alibabacloud-oss-transfer-acceleration-diagnosis

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:38 AM UTC
• Version: 0.0.1

Overview

The skill is mostly a read-only Alibaba OSS diagnostic, but it needs review because it can use cloud credentials to list account bucket names and asks for a local CLI upgrade.

Install only with a narrowly scoped read-only RAM role, provide the exact bucket name so the skill does not enumerate account buckets, verify the active Alibaba Cloud profile first, and approve any `aliyun` CLI upgrade separately before running it.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/oss_transfer_acceleration_diagnosis.py:529

Finding

Unnecessary Account-Wide OSS Bucket Enumeration

Content

View full analysis

Vulnerability Details

File Location: scripts/oss_transfer_acceleration_diagnosis.py:529-551
Vulnerability Type: Excessive cloud metadata access and violation of least privilege
Risk Level: Medium

Vulnerable Code

python

if not (args.bucket or "").strip():
    _hint = []
    _herrs = []
    try:
        try:
            _all = _oss_client.list_buckets()
        except TypeError:
            _all = _oss_client.list_buckets(prefix="")
        _hint = [b["name"] for b in _all][:30]
    except Exception as e:
        _herrs.append({"category": "degraded", "code": "ListBucketsFailed",
                       "message": str(e)[:200]})
        print(f"[WARN] ListBuckets bucket-name hint degraded: {e}",
              file=sys.stderr)
    _rep = {
        "skill": globals().get(
            "_SKILL_NAME",
            "alibabacloud-oss-transfer-acceleration-diagnosis"
        ),
        "bucket": "",
        "buckets_in_account": _hint,
        "errors": _herrs,
        "auto_filled": [],
    }
    _na = ("Ask the user which OSS bucket the issue concerns; "
           "buckets_in_account lists up to 30 buckets visible to the "
           "current credential.")

The underlying enumeration in scripts/_oss_client.py:594-621 is:

python

def list_buckets(prefix: str = "", timeout: int = _DEFAULT_TIMEOUT,
                 endpoint: str = "oss-cn-hangzhou.aliyuncs.com",
                 max_buckets: int = 200) -> list:
    try:
        auth = oss2.ProviderAuth(DefaultChainCredentialsProvider())
        session = oss2.Session()
        session.session.headers["User-Agent"] = user_agent()
        service = _RetryingHandle(
            oss2.Service(auth, endpoint, session=session,
                         connect_timeout=timeout),
            "", endpoint)
        buckets = []
        marker = ""
        while len(buckets) < max_buckets:
            re
...[truncated 3402 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic bucket enumeration from the missing-argument path. Return a failure that asks the user to provide the exact bucket name and, if known, its region:

   python

   if not (args.bucket or "").strip():
       return _emit({
           "skill": "alibabacloud-oss-transfer-acceleration-diagnosis",
           "bucket": "",
           "errors": [{
               "category": "invalid_arguments",
               "code": "BucketRequired",
               "message": "An exact OSS bucket name is required."
           }],
           "auto_filled": [],
       }, "FAIL", "Provide the exact OSS bucket name and optionally its region.")
   

2. Remove oss:ListBuckets from the default RAM policy if the diagnostic can operate using the target bucket and supplied or default region. Retain only:

   • sts:GetCallerIdentity
   • oss:GetBucketInfo
   • oss:GetBucketTransferAcceleration

3. If ListBuckets remains necessary as a wrong-region fallback, make it an explicit opt-in operation. Explain that it enumerates account metadata and obtain user approval before invoking it.

4. Never include unrelated bucket names in the normal report. If an explicit fallback is approved, filter for the exact supplied bucket and retain only the matching record.

5. Separate the recommended policies into:

   • A default least-privilege policy without oss:ListBuckets.
   • An optional troubleshooting policy that adds oss:ListBuckets only when region discovery is required.

