Security audit
Security checks for vulnerabilities and agentic risk
This is a read-only Alibaba Cloud OSS diagnostic skill that uses the configured cloud identity to inspect bucket website metadata, with no evidence of destructive or deceptive behavior.
Install only if you are comfortable letting the skill use your configured Alibaba Cloud identity to read OSS bucket metadata and caller identity. Run it with the documented least-privilege RAM actions, review before allowing any local aliyun CLI upgrade, and do not provide raw AK/SK credentials to the agent.
The skill description omits that it performs STS caller-identity checks and CLI credential-chain validation guidance. Even if read-only, identity inspection touches account context and may surprise users or violate least-surprise assumptions used by routing and approval systems.
The skill description omits that it performs STS caller-identity checks and CLI credential-chain validation guidance. Even if read-only, identity inspection touches account context and may surprise users or violate least-surprise assumptions used by routing and approval systems.
The skill invokes shell, network, environment-based credentials, and potentially file-writing behavior via referenced scripts, but it does not declare an explicit tool/permission scope. That creates an authorization and review gap: a runner may grant broader capabilities than operators expect, making accidental or abusive execution harder to constrain.
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
## Absolute Rules
1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating OSS API — e.g. `PutBucketWebsite`, `DeleteBucketWebsite`, `PutBucketPolicy`, `PutBucketAcl`, `PutObject*`, `DeleteBucket*`, or any ACL / domain-binding / hosting configuration change. This includes commands "for the user to run manually". If the user asks to enable static website hosting, set the homepage/404 rules, or bind a custom domain, only output manual console guidance and declare this skill is read-only.
2. **MANDATORY entry-point enforcement:** All OSS diagnostics MUST be performed by running the scripts under `scripts/` (`static_website_diagnosis.py` as the entry, `sts_token.py` for identity). The Agent must not assemble its own ossutil / SDK / curl commands against the OSS control plane or bypass the scripts — the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or pass AK/SK/STS tokens explicitly. The OSS SDK resolves credentials exclusively from the environment variables of the default credential chain; the identity check uses the aliyun CLI default credential chain; the default-domain probe is anonymous and credential-free. Never accept AK/SK from the user or from another script.
4. **NO FABRICATION:** Every conclusion must be grounded in data actually returned by GetBucketWebsite / GetBucketInfo / ListBucketCname / the anonymous probe / GetCallerIdentity. If a query fails or returns empty, record it and state the limitation — never invent hosting rules, domain bindings, or probe results. Empty / not-found is a valid and complete conclusion — if the bucket does not exist, has no hosting configuration, or all queries return empty, that IS the final answer: report it and STO
...[truncated 25 chars]
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Bucket name** (`--bucket`): required; the OSS bucket hosting (or intended to host) the static website.
- **User endpoint** (`--endpoint`): optional; overrides the default query endpoint when the user has a specific one.
- **Expected region** (`--region`): optional; used to derive the query endpoint when `--endpoint` is absent.
- **UID**: can always be omitted — it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted from region, UID derived), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --endpoint/--region provided)".
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Bucket name** (`--bucket`): required; the OSS bucket hosting (or intended to host) the static website.
- **User endpoint** (`--endpoint`): optional; overrides the default query endpoint when the user has a specific one.
- **Expected region** (`--region`): optional; used to derive the query endpoint when `--endpoint` is absent.
- **UID**: can always be omitted — it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.
**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted from region, UID derived), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --endpoint/--region provided)".
The manifest describes a narrowly scoped read-only diagnosis skill for OSS static website hosting issues such as homepage/404 rules, download-vs-render attribution, and ICP guidance. However, the helper’s generic keyword scoring can return official docs for any indexed content matching broad terms like '网站' or '域名', and the self-test explicitly demonstrates consultation-style matching for an unrelated lifecycle configuration query, indicating behavior broader than the declared purpose.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"--endpoint", _STS_ENDPOINT,
"--user-agent", user_agent()]
try:
result = subprocess.run(cmd, capture_output=True, text=True,
timeout=timeout, stdin=subprocess.DEVNULL)
except subprocess.TimeoutExpired:
raise CliError(f"aliyun sts get-caller-identity timed out after "
When no bucket is supplied, the script calls _oss_client.list_buckets() and prints up to 30 bucket names visible to the current credential. That expands the skill from bucket-scoped diagnosis into account-level inventory disclosure, which can leak sensitive resource names and violate least-privilege expectations for a read-only troubleshooting tool.
The code contains account inventory functionality unrelated to the stated purpose of diagnosing static website hosting for a specific bucket. Even though it is read-only, listing all accessible buckets increases information exposure and broadens the operational scope of the skill beyond what users and policy reviewers would expect.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
## 1. The rule in one sentence
Any CUSTOM DOMAIN bound to an OSS bucket located in a mainland region of
China
must hold a valid ICP filing issued by the Chinese authorities;
buckets in regions OUTSIDE mainland China do not require filing.
The file is restricted to the Chinese OSS help-center index (/zh/oss/llms.txt) and primarily uses Chinese trigger/consultation terms. This can create a language/locale policy issue because the behavior is fixed to a specific locale without user opt-in or an explicit justification in the file.
The self-test docstring says it validates activated-keyword selection for this skill, whose stated purpose is static website diagnosis. Yet the sample input 'OSS生命周期怎么配置' is about lifecycle configuration, contradicting the intended scope expressed by the surrounding module documentation and manifest context.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
def __getattr__(self, name):
handle = object.__getattribute__(self, "_handle")
attr = getattr(handle, name)
if name.startswith("_") or not callable(attr):
return attr
No suspicious patterns detected.