URL = "https://ram.console.aliyun.com/permissions/troubleshoot"
# OpenAPI Explorer debug page for the decode API (alternative manual decode).
_RAM_DECODE_OPENAPI_URL = (
    "https://api.aliyun.com/api/Ram/2015-05-01/DecodeDiagnosticMessage")
_RAM_TROUBLESHOOT_DOC = (
    "https://help.aliyun.com/zh/ram/support/how-to-troubleshoot-an-access-denied-error")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/oss_cross_account_auth_diagnosis.py (reported line 848)May include surrounding context.

python
_RAM_DIAGNOSIS_CONSOLE_URL = "https://ram.console.aliyun.com/permissions/troubleshoot"
# OpenAPI Explorer debug page for the decode API (alternative manual decode).
_RAM_DECODE_OPENAPI_URL = (
    "https://api.aliyun.com/api/Ram/2015-05-01/DecodeDiagnosticMessage")
_RAM_TROUBLESHOOT_DOC = (
    "https://help.aliyun.com/zh/ram/support/how-to-troubleshoot-an-access-denied-error")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/oss_cross_account_auth_diagnosis.py (reported line 991)May include surrounding context.

python
_RAM_DIAGNOSIS_CONSOLE_URL = "https://ram.console.aliyun.com/permissions/troubleshoot"
# OpenAPI Explorer debug page for the decode API (alternative manual decode).
_RAM_DECODE_OPENAPI_URL = (
    "https://api.aliyun.com/api/Ram/2015-05-01/DecodeDiagnosticMessage")
_RAM_TROUBLESHOOT_DOC = (
    "https://help.aliyun.com/zh/ram/support/how-to-troubleshoot-an-access-denied-error")

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest describes a read-only OSS cross-account authorization diagnosis skill that attributes common OSS authorization failures and emits templates. The code additionally accepts an EncodedDiagnosticMessage and invokes a RAM DecodeDiagnosticMessage path, which expands the skill into RAM-side authorization forensics beyond the core OSS bucket/trust-policy checks described in the manifest.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/_oss_client.py (reported line 295)May include surrounding context.

python
def __getattr__(self, name):
        handle = object.__getattribute__(self, "_handle")
        attr = getattr(handle, name)
        if name.startswith("_") or not callable(attr):
            return attr

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The top-level documentation says AK/SK are never read, printed, or passed explicitly. Later, the code directly reads ALIBABA_CLOUD_ACCESS_KEY_ID from the environment to decide whether to emit an identity-skew warning, which contradicts that documentation even though it does not print the secret.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.