Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed read-only Alibaba Cloud OSS diagnostic helper, with some scope and permission-documentation caveats users should notice before running it.
Install only if you are comfortable letting the skill read OSS bucket configuration metadata using your Alibaba Cloud credential chain. Use a least-privilege RAM role/user, avoid broad production credentials when possible, and approve any aliyun CLI install or upgrade step separately.
The skill is presented as a narrowly scoped OSS diagnostics tool, but the specification also permits external doc fetching and broader keyword-driven consultation behavior. This mismatch can mislead operators about what data leaves the environment and what logic is actually executed, undermining least surprise and causing unintended network access or scope creep.
The skill is presented as a narrowly scoped OSS diagnostics tool, but the specification also permits external doc fetching and broader keyword-driven consultation behavior. This mismatch can mislead operators about what data leaves the environment and what logic is actually executed, undermining least surprise and causing unintended network access or scope creep.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
rules = []
text = (xml_text or "").strip()
if not text:
return rules
# XML hardening: never feed untrusted DTD/entity declarations to the
# parser (guards against XXE / entity-expansion); oversize bodies are
# dropped. Control-plane responses are small, so 1 MiB is generous.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
rules = []
text = (xml_text or "").strip()
if not text:
return rules
# XML hardening: never feed untrusted DTD/entity declarations to the
# parser (guards against XXE / entity-expansion); oversize bodies are
# dropped. Control-plane responses are small, so 1 MiB is generous.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
rules = []
text = (xml_text or "").strip()
if not text:
return rules
# XML hardening: never feed untrusted DTD/entity declarations to the
# parser (guards against XXE / entity-expansion); oversize bodies are
# dropped. Control-plane responses are small, so 1 MiB is generous.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
rules = []
text = (xml_text or "").strip()
if not text:
return rules
# XML hardening: never feed untrusted DTD/entity declarations to the
# parser (guards against XXE / entity-expansion); oversize bodies are
# dropped. Control-plane responses are small, so 1 MiB is generous.
The skill requires shell, network, environment, and file access but does not declare an explicit tool/permission scope. That creates an authorization gap: a host agent may grant broader capabilities than intended, making it harder to enforce the claimed read-only boundary or audit what the skill is allowed to do.
The skill mandates executing local scripts and shell commands but does not pair that with a hard technical sandbox or explicit tool allowlist in the skill metadata. If the referenced scripts are modified, replaced, or overly permissive, the agent could execute actions beyond the intended read-only scope, including networked API access and local side effects.
## Absolute Rules
1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating OSS API - e.g. `PutBucketNotification`, `PutBucketCallbackPolicy`, `DeleteBucketCallbackPolicy`, `PutObject*`, `DeleteBucket*`, or any configuration change. This includes commands "for the user to run manually". If the user asks to create/modify/delete an event-notification rule or callback policy, only output manual console guidance and declare this skill is read-only.
2. **MANDATORY entry-point enforcement:** All diagnostics MUST be performed by running the scripts under `scripts/` (`oss_event_notification_diagnosis.py` as the entry, `sts_token.py` for identity). The Agent is forbidden from assembling its own ossutil / SDK / curl commands against the OSS control plane or bypassing the scripts - the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or pass AK/SK/STS tokens explicitly. The OSS SDK resolves credentials exclusively from the environment variables of the default credential chain; the identity check uses the aliyun CLI default credential chain. Never accept AK/SK from the user or from another script.
4. **NO FABRICATION:** Every conclusion must be grounded in data actually returned by GetBucketInfo / GetBucketNotification / GetBucketCallbackPolicy / GetCallerIdentity. If a query fails or returns empty, record it and state the limitation - never invent configured rules, event types, or callback statuses. When "no rule configured" (404 NoSuchNotificationConfiguration) is returned, report it as the semantic finding "event notification is not configured" - NOT as an error.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Expected event type** (`--expected-event`): optional; the event the user expects to be notified (e.g. `ObjectCreated:PutObject`). Matched against the configured rules (exact match or group wildcard `Group:*`).
- **Observed callback error** (`--callback-error`): optional; the exact error text of the failing upload (e.g. `CallbackFailed, Message: Error status : 502.`) used for root-cause attribution.
