Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed, read-only Alibaba Cloud OSS multipart-upload diagnostic, with limited cloud metadata access and manual-only cleanup guidance.
Install only if you are comfortable granting the skill read-only Alibaba Cloud metadata access. Use a RAM role or user limited to sts:GetCallerIdentity, oss:GetBucketInfo, oss:ListBuckets, and oss:ListMultipartUploads; do not grant cleanup permissions to the diagnostic role. Review any fragment cleanup commands yourself before running them, because aborting multipart uploads is irreversible.
The skill claims OSS multipart-upload diagnostics but the finding indicates it may only perform STS identity verification and not inspect multipart-upload state. This mismatch can cause users to rely on nonexistent diagnostics, disclose operational context unnecessarily, and approve access to identity data under false assumptions about the skill's function.
The skill claims OSS multipart-upload diagnostics but the finding indicates it may only perform STS identity verification and not inspect multipart-upload state. This mismatch can cause users to rely on nonexistent diagnostics, disclose operational context unnecessarily, and approve access to identity data under false assumptions about the skill's function.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# abort every unfinished upload under the prefix (irreversible)
ossutil rm oss://<bucket>/<object-prefix> -m -r -f
# abort every unfinished upload of the whole bucket
ossutil rm oss://<bucket> -m -r -f
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# abort every unfinished upload under the prefix (irreversible)
ossutil rm oss://<bucket>/<object-prefix> -m -r -f
# abort every unfinished upload of the whole bucket
ossutil rm oss://<bucket> -m -r -f
The skill declares broad executable capabilities in practice (shell, network, file/env access) but does not define an explicit tool/permission scope. That creates an avoidable trust gap: even though the prose says "read-only," there is no machine-enforced boundary preventing future script changes or unintended tool use beyond diagnostics.
The document instructs the agent to execute scripts, but the safety model relies on procedural rules inside the skill rather than hard technical restrictions. If the execution environment permits unrestricted shell use, a compromised or modified script could perform unintended actions despite the text saying not to call mutating APIs.
## Absolute Rules
1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating OSS API — including `AbortMultipartUpload` (fragment cleanup), `PutObject`, `UploadPart`, `CompleteMultipartUpload`, `DeleteObject`, `DeleteBucket`, or any ACL/policy/lifecycle configuration change. Fragment cleanup is a WRITE operation: this skill only outputs manual cleanup guidance and command templates for the user to execute themselves (see [references/fragment-cleanup-guide.md](references/fragment-cleanup-guide.md)).
2. **MANDATORY entry-point enforcement:** All OSS diagnostics MUST be performed by running the scripts under `scripts/` (`multipart_upload_diagnosis.py` as the entry, `sts_token.py` for identity). The Agent is forbidden from assembling its own ossutil / SDK / curl commands against the OSS control plane or bypassing the scripts — the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or pass AK/SK/STS tokens explicitly. The OSS SDK resolves credentials exclusively through the Alibaba Cloud default credential chain library; the identity check uses the aliyun CLI default credential chain. Never accept AK/SK from the user or from another script.
4. **NO FABRICATION:** Every conclusion must be grounded in data actually returned by GetBucketInfo / ListBuckets / ListMultipartUploads / GetCallerIdentity or the user-provided parameters. If a query fails or returns empty, record it and state the limitation — never invent upload IDs, fragment counts, or speed figures.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Prefix** (`--prefix`): optional object-key prefix filter for the fragment listing.
- **Endpoint** (`--endpoint`) / **Region** (`--region`): optional; used to locate the bucket when the default query endpoint does not match.
- **Customer wording** (`--question`): optional; the customer's original question wording passed verbatim. Enables the official-doc verification leg (`doc_verification` section) — read-only, help.aliyun.com only, never blocks the diagnosis.
- **UID**: can always be omitted — it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted, UID derived, fragment-listing endpoint derived from the bucket location), the Agent MUST explicitly declare this in the response or report metadata.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Prefix** (`--prefix`): optional object-key prefix filter for the fragment listing.
- **Endpoint** (`--endpoint`) / **Region** (`--region`): optional; used to locate the bucket when the default query endpoint does not match.
- **Customer wording** (`--question`): optional; the customer's original question wording passed verbatim. Enables the official-doc verification leg (`doc_verification` section) — read-only, help.aliyun.com only, never blocks the diagnosis.
- **UID**: can always be omitted — it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted, UID derived, fragment-listing endpoint derived from the bucket location), the Agent MUST explicitly declare this in the response or report metadata.
The module exceeds the declared scope of a read-only OSS diagnostics skill by making outbound HTTP requests to a public documentation site and writing a cache file under the user's home directory. While it does not access OSS credentials or mutate cloud state, this hidden side effect expands the trust boundary, can leak usage metadata to a third party, and may violate platform expectations or operator policy for an ostensibly local/read-only diagnostic skill.
The docstring states 'ZERO cloud API calls' and 'only reads public help-center content,' but the implementation performs live network fetches and writes a persistent local cache. This discrepancy is dangerous because reviewers, operators, or automated policy engines may approve the skill under false assumptions, enabling unexpected outbound communication and filesystem modification in environments that rely on strict declared behavior.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"--endpoint", _STS_ENDPOINT,
"--user-agent", user_agent()]
try:
result = subprocess.run(cmd, capture_output=True, text=True,
timeout=timeout, stdin=subprocess.DEVNULL)
except subprocess.TimeoutExpired:
raise CliError(f"aliyun sts get-caller-identity timed out after "
When --bucket is omitted, the script attempts to list up to 30 buckets visible to the current credential and returns them in the report. That expands the skill from targeted multipart-upload diagnosis into broader resource discovery, exposing inventory metadata that may be unrelated to the user’s stated issue and could be sensitive if the skill is invoked by an untrusted requester or in a shared support context.
The skill manifest describes a read-only OSS multipart upload diagnostic focused on listing multipart uploads, checking part size/concurrency limits, and attributing upload failures. This file instead implements a separate STS caller-identity helper that verifies the current Alibaba Cloud account identity, which is not described among the skill's stated functions or triggers.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
def __getattr__(self, name):
handle = object.__getattribute__(self, "_handle")
attr = getattr(handle, name)
if name.startswith("_") or not callable(attr):
return attr
No suspicious patterns detected.