Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed, read-only Alibaba Cloud OSS replication checker, with some metadata-access risks users should understand before running it.
Install only with a least-privilege read-only RAM policy. Be aware that running it can reveal bucket names, bucket metadata, replication settings, account identity, and, if --verify-target is used, object-list metadata such as keys, ETags, and sizes. Do not provide raw AccessKey or SecretKey values to the skill.
The skill claims to do configuration checking, but it also derives caller identity via STS, queries replication progress, and may list/count objects with ListObjectsV2. These are materially broader capabilities than the declared purpose and can expose account identity and object metadata, creating unnecessary data-access risk if users or reviewers assume a narrower operational scope.
The skill claims to do configuration checking, but it also derives caller identity via STS, queries replication progress, and may list/count objects with ListObjectsV2. These are materially broader capabilities than the declared purpose and can expose account identity and object metadata, creating unnecessary data-access risk if users or reviewers assume a narrower operational scope.
The skill claims to do configuration checking, but it also derives caller identity via STS, queries replication progress, and may list/count objects with ListObjectsV2. These are materially broader capabilities than the declared purpose and can expose account identity and object metadata, creating unnecessary data-access risk if users or reviewers assume a narrower operational scope.
The module documentation contains a strong security assertion that no calls exist beyond three named OSS queries, yet the code exposes a broader read-only API surface. Even without write capability, this contradiction is dangerous because security review, least-privilege approval, and user expectations may be based on the narrower claim, enabling unintended metadata enumeration such as object listing.
The header explicitly promises that only GetBucketReplication, GetBucketInfo, and ListBuckets are ever issued, but the implementation also performs GetBucketReplicationProgress and ListObjectsV2. In a security-sensitive agent system, false declarations about cloud API surface undermine operator trust, consent, and auditability, and may cause users to authorize or run a skill under incorrect assumptions about what account metadata it can access.
The skill declares no explicit tool/permission scope despite requiring shell, network, environment, and filesystem capabilities. Without a tight allowlist, an agent platform may grant broader-than-necessary access, increasing the blast radius if the skill is misused or if prompt injection influences execution behavior.
The skill mandates execution of local scripts and shell commands but does not pair that with a narrowly bounded execution policy. Even though the text forbids mutating OSS APIs, unrestricted shell execution can still be abused through modified scripts, environmental manipulation, or future maintenance drift, leading to command execution beyond the intended read-only scope.
## Absolute Rules
1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating OSS API — e.g. `PutBucketReplication`, `DeleteBucketReplication`, `PutBucket*`, `DeleteBucket*`, `PutObject*`, or any replication-rule / ACL / policy change. This includes commands "for the user to run on your behalf". If the user asks to create or change a replication rule, only output manual guidance and declare this skill is read-only. **Empty / not-found is a valid result — never react to it with a write.** When `GetBucketReplication` returns no rule, the bucket is not found, `target_verification.verdict` is `target_unreachable`, or every query returns empty, that is already a complete conclusion: relay it and STOP. Never issue a create / re-create / verify / test / validate / repair call to "confirm" an empty result, and never fall back to hand-written `ossutil`, SDK, or `aliyun` commands for the same purpose.
2. **MANDATORY entry-point enforcement:** All CRR checks MUST be performed by running the scripts under `scripts/` (`crr_config_check.py` as the entry, `sts_token.py` for identity). The Agent is forbidden from assembling its own ossutil / SDK / curl commands against the OSS control plane or bypassing the scripts — the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries. This mandate is UNCONDITIONAL: it also covers a request that names no bucket, no region, or only a consultation question (e.g. online migration vs cross-region replication selection). You MUST still run `crr_config_check.py` — with no `--bucket` it exits `STATUS: FAIL` whose `NEXT_ACTION` names the missing input and whose `buckets_in_account` lists up to 30 buckets visible to the current credential, and that output is exactly what to put back to the customer. NEVER answer a replicat
...[truncated 26 chars]
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Expected region** (`--region`): optional; used to derive the query endpoint when `--endpoint` is absent.
