alibabacloud-oss-security-incident-forensics

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:01 AM UTC
• Version: 0.0.1

Overview

This Alibaba Cloud OSS forensic skill appears read-only and purpose-related, but it deserves Review because it can use cloud credentials to broadly read bucket/log metadata and automatically enumerate bucket names when no bucket is supplied.

Install only with a short-lived, least-privilege Alibaba Cloud credential and expect the skill to read OSS configuration metadata plus OSS real-time-log request metadata. Avoid invoking it without a bucket name unless account-wide bucket-name disclosure is acceptable, and narrow the RAM policy to a known bucket/log project when possible.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/oss_traffic_forensics.py:1208

Finding

Automatic Account-Wide Bucket Enumeration Exceeds Least Privilege

Content

View full analysis

Vulnerability Details

File Location: scripts/oss_traffic_forensics.py:1208-1236
Vulnerability Type: Excessive read permissions and unnecessary account-wide resource enumeration
Risk Level: Medium

Vulnerable Code

python

# Missing-bucket guard: most real tickets never name a bucket, so a bare
# argparse exit 2 leaves the customer with no next step. Ask for the name
# and surface the buckets this credential can actually see.
if not (args.bucket or "").strip():
    _hint = []
    _herrs = []
    try:
        try:
            _all = _oss_client.list_buckets()
        except TypeError:
            _all = _oss_client.list_buckets(prefix="")
        _hint = [b["name"] for b in _all][:30]
    except Exception as e:
        _herrs.append({"category": "degraded", "code": "ListBucketsFailed",
                       "message": str(e)[:200]})
        print(f"[WARN] ListBuckets bucket-name hint degraded: {e}",
              file=sys.stderr)
    _rep = {
        "skill": globals().get("_SKILL_NAME", "alibabacloud-oss-security-incident-forensics"),
        "bucket": "",
        "buckets_in_account": _hint,
        "errors": _herrs,
        "auto_filled": [],
    }
    _na = ("Ask the user which OSS bucket the issue concerns; "
           "buckets_in_account lists up to 30 buckets visible to the "
           "current credential.")
    if not _hint:
        _na += (" No bucket is listable with the current credential: ask "
                "for the exact bucket name and its region instead.")
    return _emit(_rep, "FAIL", _na)

The enumeration implementation is located at scripts/_oss_client.py:600-632:

python

def list_buckets(prefix: str = "", timeout: int = _DEFAULT_TIMEOUT,
                 endpoint: str = "oss-cn-hangzhou.aliyuncs.com",
                 max_buckets: int = 200) -> list:
    """Call OSS ListBuckets (read-only) to locate buckets of this account.

    Used as the fallback path when GetBucketInfo cannot resolve the region
    (wr
...[truncated 3683 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic ListBuckets invocation when --bucket is absent. Return a failure that asks for the exact bucket name and, if necessary, its region.
2. Make account-wide discovery an explicit, separately authorized opt-in operation rather than an implicit fallback.
3. Remove oss:ListBuckets from the default minimal policy. Provide it only through a separate discovery policy when the operator has explicitly requested enumeration.
4. Scope bucket configuration actions to the affected bucket ARN wherever the Alibaba Cloud action supports resource-level restrictions.
5. Scope SLS access to the derived OSS log project and logstore rather than using Resource: "*", wherever supported.
6. If a region fallback remains necessary, require the user to supply the expected region or obtain it through a narrowly scoped mechanism that does not enumerate the full account.
7. Avoid including account inventory in normal report output. If explicitly requested, minimize returned fields and apply output redaction and access controls.
8. Add tests asserting that execution without --bucket performs no cloud API calls and returns only a request for the missing target.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A second independently reported description/behavior mismatch reinforces that the skill may not perform the forensic actions it claims, especially around SLS queries and incident analysis. In a security-response context, this can delay detection, produce false assurance, and cause responders to miss active abuse or credential compromise.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A second independently reported description/behavior mismatch reinforces that the skill may not perform the forensic actions it claims, especially around SLS queries and incident analysis. In a security-response context, this can delay detection, produce false assurance, and cause responders to miss active abuse or credential compromise.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares no explicit tool scope while its described operation depends on shell, network, environment, and file access. Without an allowlist or permissions boundary, an agent could invoke capabilities beyond the intended read-only forensic workflow, increasing the blast radius if the skill is misrouted, compromised, or later modified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The phrase "unexpected outbound traffic" is ambiguous and may capture ordinary troubleshooting scenarios unrelated to OSS security incidents. Because this skill can invoke scripts and cloud-facing commands, ambiguous triggering increases the chance of unnecessary privileged execution and misdiagnosis.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The phrase "unexpected outbound traffic" is ambiguous and may capture ordinary troubleshooting scenarios unrelated to OSS security incidents. Because this skill can invoke scripts and cloud-facing commands, ambiguous triggering increases the chance of unnecessary privileged execution and misdiagnosis.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill text forbids only mutating OSS APIs, but still authorizes executing commands/scripts generally and relies on prose rather than enforced restrictions. This is dangerous because an agent with shell access could run unintended commands, inspect local state, or interact with other tools outside the narrow forensic scope.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