- **Callback URL** (`--callback-url`): optional; the user's callbackUrl for a static form check (scheme/host/SNI notes). No network probe is issued from this skill.
- **UID**: can always be omitted - it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query region defaulted, UID derived), the Agent MUST explicitly declare this in the response or report metadata.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Expected event type** (`--expected-event`): optional; the event the user expects to be notified (e.g. `ObjectCreated:PutObject`). Matched against the configured rules (exact match or group wildcard `Group:*`).
- **Observed callback error** (`--callback-error`): optional; the exact error text of the failing upload (e.g. `CallbackFailed, Message: Error status : 502.`) used for root-cause attribution.
- **Callback URL** (`--callback-url`): optional; the user's callbackUrl for a static form check (scheme/host/SNI notes). No network probe is issued from this skill.
- **UID**: can always be omitted - it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query region defaulted, UID derived), the Agent MUST explicitly declare this in the response or report metadata.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
User: "My callback URL works from curl but OSS keeps reporting CallbackFailed with a 502, and the certificate is valid."
python3 scripts/oss_event_notification_diagnosis.py --bucket "my-bucket" --callback-error "502" --callback-url "https://api.example.com/callback"
Report the 5-second response budget and the SNI behaviour: several HTTPS sites behind one IP need callbackSNI set explicitly, otherwise the origin rejects the handshake; also verify the URL is publicly resolvable, not an intranet address.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
1. Reproduce the upload and capture the exact OSS error response
(ErrorCode / Message / RequestId).
2. `curl -v -d "object=test" <callbackUrl>` from a public network to
prove the server answers 200 + JSON within 5 s.
3. For HTTPS, confirm the certificate chain and whether the server needs
SNI; retry with `callbackSNI=true`.
The manifest scopes this skill to diagnosing OSS event notification and upload callback issues and explicitly frames it as checks/advice only. This file adds a separate capability to fetch public help-center indexes and document bodies over the network, which is not obviously required for performing the diagnosis itself and broadens the skill into runtime web retrieval.
The manifest description is narrowly focused on OSS event notification failures, callback failures, and related configuration checks. The code's topic table additionally activates on '签名' and '直传' with the hint 'server-side signature', which introduces a different troubleshooting domain not described in the manifest.
list_buckets() performs account-level bucket enumeration, which exceeds the stated bucket-specific OSS notification/callback diagnostic scope. In a least-privilege skill ecosystem, this broadens accessible metadata and can expose bucket inventory, regions, and creation dates unrelated to the user’s immediate request, increasing data exposure if the skill is misused or over-invoked.
The skill invokes an external CLI to resolve caller identity even though the stated purpose is OSS event-notification/callback diagnostics. This adds an unnecessary execution capability and trusts ambient host tooling and configuration, which increases attack surface and may leak account-identifying metadata or behave unexpectedly in environments where PATH or CLI plugins are tampered with.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"--endpoint", _STS_ENDPOINT,
"--user-agent", user_agent()]
try:
result = subprocess.run(cmd, capture_output=True, text=True,
timeout=timeout, stdin=subprocess.DEVNULL)
except subprocess.TimeoutExpired:
raise CliError(f"aliyun sts get-caller-identity timed out after "
At L20, the document explicitly says official sources disagree on whether DeleteObject without versionId triggers an event, and recommends treating versionId as the safe path. But L70 says categorically that delete without versionId never fires events. This is an active contradiction within the skill's own guidance and could mislead diagnosis outcomes.
The docstring says the self-test covers activated-keyword selection for this skill, yet the sample input is 'OSS生命周期怎么配置', which does not align with this event-notification/callback diagnosis skill's documented domain. This is an intent/documentation mismatch because the inline documentation suggests domain-relevant validation while the actual test exercises an unrelated topic.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
def __getattr__(self, name):
handle = object.__getattribute__(self, "_handle")
attr = getattr(handle, name)
if name.startswith("_") or not callable(attr):
return attr
The manifest describes a read-only OSS event notification and upload callback diagnosis skill, but this file implements a standalone Alibaba Cloud STS caller-identity checker with its own CLI interface and output contract. While potentially useful as a prerequisite check, identity verification is not declared in the manifest's purpose or trigger set, so this capability is not clearly justified by the stated skill scope.
No suspicious patterns detected.