Alibabacloud Oss Manage Cron Upload

• Outcome: Review
• Latest audit: May 29, 2026 · 9:35 PM UTC
• Version: 0.0.2

Overview

This skill has a real OSS backup purpose, but it needs Review because it can set up recurring cloud uploads and includes under-scoped test-file and credential-setup guidance.

Install only after reviewing the exact local source path, OSS bucket, prefix, schedule, log path, and generated script. Use a dedicated least-privilege RAM identity, avoid DeleteObject and PutBucket unless needed, configure credentials outside the agent session, and do not allow substitute test folders or test uploads unless you explicitly request them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to create a local directory and test file automatically when the specified source path does not exist, which is a write operation on the host outside the user’s originally requested action. Even though this is framed as validation, it can modify local state and lead to unintended uploads to OSS without an explicit opt-in for creating test artifacts.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The document says not to simulate success or create fake local artifacts, yet elsewhere requires creating test data when prerequisites are missing. This contradiction increases the chance that an agent will justify unintended file creation and uploads as part of normal execution, weakening operator expectations about when state changes occur.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The guide correctly warns that agents must never execute credential-setting commands, but then states that non-interactive credential configuration is recommended for agent-driven automation. That contradiction can cause an agent or operator to treat secret-bearing `aliyun configure set --access-key-*` commands as acceptable automation steps, leading to credential entry, storage, or exfiltration in agent contexts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill directs creation of local test files and immediate upload to OSS without a prominent warning that this will modify the filesystem and transmit data to cloud storage. In an agent setting, that can cause unexpected writes and network exfiltration of locally generated or mistakenly targeted content.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The cleanup section includes commands that delete scheduled tasks, cron entries, scripts, logs, and OSS objects, but the warnings are not prominent enough for an execution-oriented agent. This can lead to destructive changes to persistence mechanisms or cloud data if the cleanup block is run too broadly or inferred as routine post-validation behavior.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: SKILL.md:251