- **Customer symptom** (`--symptom`): optional; the customer's original symptom wording (Chinese or English). The embedded symptom-routing table maps it to a concrete branch — progress-stuck / target-empty / not-syncing / rule-not-effective / slow-replication / replication-failed / cross-account-auth / region-decommission / region-migration. When it matches, the report carries `symptom_routing` and the `NEXT_ACTION` is prefixed with the matched branch guidance (and a cross-skill `referral` when the symptom belongs to a sibling skill). Purely advisory: it never changes which OSS calls are made.
- **Verify target** (`--verify-target`): optional flag; when set (and a replication rule exists) the script performs a bounded read-only source-vs-target object count under the rule prefix (`ListObjectsV2`, `oss:ListObjects`) and reports `target_verification` with `verdict` = match / mismatch / target_unreachable / truncated. A cross-account target that cannot be listed is reported as the LIMIT `target_unreachable`, not an error. This is a spot-check PATH only — it never promises full integrity.
- **UID**: can always be omitted — it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: every auto-filled parameter (query endpoint defaulted, UID derived) and every input the customer never named MUST be declared on the `PARAMETER SOURCE:` line of the final answer — see the Final Answer Contract, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --endpoint/--region provided)".
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Expected region** (`--region`): optional; used to derive the query endpoint when `--endpoint` is absent.
- **Customer symptom** (`--symptom`): optional; the customer's original symptom wording (Chinese or English). The embedded symptom-routing table maps it to a concrete branch — progress-stuck / target-empty / not-syncing / rule-not-effective / slow-replication / replication-failed / cross-account-auth / region-decommission / region-migration. When it matches, the report carries `symptom_routing` and the `NEXT_ACTION` is prefixed with the matched branch guidance (and a cross-skill `referral` when the symptom belongs to a sibling skill). Purely advisory: it never changes which OSS calls are made.
- **Verify target** (`--verify-target`): optional flag; when set (and a replication rule exists) the script performs a bounded read-only source-vs-target object count under the rule prefix (`ListObjectsV2`, `oss:ListObjects`) and reports `target_verification` with `verdict` = match / mismatch / target_unreachable / truncated. A cross-account target that cannot be listed is reported as the LIMIT `target_unreachable`, not an error. This is a spot-check PATH only — it never promises full integrity.
- **UID**: can always be omitted — it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: every auto-filled parameter (query endpoint defaulted, UID derived) and every input the customer never named MUST be declared on the `PARAMETER SOURCE:` line of the final answer — see the Final Answer Contract, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --endpoint/--region provided)".
The manifest describes a read-only checker for existing OSS cross-region replication configuration and troubleshooting why replication is not starting. This code adds generic 'configuration/usage consultation' detection, including broad terms such as pricing, enablement, and support, which implies advisory/intake capability beyond verifying CRR rule state or diagnosing replication-start issues.
The manifest describes a read-only skill for checking CRR configuration and explaining why replication is not starting, focusing on replication rules, authorization role, prefix scope, delete-marker sync, historical sync, cold archive, transfer acceleration, and investigation planning. This file also implements GetBucketReplicationProgress and ListObjectsV2-based object counting/sample inspection, which go beyond configuration verification into runtime progress inspection and source/target data verification.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"--endpoint", _STS_ENDPOINT,
"--user-agent", user_agent()]
try:
result = subprocess.run(cmd, capture_output=True, text=True,
timeout=timeout, stdin=subprocess.DEVNULL)
except subprocess.TimeoutExpired:
raise CliError(f"aliyun sts get-caller-identity timed out after "
The file includes a help.aliyun.com /zh/ link as the only referenced official documentation, which implicitly forces a Chinese-language resource. Under the policy, locale-specific guidance should either offer a user choice or clearly document why the locale restriction is required.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
def __getattr__(self, name):
handle = object.__getattribute__(self, "_handle")
attr = getattr(handle, name)
if name.startswith("_") or not callable(attr):
return attr
No suspicious patterns detected.