6. Restrict bucket-scoped actions to the target bucket ARN whenever the deployment knows the diagnostic scope in advance. Document that oss:ListBuckets is inherently account-level and should not be granted merely to improve missing-input usability.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The documented purpose is narrowly framed as read-only OSS acceleration diagnosis, but the skill also performs live documentation retrieval and routing/orchestration behavior not transparently reflected in the declared description. This mismatch can cause operators to trust the skill with a narrower risk profile than it actually has, undermining review, consent, and least-privilege assumptions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose is narrowly framed as read-only OSS acceleration diagnosis, but the skill also performs live documentation retrieval and routing/orchestration behavior not transparently reflected in the declared description. This mismatch can cause operators to trust the skill with a narrower risk profile than it actually has, undermining review, consent, and least-privilege assumptions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares substantial operational capabilities—shell execution, network access, environment access, and file read/write behavior—without an explicit tool/permission scope. That creates a governance gap: an agent may be allowed to execute sensitive local and network actions not clearly constrained by policy, making misuse or accidental overreach more likely.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The skill mandates command/script execution from local scripts/ with shell, network, file, and environment access, but relies mainly on textual prohibitions rather than a hard technical sandbox. If the referenced scripts are replaced, tampered with, or broader than described, the agent could execute unintended actions under the guise of diagnosis.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

## Absolute Rules

1. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating OSS API - e.g. the transfer-acceleration switch (oss2 `put_bucket_transfer_acceleration` / the console Enable action), any ACL/policy/lifecycle/CNAME change, or any object/bucket mutation. Enabling transfer acceleration is described as manual guidance in words only and is executed by the user in the OSS console. If the user asks to enable/disable the feature, only output the guidance and declare this skill is read-only.
2. **MANDATORY entry-point enforcement:** All OSS diagnostics MUST be performed by running the scripts under `scripts/` (`oss_transfer_acceleration_diagnosis.py` as the entry, `sts_token.py` for identity). The Agent is forbidden from assembling its own ossutil / SDK / curl commands against the OSS control plane or bypassing the scripts - the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries.
3. **ABSOLUTE PROHIBITION (credential handling):** Never read, print, or pass AK/SK/STS tokens explicitly. The scripts already resolve the default credential chain for you - `ALIBABA_CLOUD_ACCESS_KEY_ID` / `ALIBABA_CLOUD_ACCESS_KEY_SECRET` / `ALIBABA_CLOUD_SECURITY_TOKEN` environment variables first, then the current aliyun CLI profile (`~/.aliyun/config.json`) - entirely in memory. Therefore parsing, cat-ing, or exporting values from that config file is forbidden too: if a query degrades with `NoCredentials`, record the degradation and continue the report; never "bridge" credentials yourself. Never accept AK/SK from the user or from another script.
4. **NO FABRICATION:** Every conclusion must be grounded in data actually returned by GetBucketInfo / GetBucketTransferAcceleration / ListBuckets / GetCallerIdentity. If a query fails or returns empty, record
...[truncated 25 chars]

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

- **Workload** (`--workload hot-cache-read|upload-download|unknown`): optional; refines the selection advice.
- **Expected region** (`--region`): optional; used to derive the query endpoint.
- **Scope** (`--scope adoption|selection|fee|all`): optional; default `all`.
- **UID**: can always be omitted - it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.

**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted or re-derived from the bucket location, UID derived), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --region provided)".

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

md

- **Workload** (`--workload hot-cache-read|upload-download|unknown`): optional; refines the selection advice.
- **Expected region** (`--region`): optional; used to derive the query endpoint.
- **Scope** (`--scope adoption|selection|fee|all`): optional; default `all`.
- **UID**: can always be omitted - it is derived via `aliyun sts get-caller-identity` and used only as a traceability label. Auto-fill first, ask second: never ask the user for UID when it can be derived.

**Auto-fill declaration requirement**: Whenever any parameter is auto-filled (query endpoint defaulted or re-derived from the bucket location, UID derived), the Agent MUST explicitly declare this in the response or report metadata, e.g. "query endpoint auto-defaulted to oss-cn-hangzhou.aliyuncs.com (no --region provided)".

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_oss_client.py (reported line 653)May include surrounding context.

python

"--endpoint", _STS_ENDPOINT,
           "--user-agent", user_agent()]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True,
                                timeout=timeout, stdin=subprocess.DEVNULL)
    except subprocess.TimeoutExpired:
        raise CliError(f"aliyun sts get-caller-identity timed out after "

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs running aliyun upgrade --yes, which modifies the local system in place, despite the broader framing of the skill as read-only diagnosis. Even though this does not mutate cloud resources, it can still change the operator environment unexpectedly and bypass normal change-control expectations.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/_oss_client.py (reported line 322)May include surrounding context.

python

def __getattr__(self, name):
        handle = object.__getattribute__(self, "_handle")
        attr = getattr(handle, name)
        if name.startswith("_") or not callable(attr):
            return attr

Static analysis

No suspicious patterns detected.