Alibabacloud Oss Media Process

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 0.0.1

Overview

The skill mostly matches its Alibaba OSS media-processing purpose, but it also includes unsafe installation guidance and high-impact cloud administration behaviors that need review.

Install only if you trust the publisher and can review the cloud permissions. Prefer a verified Aliyun CLI installation method, use least-privilege RAM policies, avoid granting imm:DeleteProject or lifecycle-policy write access unless required, do not use custom endpoints unless they are trusted Alibaba OSS HTTPS endpoints, and process personal images or videos only with proper authorization.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:71

Finding

Unverified Remote Installer Is Piped Directly into Bash

Content

View full analysis

=3.3.3) | `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` | ``` ### Technical Analysis The installation instruction downloads a mutable remote script and immediately executes it with Bash. The payload is not pinned to a version, inspected, signature-verified, or checked against a known cryptographic digest. HTTPS authenticates the connection under normal conditions, but it does not guarantee that the remote script remains identical to the version reviewed during this audit. Compromise of the hosting infrastructure, CDN, DNS resolution, certificate trust path, or publisher account could change the effective code executed by the Skill. This behavior is unnecessary for the media-processing functionality itself. Installation should use a versioned and independently verified artifact rather than direct execution of network output. ### Attack Path 1. An attacker compromises the installer host, CDN, publishing process, DNS resolution, or another component in the delivery path. 2. The attacker replaces `setup.sh` with a malicious payload. 3. A user or agent follows the documented prerequisite command. 4. `curl` streams the attacker-controlled content directly to Bash. 5. The payload executes with all privileges available to the user running the command. ### Impact Assessment A malicious installer could execute arbitrary commands, read files accessible to the current user, steal Alibaba Cloud credentials, modify shell configuration, install persistence, alter local tools, or download additional payloads. If the command is run by a privileged user, the impact could extend to complete host compromise. ]]>

Remediation

View remediation

' aliyun-cli-installer.sh | sha256sum -c - bash aliyun-cli-installer.sh ``` The placeholder URL and digest must be replaced with official, independently verifiable values. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/process.py:1141

Finding

Unrestricted Custom OSS Endpoint Can Receive Authenticated Requests and Uploaded Files

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/imm_admin.py:241

Finding

IMM Project Deletion Proceeds When Its Protective Pre-check Fails

Content

View full analysis

None: """Delete an IMM project with protective pre-check.""" from alibabacloud_imm20200930 import models client = _get_imm_client(args.region) # Protective pre-check: verify project exists and check for bound buckets try: get_request = models.GetProjectRequest(project_name=args.project) get_response = client.get_project(get_request) proj = getattr(get_response.body, "project", None) if proj: dataset_count = getattr(proj, "dataset_count", 0) if dataset_count and dataset_count > 0: _die( f"Project '{args.project}' still has {dataset_count} " f"dataset(s) bound. Unbind all buckets before deleting.", "Use 'unbind-bucket' to remove bucket bindings first." ) except Exception as exc: print( json.dumps({"status": "warning", "message": f"Pre-check skipped: {exc}"}), file=sys.stderr, ) request = models.DeleteProjectRequest(project_name=args.project) client.delete_project(request) ``` ### Technical Analysis The function describes the project query as a protective pre-check, but catches every exception and converts it into a warning. Execution then continues to the destructive `delete_project` API call. The safeguard therefore fails open. Permission errors, transient network failures, API response changes, malformed responses, or service errors can prevent the code from confirming that the project is safe to delete while still allowing deletion to proceed. The broad `except Exception` also prevents the caller from distinguishing an expected “project not found” result from a failure to inspect pr ...[truncated 981 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/process.py:1737

Finding

Blind-Watermark URL Generation Automatically Modifies Persistent Bucket Lifecycle Policy

