Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a read-only Alibaba Cloud OSS diagnostic tool, but it can automatically list bucket names across the configured account when the user does not provide a bucket.
Install or run this only with a narrowly scoped temporary RAM credential. Avoid invoking it without an explicit bucket name, and consider removing or gating ListBuckets if account inventory names are sensitive. Pin the oss2 dependency before production use.
scripts/oss_lifecycle_runtime_diagnosis.py:716Automatic Account-Wide Bucket Enumeration Exceeds Minimum Diagnostic Scope
scripts/requirements.txt:1OSS SDK Dependency Is Not Reproducibly Pinned
This code chunk does not implement the declared diagnostic functionality for OSS lifecycle runtime behavior, archive restore issues, storage tiering, or fee composition. Instead, it only verifies the current Alibaba Cloud CLI identity using STS GetCallerIdentity and reports the account UID/ARN/identity type. While this may be a supporting pre-check for a larger workflow, the supplied chunk’s primary purpose is materially different from the declared skill purpose and operates on different resources (STS identity metadata rather than OSS lifecycle/archive state). Therefore, this is a description-behavior mismatch.
The skill clearly expects capabilities equivalent to shell, network, environment credential access, and file reads, but it does not declare an explicit tool/permission scope. That creates an authorization gap where reviewers and runtime policy may not have a precise least-privilege contract, increasing the chance of over-broad execution or unintended tool availability.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Do NOT use for bill line-items (alibabacloud-oss-billing-diagnosis), data recovery
(alibabacloud-oss-deletion-recovery-diagnosis), transfer error codes
(alibabacloud-oss-transfer-error-code-diagnosis), backup-tool retrieval fees
(alibabacloud-oss-backup-integration-diagnosis), or write operations.
---
# OSS Lifecycle Runtime & Archive Restore Diagnosis
The skill mandates command/script execution and relies on shellable scripts, but the document does not pair that with a hard technical sandbox or allowlist at the policy level. Even though the prose forbids mutating APIs, instruction-only restrictions are weaker than enforced tool constraints and could be bypassed if the referenced scripts are modified or replaced.
## Absolute Rules
1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating OSS API - e.g. `PutBucketLifecycle`, `DeleteBucketLifecycle`, `RestoreObject`, `PutObject`/copy-based storage-class conversion, `ossutil restore`, `ossutil set-meta`, `PutBucketVersioning`, or any ACL/policy change. This includes commands "for the user to run manually" issued from the scripts; rule creation and restores are described as manual guidance in words only, and the user executes them. When a lifecycle rule change is needed, MANDATORY behavior: output a configuration template (XML/JSON shape or console path) as advice - never call the write API.
2. **MANDATORY entry-point enforcement:** All OSS diagnostics MUST be performed by running the scripts under `scripts/` (`oss_lifecycle_runtime_diagnosis.py` as the entry, `sts_token.py` for identity). The Agent is forbidden from assembling its own ossutil / SDK / curl commands against the OSS control plane or bypassing the scripts - the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or pass AK/SK/STS tokens explicitly. The OSS SDK resolves credentials exclusively from the environment variables of the default credential chain; the identity check uses the aliyun CLI default credential chain. Never accept AK/SK from the user or from another script.
4. **NO FABRICATION:** Every conclusion must be grounded in data actually returned by GetBucketInfo / GetBucketVersioning / GetBucketLifecycle / ListBuckets / GetCallerIdentity. If a query fails or returns empty, record it and state the limitation - never invent rule definitions, restore states, or fee amounts. `NoSuchLifecycle` means "no rule configured" - report it as a finding, not as an e
...[truncated 23 chars]
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Error** (`--error`): optional; the data-plane error the user hit (e.g. `InvalidObjectState`, `RestoreAlreadyInProgress`).
- **Days since last modification** (`--days-since-created`): optional; checks the Days-policy 24-hour spacing requirement.
- **Expected region** (`--region`): optional; used to derive the query endpoint.
- **UID**: can always be omitted - it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted or derived from --region, object class defaulted to the bucket default class, UID derived), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --region provided)".
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Error** (`--error`): optional; the data-plane error the user hit (e.g. `InvalidObjectState`, `RestoreAlreadyInProgress`).
- **Days since last modification** (`--days-since-created`): optional; checks the Days-policy 24-hour spacing requirement.
- **Expected region** (`--region`): optional; used to derive the query endpoint.
- **UID**: can always be omitted - it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted or derived from --region, object class defaulted to the bucket default class, UID derived), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --region provided)".
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"--endpoint", _STS_ENDPOINT,
"--user-agent", user_agent()]
try:
result = subprocess.run(cmd, capture_output=True, text=True,
timeout=timeout, stdin=subprocess.DEVNULL)
except subprocess.TimeoutExpired:
raise CliError(f"aliyun sts get-caller-identity timed out after "
When --bucket is omitted, the skill calls ListBuckets and returns up to 30 bucket names visible to the current credential. Even though the skill is described as read-only, this still discloses sensitive inventory metadata that may exceed the minimum information needed for diagnosis and could expose internal naming conventions, environments, or tenant information to whoever can invoke the skill.
This code reads ALIBABA_CLOUD_ACCESS_KEY_ID, ALIBABA_CLOUD_ACCESS_KEY_SECRET, and ALIBABA_CLOUD_SECURITY_TOKEN from environment variables, which falls under access to sensitive environment variables. Although the module docstring documents this behavior, there is no runtime user-facing prompt or warning when the access occurs.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
def __getattr__(self, name):
handle = object.__getattribute__(self, "_handle")
attr = getattr(handle, name)
if name.startswith("_") or not callable(attr):
return attr
The natural-language comments explicitly state that the Chinese variant is not matched by the English pattern and falls back to generic handling. This suggests the skill's language-specific interpretation logic is optimized for English without explicit user opt-in or documented locale constraint.
The manifest scopes the skill to OSS lifecycle/restore diagnosis, tiering advice, and fee composition, but this function adds a separate capability to classify the customer's question and query documentation via _doc_lookup. That documentation-verification feature is not stated in the manifest and is not necessary to perform the core runtime diagnosis.
No suspicious patterns detected.