Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed read-only Alibaba Cloud OSS endpoint diagnostic that inspects account and bucket metadata but does not modify cloud resources.
Use this only with least-privilege Alibaba Cloud credentials limited to sts:GetCallerIdentity, oss:GetBucketInfo, oss:ListBuckets, and oss:ListCname. Expect it to inspect bucket metadata, caller UID, custom-domain DNS/CNAME metadata, and optionally fetch/cache public OSS docs; review any suggested aliyun CLI install or upgrade before allowing it.
The declared purpose is narrow diagnostic analysis, but the skill also performs live documentation retrieval, local cache writes, and broad keyword-based routing behavior. This mismatch can cause operators or orchestrators to invoke the skill in contexts where additional network or filesystem actions were not expected, undermining trust boundaries and review assumptions.
The declared purpose is narrow diagnostic analysis, but the skill also performs live documentation retrieval, local cache writes, and broad keyword-based routing behavior. This mismatch can cause operators or orchestrators to invoke the skill in contexts where additional network or filesystem actions were not expected, undermining trust boundaries and review assumptions.
The skill declares no explicit tool scope even though it clearly expects shell, network, environment, and file access. Without an allowlist, a hosting agent may grant broader capabilities than intended, increasing the blast radius if the skill is misused or if embedded instructions are followed too literally.
The skill operational model requires executing shell commands and strongly instructs the agent to run local scripts, but it does not pair that with hard technical restrictions on what may be executed. If an agent obeys these instructions in a permissive runtime, this creates command-execution exposure and could be abused through modified scripts, environment manipulation, or unsafe orchestration.
## Absolute Rules
1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating OSS API - e.g. `PutBucket*`, `DeleteBucket*`, `PutObject*`, `DeleteObject*`, `PutBucketPolicy`, or any ACL/policy/endpoint configuration change. This includes commands "for the user to run manually". If the user asks to change a bucket ACL or enable transfer acceleration, only output manual guidance and declare this skill is read-only.
2. **MANDATORY entry-point enforcement:** All OSS diagnostics MUST be performed by running the scripts under `scripts/` (`oss_endpoint_diagnosis.py` as the entry, `sts_token.py` for identity). The Agent is forbidden from assembling its own ossutil / SDK / curl commands against the OSS control plane or bypassing the scripts - the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries. Every run MUST contain BOTH commands below, in this order, each as its own command; neither one replaces the other:
`cd $SKILL_DIR && python3 scripts/sts_token.py`
`cd $SKILL_DIR && python3 scripts/oss_endpoint_diagnosis.py --bucket <name> [--endpoint <user-endpoint>] [--region <region>] [--question "<customer original wording>"]`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Bucket name** (`--bucket`): required; the OSS bucket to diagnose.
- **User endpoint** (`--endpoint`): optional; the endpoint the user currently configured (e.g. `oss-cn-beijing.aliyuncs.com` or `oss-cn-shanghai-internal.aliyuncs.com`), or a **custom domain (CNAME)** such as `img.example.com`. When provided it is classified (public / internal / accelerate / dualstack / cname / invalid) and matched against the bucket's real region; a `cname` value triggers the custom-domain diagnosis flow (DNS probe + read-only `ListCname`).
- **Expected region** (`--region`): optional; used to derive the query endpoint when `--endpoint` is absent.
- **UID**: can always be omitted - it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted, UID derived), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --endpoint/--region provided)".
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Bucket name** (`--bucket`): required; the OSS bucket to diagnose.
- **User endpoint** (`--endpoint`): optional; the endpoint the user currently configured (e.g. `oss-cn-beijing.aliyuncs.com` or `oss-cn-shanghai-internal.aliyuncs.com`), or a **custom domain (CNAME)** such as `img.example.com`. When provided it is classified (public / internal / accelerate / dualstack / cname / invalid) and matched against the bucket's real region; a `cname` value triggers the custom-domain diagnosis flow (DNS probe + read-only `ListCname`).
- **Expected region** (`--region`): optional; used to derive the query endpoint when `--endpoint` is absent.
- **UID**: can always be omitted - it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted, UID derived), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --endpoint/--region provided)".
The manifest describes a read-only skill for diagnosing wrong OSS endpoint/region choice, internal-network access, same-region traffic fee, and custom-domain opening issues. This file instead focuses on site-monitoring guidance for regional/ISP reachability and slow downloads, explicitly stating that the root cause may be the network path rather than the endpoint string itself and describing a complementary workflow outside the manifest's listed triggers.
The manifest is specifically for OSS endpoint/internal-network diagnosis and explicitly excludes adjacent specialties. Here the documentation advises using transfer acceleration to bypass ISP issues, which is a distinct operational topic not justified by the stated endpoint-selection purpose and not listed among the manifest's supported scenarios.
This code embeds many trigger keywords and examples in Chinese and is explicitly tailored to customer phrasings in that language, which can amount to a locale-specific behavior. The file does not state that the skill is China-region-only or otherwise provide a user opt-in or language choice, so the locale constraint is not clearly documented and justified.
The manifest describes read-only diagnostics for endpoint/region choice and internal-network access issues, while the code also performs custom-domain specific checks by listing bucket CNAME bindings and resolving DNS targets. Although 'custom domain not opening' appears in the trigger list, these capabilities are broader than the main manifest description and materially extend behavior beyond pure endpoint/internal-network diagnosis.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"--endpoint", _STS_ENDPOINT,
"--user-agent", user_agent()]
try:
result = subprocess.run(cmd, capture_output=True, text=True,
timeout=timeout, stdin=subprocess.DEVNULL)
except subprocess.TimeoutExpired:
raise CliError(f"aliyun sts get-caller-identity timed out after "
This markdown file states that the skill performs an OS-level DNS probe and a read-only ListCname call as part of diagnosis. Those actions involve network access and retrieval of bucket/domain metadata, but this section does not explicitly warn users that the skill will make external lookups or inspect OSS configuration data.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
def __getattr__(self, name):
handle = object.__getattribute__(self, "_handle")
attr = getattr(handle, name)
if name.startswith("_") or not callable(attr):
return attr
The skill's stated purpose is OSS endpoint/internal-network diagnosis, but the code also shells out to the aliyun CLI to retrieve caller identity via STS. This identity-resolution capability is not described in the manifest and is not obviously required for diagnosing endpoint or internal-network routing issues themselves.
The manifest describes a read-only OSS endpoint/internal-network diagnostic focused on endpoint selection, region mismatch, and custom-domain access. This helper adds an extra capability to query an external documentation index via _doc_lookup.lookup_config_topic, which is not necessary to determine the bucket's actual region/endpoint state and expands behavior beyond the core diagnosis described.
The stated purpose is OSS endpoint and internal-network diagnosis, and most of the code fits that scope. However, resolving arbitrary custom domains through _oss_client.resolve_cname_target introduces a broader external-network probing capability that is only indirectly tied to OSS control-plane diagnosis and is not clearly declared in the manifest beyond brief mention of custom domains.
No suspicious patterns detected.