## Absolute Rules

1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating OSS API — e.g. `PutBucket*`, `DeleteBucket*`, `PutObject*`, `DeleteObject*`, `PutBucketPolicy`, `DeleteBucketPolicy`, or any ACL/policy/Referer configuration change. This includes commands "for the user to run manually". If the user asks to seal off attackers, change the ACL, or disable a leaked AccessKey, only output manual guidance and declare this skill is read-only.
2. **MANDATORY entry-point enforcement:** All OSS forensics MUST be performed by running the scripts under `scripts/` (`oss_traffic_forensics.py` as the entry, `sts_token.py` for identity). The Agent is forbidden from assembling its own ossutil / SDK / curl commands against the OSS control plane or bypassing the scripts — the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or pass AK/SK/STS tokens explicitly. The OSS SDK resolves credentials exclusively from the environment variables of the default credential chain; the identity check uses the aliyun CLI default credential chain. Never accept AK/SK from the user or from another script.
4. **NO FABRICATION:** Every conclusion must be grounded in data actually returned by the control-plane queries or the executed real-time-log queries. If a query fails or returns empty, record it and state the limitation — never invent attacker IPs, traffic figures, or root causes. The SLS query leg EXECUTES read-only (the SLS `GetHistograms` and `GetLogs` API operations) against the customer's own dedicated log project (`oss-log-<owner-uid>-<regionId>`) and is strictly additive: it never raises, never contributes to `errors[]`, and on any failure (not enabled / no permission / over-cap w
...[truncated 25 chars]

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md

- **Log scan days** (`--log-days`): optional (default 1, max 7, the OSS real-time log keeps a rolling 7 days); how many days back to execute the real-time-log queries. Ignored when `--time-window` already states a day/hour count.
- **Disable log execution** (`--no-log-execution`): optional flag; emit the query statement sequence without executing it (offline review, or the caller lacks SLS read permission).
- **Customer wording** (`--question`): optional; the customer's original question wording passed verbatim. Enables the official-doc verification leg (`doc_verification` section) — read-only, help.aliyun.com only, never blocks the diagnosis.
- **UID**: can always be omitted — it is derived via `aliyun sts get-caller-identity` and used only as a traceability label plus the SLS project-name derivation. Auto-fill first, ask second: never ask the user for UID when it can be derived.

**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted, UID derived, region discovered via ListBuckets), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --region provided)".

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.

md

- **Log scan days** (`--log-days`): optional (default 1, max 7, the OSS real-time log keeps a rolling 7 days); how many days back to execute the real-time-log queries. Ignored when `--time-window` already states a day/hour count.
- **Disable log execution** (`--no-log-execution`): optional flag; emit the query statement sequence without executing it (offline review, or the caller lacks SLS read permission).
- **Customer wording** (`--question`): optional; the customer's original question wording passed verbatim. Enables the official-doc verification leg (`doc_verification` section) — read-only, help.aliyun.com only, never blocks the diagnosis.
- **UID**: can always be omitted — it is derived via `aliyun sts get-caller-identity` and used only as a traceability label plus the SLS project-name derivation. Auto-fill first, ask second: never ask the user for UID when it can be derived.

**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted, UID derived, region discovered via ListBuckets), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --region provided)".

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_oss_client.py (reported line 659)May include surrounding context.

python

the timeout is always set. Never shell=True.
    """
    try:
        result = subprocess.run(cmd, capture_output=True, text=True,
                                timeout=timeout, stdin=subprocess.DEVNULL)
    except subprocess.TimeoutExpired:
        return 124, "", f"timed out after {timeout}s"

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_sls_query.py (reported line 263)May include surrounding context.

python

the timeout is always set. Never shell=True.
    """
    try:
        result = subprocess.run(cmd, capture_output=True, text=True,
                                timeout=timeout, stdin=subprocess.DEVNULL)
    except subprocess.TimeoutExpired:
        return 124, "", f"timed out after {timeout}s"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The advisory-question detection logic explicitly matches only Chinese and English trigger phrases, which can change behavior based on language and omit equivalent support for users in other languages. This is a natural-language locale policy concern because the skill effectively privileges specific languages without documenting user opt-in or a justified locale restriction.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest frames the skill as investigating an affected bucket for traffic abuse and incidents, with a read-only exposure audit and log-query workflow. In practice, the code broadens behavior to account-wide bucket discovery via ListBuckets and returns bucket names to the caller, which is more than bucket-specific forensics and is not clearly disclosed in the manifest description.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/_oss_client.py (reported line 273)May include surrounding context.

python

def __getattr__(self, name):
        handle = object.__getattribute__(self, "_handle")
        attr = getattr(handle, name)
        if name.startswith("_") or not callable(attr):
            return attr

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest describes auditing ACL, bucket policy, public-access block, and Referer settings, plus SLS query sequencing and root-cause routing. This module also implements GetBucketRequestPayment analysis, which is not mentioned in the manifest description and extends the exposure-analysis behavior beyond the declared controls.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The top-level documentation says the skill 'Only issues GetBucketInfo / GetBucketPolicy / GetBucketPublicAccessBlock / GetBucketReferer (+ ListBuckets fallback) to the OSS control plane and GetCallerIdentity to STS.' Later code explicitly calls _oss_client.get_bucket_request_payment, so the documentation actively understates the real cloud operations performed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes a forensic OSS incident-analysis skill focused on exposure auditing, SLS queries, root-cause routing, and containment checklists. The code additionally performs doc-verification via lookup_config_topic and attaches documentation matches for advisory questions or degraded runs, which is more of an advisory/documentation assistant capability than incident forensics.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description specifically says it 'runs the 6-step SLS log query sequence,' which implies a fixed, narrow workflow. The implementation adds multiple extra query stages such as endpoint split, VPC split, daily trend, bytes-ranked IPs, C-segment aggregation, object-prefix aggregation, and CDN origin checks, so the actual behavior exceeds the described sequence.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.