Security audit
Security checks for vulnerabilities and agentic risk
The skill is a mostly read-only Alibaba Cloud OSS diagnostic, but it can automatically expose account bucket inventory when required bucket input is missing.
Install only if you are comfortable granting read-only OSS account metadata access and potential bucket-name disclosure. Prefer running it with an explicit bucket name and a least-privilege RAM role limited to the documented Get/List actions; avoid invoking it from vague prompts where bucket details are missing.
The metadata says the skill should invoke immediately and handle missing details internally, but the body also says bucket name is required and describes ListBuckets fallback enumeration. This mismatch can cause the agent to perform broader account-level discovery than users expect, increasing privacy and scope-creep risk.
The metadata says the skill should invoke immediately and handle missing details internally, but the body also says bucket name is required and describes ListBuckets fallback enumeration. This mismatch can cause the agent to perform broader account-level discovery than users expect, increasing privacy and scope-creep risk.
The skill declares no explicit tool/permission scope even though it is designed to use shell, network, file access, and environment-derived credentials. That creates a broader execution surface than necessary and makes the read-only intent dependent on prompt compliance rather than enforceable platform restrictions.
The skill instructs the agent to execute local scripts and shell commands, but without an external enforcement boundary this still grants a path to command execution in the agent runtime. Even though the prose forbids mutating OSS APIs, the actual safety relies on the scripts and environment, so compromise or script drift could turn this into unintended command execution or side effects.
## Absolute Rules
1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating OSS API — e.g. `DeleteObject`, `DeleteObjects`, `DeleteBucket`, any version restore (`ossutil revert`), delete-marker removal, multipart abort (`AbortMultipartUpload`), `PutBucketVersioning`, or any ACL/policy/lifecycle change. This includes commands "for the user to run manually" issued from the scripts; recovery and cleanup are described as manual guidance in words only, and the user executes them. If the user asks to restore a version or clean fragments, only output the guidance and declare this skill is read-only. **Empty / not-found is a valid result — never react to it with a write.** If the bucket or object does not exist (`NoSuchBucket` / 404), a query returns empty, or versioning was never configured, that already is a complete conclusion: report it honestly and STOP. Never try to create / re-create / verify / test / validate / restore / repair the bucket or object, and never fall back to hand-written ossutil / SDK / curl calls — stay inside the read-only entry-script flow.
2. **MANDATORY entry-point enforcement:** All OSS diagnostics MUST be performed by running the scripts under `scripts/` (`oss_deletion_recovery_diagnosis.py` as the entry, `sts_token.py` for identity). The Agent is forbidden from assembling its own ossutil / SDK / curl commands against the OSS control plane or bypassing the scripts — the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or pass AK/SK/STS tokens explicitly. The OSS SDK resolves credentials exclusively from the environment variables of the default credential chain; the identity check uses the aliyun CLI default credential chain. Never accept AK
...[truncated 25 chars]
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Absolute Rules
1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating OSS API — e.g. `DeleteObject`, `DeleteObjects`, `DeleteBucket`, any version restore (`ossutil revert`), delete-marker removal, multipart abort (`AbortMultipartUpload`), `PutBucketVersioning`, or any ACL/policy/lifecycle change. This includes commands "for the user to run manually" issued from the scripts; recovery and cleanup are described as manual guidance in words only, and the user executes them. If the user asks to restore a version or clean fragments, only output the guidance and declare this skill is read-only. **Empty / not-found is a valid result — never react to it with a write.** If the bucket or object does not exist (`NoSuchBucket` / 404), a query returns empty, or versioning was never configured, that already is a complete conclusion: report it honestly and STOP. Never try to create / re-create / verify / test / validate / restore / repair the bucket or object, and never fall back to hand-written ossutil / SDK / curl calls — stay inside the read-only entry-script flow.
2. **MANDATORY entry-point enforcement:** All OSS diagnostics MUST be performed by running the scripts under `scripts/` (`oss_deletion_recovery_diagnosis.py` as the entry, `sts_token.py` for identity). The Agent is forbidden from assembling its own ossutil / SDK / curl commands against the OSS control plane or bypassing the scripts — the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or pass AK/SK/STS tokens explicitly. The OSS SDK resolves credentials exclusively from the environment variables of the default credential chain; the identity check uses the aliyun CLI default credential chain. Never accept AK
...[truncated 25 chars]
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Scope** (`--scope`): optional; `recover` (recoverability assessment), `residue` (residue/attribution), or `all` (default).
- **Expected region** (`--region`): optional; used to derive the query endpoint.
- **Customer wording** (`--question`): optional; the customer's original question wording passed verbatim. Enables the official-doc verification leg (`doc_verification` section) — read-only, help.aliyun.com only, never blocks the diagnosis.
- **UID**: can always be omitted — it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted or re-derived from the bucket location, UID derived), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --region provided)".
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Scope** (`--scope`): optional; `recover` (recoverability assessment), `residue` (residue/attribution), or `all` (default).
- **Expected region** (`--region`): optional; used to derive the query endpoint.
- **Customer wording** (`--question`): optional; the customer's original question wording passed verbatim. Enables the official-doc verification leg (`doc_verification` section) — read-only, help.aliyun.com only, never blocks the diagnosis.
- **UID**: can always be omitted — it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted or re-derived from the bucket location, UID derived), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --region provided)".
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"--endpoint", _STS_ENDPOINT,
"--user-agent", user_agent()]
try:
result = subprocess.run(cmd, capture_output=True, text=True,
timeout=timeout, stdin=subprocess.DEVNULL)
except subprocess.TimeoutExpired:
raise CliError(f"aliyun sts get-caller-identity timed out after "
When no bucket is supplied, the script calls ListBuckets and returns up to 30 bucket names visible to the current credential. That expands the skill from diagnosis of a specific deletion event into account inventory disclosure, which can leak sensitive infrastructure metadata to the caller or downstream logs/UI without a clear need for the stated task.
Disclosing bucket names without prior warning or necessity reveals account asset inventory to whoever can trigger the skill without a --bucket parameter. In cloud environments, inventory metadata is often sensitive and can aid reconnaissance, targeting, and correlation of business systems even if no object data is returned.
The skill exposes account bucket inventory as a user-facing hint even though its declared purpose is read-only recovery diagnosis for a target bucket/object. Bucket names often reveal projects, environments, customers, or internal structure, so this becomes an unnecessary information disclosure primitive.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
def __getattr__(self, name):
handle = object.__getattribute__(self, "_handle")
attr = getattr(handle, name)
if name.startswith("_") or not callable(attr):
return attr
The inline interface documentation states the opposite of the manifest-level intent: it describes bucket input as effectively required and says the script will ask when absent. This is an intent-level contradiction because the skill’s declared behavior is to invoke immediately and handle missing details internally.
No suspicious patterns detected.