alibabacloud-oss-image-processing-diagnosis

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:38 AM UTC
• Version: 0.0.1

Overview

The skill is mostly a disclosed read-only Alibaba OSS diagnostic tool, but it has Review-level concerns because it can use cloud credentials against arbitrary endpoints and can enumerate account buckets.

Review before installing. Use only a tightly scoped, short-lived Alibaba Cloud role, avoid Resource:* where possible, do not provide arbitrary --endpoint values, and do not let the skill enumerate buckets unless you intentionally accept account inventory exposure. Treat any aliyun CLI install or upgrade as a local system change requiring your approval.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/image_processing_diagnosis.py:942

Finding

Unrestricted Endpoint Allows Credential-Signed Requests to Untrusted Hosts

Content

View full analysis

"_RetryingHandle": """Build an oss2.Bucket handle carrying UA + per-call timeout. oss2.Bucket raises oss2.exceptions.ClientError for an illegal bucket name (uppercase / underscore / special character / wrong length); it is converted here to the unified OssClientError(category="invalid") so the entry script degrades with [WARN] + STATUS: DEGRADED instead of a bare Traceback. """ auth = oss2.ProviderAuth(EnvCredentialsProvider()) session = oss2.Session() # Inject the observability User-Agent into every SDK request of this run. session.session.headers["User-Agent"] = user_agent() try: return _RetryingHandle( oss2.Bucket(auth, endpoint, bucket_name, s ...[truncated 3053 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/image_processing_diagnosis.py:895

Finding

Automatic Account-Wide Bucket Enumeration Exceeds Diagnostic Least Privilege

Content

View full analysis

list: """Call OSS ListBuckets (read-only) to locate buckets of this account. Fallback path when GetBucketInfo cannot resolve the region: the returned `location` of each bucket reveals the region it was created in. Raises OssClientError. """ try: auth = oss2.ProviderAuth(EnvCredentialsProvider()) session = oss2.Session() session.session.headers["User-Agent"] = user_agent() service = _RetryingHandle( o ...[truncated 3489 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as image-processing diagnosis, but it also performs STS identity verification and accesses account identity metadata such as caller identity and UID. This mismatch can cause operators or users to approve the skill under a narrower trust assumption than its real behavior, leading to unnecessary exposure of account metadata and credential-validation side effects.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises strong behavioral constraints but does not declare any explicit tool scope such as allowed-tools or permissions, while the content clearly expects shell, network, environment, and file access. That means enforcement relies on prompt text rather than platform policy, increasing the chance an agent can access broader capabilities than intended or execute unexpected actions if the runtime grants them.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 81% confidence

Finding

The skill mandates executing local scripts and shell commands but does not pair that with technical restrictions on what can actually be run. Even though the prose says 'read-only,' requiring command execution in a loosely scoped environment can expose the agent to command abuse, unintended script substitution, or execution of code that performs actions beyond the declared OSS read-only workflow.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

## Absolute Rules

1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating OSS API - any object upload, deletion, ACL change, style creation/update, or bucket configuration change. This includes commands "for the user to run manually". If the user asks to create or change an image style, only output manual console guidance and declare this skill is read-only.
2. **MANDATORY entry-point enforcement:** All diagnostics MUST be performed by running the scripts under `scripts/` (`image_processing_diagnosis.py` as the entry, `sts_token.py` for identity). The Agent is forbidden from assembling its own ossutil / SDK / curl commands against OSS or bypassing the scripts - the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or pass AK/SK/STS tokens explicitly. The OSS SDK resolves credentials exclusively from the environment variables of the default credential chain; the identity check uses the aliyun CLI default credential chain. Never accept AK/SK from the user or from another script.
4. **NO FABRICATION:** Every conclusion must be grounded in data actually returned by the scripts (HeadObject metadata, GET probe headers, magic bytes, GetBucketInfo). If a query fails or returns empty, record it and state the limitation - never invent formats, sizes, or error causes.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md

- **Bucket name** (`--bucket`) and **object key** (`--object`): required together for live probes; the image object to inspect.
- **Endpoint** (`--endpoint`) or **region** (`--region`): optional; used to reach the bucket. When both are absent the query endpoint is auto-defaulted and the bucket's real location from GetBucketInfo corrects it (auto-fill is always declared in the report).
- **Customer wording** (`--question`): optional; the customer's original question wording passed verbatim. Enables the official-doc verification leg (`doc_verification` section) - read-only, help.aliyun.com only, never blocks the diagnosis.
- **UID**: can always be omitted - it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.

**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted, probe endpoint derived from the bucket location, UID derived), the Agent MUST explicitly declare this in the response or report metadata.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

md

- **Bucket name** (`--bucket`) and **object key** (`--object`): required together for live probes; the image object to inspect.
- **Endpoint** (`--endpoint`) or **region** (`--region`): optional; used to reach the bucket. When both are absent the query endpoint is auto-defaulted and the bucket's real location from GetBucketInfo corrects it (auto-fill is always declared in the report).
- **Customer wording** (`--question`): optional; the customer's original question wording passed verbatim. Enables the official-doc verification leg (`doc_verification` section) - read-only, help.aliyun.com only, never blocks the diagnosis.
- **UID**: can always be omitted - it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.

**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted, probe endpoint derived from the bucket location, UID derived), the Agent MUST explicitly declare this in the response or report metadata.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

list_buckets enables account-level enumeration of OSS buckets, which exceeds the stated image-processing troubleshooting scope and broadens data discovery beyond a single target bucket/object. In an agent skill context, this can expose inventory metadata across the account and violates least-privilege expectations even if the calls are read-only.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code introduces general subprocess execution capability into a skill whose stated purpose is OSS image-processing diagnosis. Although the current command is fixed and relatively safe, adding subprocess-based execution increases the attack surface, depends on PATH-resolved binaries, and creates a broader capability than the manifest suggests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The module performs an external STS caller-identity lookup via the Alibaba CLI, which is outside the manifest's described OSS image-processing diagnostics and introduces an additional cloud-scope capability. Even though the call is read-only, it collects account identity data and expands the trust boundary from OSS-only access to local CLI execution plus STS access.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_oss_client.py (reported line 764)May include surrounding context.

python

"--endpoint", _STS_ENDPOINT,
           "--user-agent", user_agent()]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True,
                                timeout=timeout, stdin=subprocess.DEVNULL)
    except subprocess.TimeoutExpired:
        raise CliError(f"aliyun sts get-caller-identity timed out after "

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The referenced documentation links are all explicitly to zh Alibaba Cloud pages, which imposes a Chinese-language documentation context in the skill artifact. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/_oss_client.py (reported line 290)May include surrounding context.

python

def __getattr__(self, name):
        handle = object.__getattribute__(self, "_handle")
        attr = getattr(handle, name)
        if name.startswith("_") or not callable(attr):
            return attr

Static analysis

No suspicious patterns detected.