Content

View full analysis

dict: """Safely add or update the temp-object lifecycle rule without dropping others.""" try: import oss2 as _oss2 except ImportError: return { "status": "skipped", "message": "oss2 SDK not installed; cannot manage lifecycle cleanup.", } rule_id = "blindwatermark-tmp-cleanup" new_rule = _oss2.models.LifecycleRule( rule_id, "_blindwatermark_tmp/", status=_oss2.models.LifecycleRule.ENABLED, expiration=_oss2.models.LifecycleExpiration(days=lifecycle_days), ) try: existing = bucket.get_bucket_lifecycle() rules = list(getattr(existing, "rules", []) or []) except Exception as exc: error_str = str(exc) if any(token in error_str for token in ("NoSuchLifecycle", "NoSuchBucketLifecycle", "404")): rules = [] else: return { "status": "skipped", "message": f"Failed to inspect existing lifecycle rules: {exc}", } updated = False merged_rules = [] for rule in rules: if getattr(rule, "id", None) == rule_id: merged_rules.append(new_rule) updated = True else: merged_rules.append(rule) if not updated: merged_rules.append(new_ru ...[truncated 2492 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description centers on processing media files in Alibaba Cloud OSS using OSS/IMM features such as resize, crop, watermarking, transcoding, detection, and format conversion. The supplied code chunk does none of that. Its sole purpose is to validate RAM permissions for OSS and IMM by checking bucket/project access and printing diagnostic results. While permission checking could be a supporting utility inside a larger media-processing package, this specific code chunk’s behavior is materially different from the declared skill purpose and exposes an undeclared capability area: credential/permission diagnostics. Therefore this chunk does not accurately represent the declared media-processing functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a user-facing media transformation skill operating on OSS media objects, with broad image/audio/video processing and IMM intelligent analysis features. The supplied code chunk instead is strictly an IMM administration script. Its functions are limited to project lifecycle management (create, list, get, delete), checking project/bucket binding status, attaching/detaching OSS buckets, and auto-provisioning an IMM project for a bucket. Although IMM is mentioned in the declared description, this code does not invoke any media-processing or AI analysis operations on files themselves. The primary purpose is therefore materially different: infrastructure/setup management rather than media processing. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a full OSS media-processing skill covering image, audio, video, IMM intelligence, and file transfer operations. The provided code chunk does none of that processing. Its purpose is operational setup and diagnostics: discovering environment variables, validating dependencies and credentials, checking permissions, and verifying IMM configuration. While such setup logic could support a media-processing skill, this chunk’s actual behavior is materially different from the declared primary purpose and includes undeclared local file/config inspection and permission-diagnostic capabilities. Therefore this code chunk does not accurately represent the declared skill behavior.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Piping a remotely fetched script directly into bash is a well-known supply-chain risk. If the hosting endpoint, network path, or downloaded installer is compromised, arbitrary code will execute immediately with the user's privileges, potentially leading to credential theft, malware installation, or broader system compromise. In this skill's cloud context, that risk is heightened because the environment is likely to hold Alibaba credentials and access to OSS resources.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

| Step | Action | Command |
|------|--------|---------|
| 1 | Install Aliyun CLI (>=3.3.3) | `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` |
| 2 | Configure credentials | `aliyun configure` |
| 3 | Run blocking preflight check 1 | `python scripts/load_env.py` |
| 4 | Run blocking preflight check 2 | `aliyun configure list` |

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

The script auto-detects async-only operations and handles routing/polling automatically — no `--async` or `--wait` flags needed.

### Output rules

| Operation type | Output mode | Command pattern |
|----------------|-------------|-----------------|

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file includes a delete-project command that can permanently remove IMM projects, which is a destructive cloud control-plane action not necessary for ordinary media transformation. If exposed through an agent or invoked through prompt-driven workflows, it could cause loss of service configuration, downstream processing failures, and operational disruption.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/load_env.py (reported line 16)May include surrounding context.

python

~/.profile
    ~/.bash_profile
    ~/.zshrc
    ~/.env

  Windows systems scan these files:
    %USERPROFILE%\\.env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/load_env.py (reported line 19)May include surrounding context.

python

~/.profile
    ~/.bash_profile
    ~/.zshrc
    ~/.env

  Windows systems scan these files:
    %USERPROFILE%\\.env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/load_env.py (reported line 64)May include surrounding context.

python

if _IS_WINDOWS:
    _ENV_FILES = [
        os.path.join(os.environ.get("USERPROFILE", ""), ".env"),
        os.path.join(os.environ.get("USERPROFILE", ""), "alibaba.env"),
    ]
else:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/load_env.py (reported line 75)May include surrounding context.

python

if _IS_WINDOWS:
    _ENV_FILES = [
        os.path.join(os.environ.get("USERPROFILE", ""), ".env"),
        os.path.join(os.environ.get("USERPROFILE", ""), "alibaba.env"),
    ]
else:

Lp1

High

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The script has broad network capability: it contacts arbitrary HTTP(S) URLs, OSS, and IMM services, but the finding indicates those capabilities are not declared in the skill permissions model. In an agent setting, undeclared network access is dangerous because it enables unexpected external communication, data transfer, and SSRF-like behavior outside the user's understood trust boundary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script modifies bucket lifecycle configuration to manage temporary watermark objects, which is a control-plane permission far broader than simple media processing. In a shared bucket, this can unexpectedly alter retention/deletion behavior for objects and demonstrates the skill is capable of making persistent administrative changes to storage policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This is a natural-language locale policy constraint that forces a specific language by default rather than offering the user a language choice. The policy applies throughout the skill and may conflict with organizational expectations to avoid language restrictions without explicit user opt-in.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill instructs saving outputs into a persistent workspace directory for the session. Media outputs may contain sensitive user data, and storing them by default in a reusable local path can increase the risk of unintended retention, cross-task exposure, or later access by other processes or users on the same system. The skill context makes this somewhat more sensitive because it handles user-supplied images, audio, and video, which often contain personal or proprietary content.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

