alibabacloud-oss-quota-throttling-diagnosis

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:38 AM UTC
• Version: 0.0.1

Overview

The skill is mostly a read-only OSS diagnostic tool, but it has overbroad credentialed network and bucket-inventory behaviors that users should review before installing.

Use this only with narrowly scoped, preferably short-lived read-only Alibaba Cloud credentials. Provide the exact bucket name to avoid account-wide bucket listing, do not use --endpoint unless it is a verified Alibaba Cloud OSS endpoint, and approve any aliyun CLI upgrade separately.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/oss_quota_diagnosis.py:610

Finding

Credentialed OSS Requests Can Be Redirected to an Arbitrary Host

Content

View full analysis

"_RetryingHandle": """Build an oss2.Bucket handle carrying UA + per-call timeout. ... """ auth = oss2.ProviderAuth(EnvCredentialsProvider()) session = oss2.Session() # Inject the observability User-Agent into every SDK request of this run. session.session.headers["User-Agent"] = user_agent() try: return _RetryingHandle( oss2.Bucket(auth, endpoint, bucket_name, session=session, connect_timeout=timeout), bucket_name, endpoint) ``` ### Technical Analysis The `--endpoint` argument is accepted as an arbitrary string. Normalization only removes a trailing slash and an optional `http://` or `https://` prefix. It does not verify that the resulting hostname belongs to Alibaba Cloud, matches an OSS endpoint format, uses an approved region, lacks a custom port, or resolves to a trusted address. T ...[truncated 2623 chars]

Remediation

View remediation

.aliyuncs.com` pattern. - Rejection of malformed labels, suffix confusion, and domains such as `aliyuncs.com.attacker.example`. 4. Do not silently strip `http://`; reject non-HTTPS input explicitly. 5. Disable redirects for authenticated requests, or validate every redirect destination before forwarding authentication headers or security tokens. 6. Add tests proving that attacker-controlled hosts, IP addresses, custom ports, internal addresses, and suffix-confusion domains are rejected before credentials are loaded or a request is issued. 7. Prefer short-lived, narrowly scoped STS credentials so that any accidental disclosure has limited duration and impact. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/oss_quota_diagnosis.py:565

Finding

Missing Bucket Input Triggers Unnecessary Account-Wide Bucket Enumeration

Content

View full analysis

list: """Call OSS ListBuckets (read-only) to locate buckets of this account. ... """ try: auth = oss2.ProviderAuth(EnvCredentialsProvider()) session = oss2.Session() session.session.headers["User-Agent"] = user_agent() service = _RetryingHandle( ...[truncated 3446 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented purpose says the skill is narrowly scoped to read-only quota/throttling diagnosis, but the content also mandates online documentation retrieval, caching, and broad keyword-based lookup behavior outside that scope. Scope drift is dangerous because operators may trust the skill as a narrow diagnostic tool while it performs broader network/file activity and may answer unrelated prompts under the same authority.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose says the skill is narrowly scoped to read-only quota/throttling diagnosis, but the content also mandates online documentation retrieval, caching, and broad keyword-based lookup behavior outside that scope. Scope drift is dangerous because operators may trust the skill as a narrow diagnostic tool while it performs broader network/file activity and may answer unrelated prompts under the same authority.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill requires shell, network, environment, and file access but does not declare any explicit tool scope or permissions boundaries. That creates unnecessary ambient authority: if the agent follows the skill, it may execute scripts with broad local and network access beyond the minimum needed for diagnosis.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The skill instructs the agent to execute scripts and shell commands, but the restriction is policy text inside the skill rather than an enforced sandbox boundary. If the referenced scripts are modified, replaced, or behave unexpectedly, the agent could still perform unintended network calls, file writes, or command execution under broad tool privileges.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

## Absolute Rules

1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating OSS API - e.g. `PutBucket*`, `PutObject*`, `DeleteObject*`, any ACL/policy/QoS configuration change. This includes commands "for the user to run manually". Quota increases and dedicated-resource (resource pool QoS) applications are ticket-based: only output the application guidance, never submit anything.
2. **MANDATORY entry-point enforcement:** All diagnostics MUST be performed by running the scripts under `scripts/` (`oss_quota_diagnosis.py` as the entry, `sts_token.py` for identity). The Agent is forbidden from assembling its own ossutil / SDK / curl commands against the OSS control plane or bypassing the scripts - the scripts embed timeout, error degradation, and observability guarantees. Read the script output, interpret it, and compose the report; do not re-implement the queries.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or pass raw credential values (key pair or session token) explicitly. The OSS SDK resolves credentials exclusively from the environment variables of the default credential chain; the identity check uses the aliyun CLI default credential chain. Never accept credential values from the user or from another script.
4. **NO FABRICATION (watermark honesty):** OSS has no public API to read the actual bandwidth/QPS utilization. Never present guessed or invented watermark/utilization numbers as measured data; the quota context this skill reports is the official default limits, and actual utilization must be checked in the OSS console (Usage Query > Basic Data) or CloudMonitor, or via the `x-oss-qos-delay-time` header of throttled responses. Every conclusion must be grounded in script output or user-provided evidence.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

md

| Error | Cause | Resolution |
|-------|-------|------------|
| No credentials found | Environment credential chain not configured | Run `aliyun configure` / configure environment variables; never ask the user for AK/SK |
| `AccessDenied` / 403 | Missing `oss:GetBucketInfo`, bucket owned by another account | Record `[WARN]`, run the ListBuckets fallback, point to [references/ram-policies.md](references/ram-policies.md); report `STATUS: DEGRADED` |
| `NoSuchBucket` / 404 | Bucket name does not exist (global namespace) | Verify spelling and owning account; report `STATUS: DEGRADED` with `NEXT_ACTION` |
| Network timeout / connection reset | Transient network failure | Report `STATUS: DEGRADED` honestly; retry later, never conclude "no throttling" from a failed call |

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_oss_client.py (reported line 525)May include surrounding context.

python

"--endpoint", _STS_ENDPOINT,
           "--user-agent", user_agent()]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True,
                                timeout=timeout, stdin=subprocess.DEVNULL)
    except subprocess.TimeoutExpired:
        raise CliError(f"aliyun sts get-caller-identity timed out after "

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill manifest describes a read-only OSS quota and throttling diagnosis capability focused on SlowDown, QPS, bandwidth, concurrency throttling, and quota guidance. This file instead implements a standalone STS caller-identity verification helper and account-selection workflow, which is not part of the manifest's described diagnostic functions or triggers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The listed references are all Chinese-language Aliyun help pages, and the document presents them as the authoritative sources for this skill without stating that the skill is China-locale-specific or offering an alternative language path. This can violate the language/locale policy criterion because it implicitly constrains users to a specific language without opt-in.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/_oss_client.py (reported line 269)May include surrounding context.

python

def __getattr__(self, name):
        handle = object.__getattribute__(self, "_handle")
        attr = getattr(handle, name)
        if name.startswith("_") or not callable(attr):
            return attr

Static analysis

No suspicious patterns detected.