Setup workspace output directory (run once per session):

bash

WORKSPACE_OUTPUT=$(pwd)/outputs && mkdir -p "$WORKSPACE_OUTPUT"

All --output-path arguments MUST use $WORKSPACE_OUTPUT/<filename> — files saved inside the skill directory will NOT be renderable.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

**Security rules**:
- Never read, echo, print, `cat`, or dump `~/.aliyun/config.json`, credential files, or any raw command output that contains `access_key_id`, `access_key_secret`, `sts_token`, `AccessKeyId`, `AccessKeySecret`, or `SecurityToken` values.
- Never ask the user to input AK/SK directly in the conversation or command line
- Guide users to use `aliyun configure` to set up credentials securely
- Never write `AccessKeyId`, `AccessKeySecret`, or `SecurityToken` into any temporary Python/Shell script, here-doc, env export, or intermediate file. All credentials must be discovered through Aliyun CLI or the SDK default credential chain.
- For credential diagnostics, use `aliyun configure list`, `python scripts/load_env.py`, or other non-secret checks. If you must inspect configuration structure, only inspect non-sensitive fields and do not print secret or token values to the transcript.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

These instructions impose a specific output language for final user-facing summaries without first offering a language choice. That constitutes a natural-language policy violation under the locale/language rule because the skill defaults to Chinese unless the user opts into English.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

md

- If an explicitly performed read-only verification result differs from the requested value, report the actual verified output value and describe the request as only partially satisfied when necessary. Do not replace the verified value with the requested one.
- If no read-only verification result was obtained, do not claim that machine-verifiable output properties were independently confirmed.

If the user forbids local downloads, omit the `File path` row/section entirely and do not create temporary local files for validation. In that case, present only the JSON-backed metadata returned by `process.py`, such as `success`, `request_id`, `task_id`, `target_key`, `generated_keys`, or `url`.

If `process.py` returns a signed URL, treat the full query string as sensitive output. In normal visible summaries, prefer the OSS path, target key, or a redacted URL. Do not expand raw signing parameters into the final summary unless the runtime has a secure private-output channel for secret delivery.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file documents g=face, g=auto, and g=faces modes that rely on AI analysis of image contents, including face-centered cropping and face blurring. While it notes IMM binding and anonymous-access constraints, it does not warn that these operations involve automated analysis of potentially sensitive biometric data or that image content is sent to backend image-analysis services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This reference documents face, body, car, code, labeling, and image scoring operations that can extract biometric or sensitive content-derived information, but it provides no user-facing privacy, consent, retention, or lawful-use warning. In an agent skill that directly enables processing user-supplied OSS media, this omission increases the risk that operators will use these features on personal data without adequate notice, authorization, or compliance controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The permission guide explicitly includes oss:DeleteObject and states it is used for temp-file cleanup and --uri auto-cleanup, but it does not prominently warn operators that enabling this permission allows permanent object deletion in the bucket scope granted by the policy. In a media-processing skill that handles uploads, transforms, and temporary artifacts, undocumented destructive capability increases the chance of accidental data loss or misuse if the skill, caller, or configuration targets the wrong object keys.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This script expands the skill from media processing into cloud administration by creating, listing, binding, unbinding, and deleting IMM resources. In an agent-skill context, that broader capability increases the attack surface and can let prompts trigger persistent infrastructure changes unrelated to a single media-processing task.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/imm_admin.py (reported line 8)May include surrounding context.

python

image-intelligent operations such as blind watermark extraction and AI detection.

Subcommands:
    auto-setup      Auto-check/create IMM project and bind bucket (one command)
    create-project  Create an IMM project and auto-bind bucket
    list-projects   List IMM projects
    get-project     Get IMM project details

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The deletion path executes immediately after minimal pre-checks and does not require any interactive confirmation, force flag, or explicit acknowledgment of destructive consequences. This makes accidental or prompt-induced deletion much easier, especially in automated environments where command execution may not be carefully reviewed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

In verbose and diagnostic modes, the script prints environment variable values directly, and _safe_display currently returns the raw value unchanged. Even though the current target variables are bucket and region rather than secret keys, these values still disclose internal cloud resource identifiers and normalize unsafe logging patterns around local configuration data; if target vars expand later, this becomes a direct secret leak.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.