Security audit

alibabacloud-pai-dlc-job

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Alibaba Cloud PAI-DLC job-management skill, but it needs Review because it includes high-impact terminal access, sharing-token generation, plugin installation, and credential-handling guidance that are not fully scoped.

Install only if you are comfortable letting the agent operate Alibaba Cloud PAI-DLC jobs with your configured Aliyun profile. Review RAM permissions carefully, prefer least-privilege/read-only access when possible, require explicit approval before terminal or sharing-token use, and configure credentials outside the agent session using secure short-lived credentials or roles rather than pasting secrets into commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 78% confidence
Finding: The documentation introduces web terminal and token-sharing operations that are not declared in the manifest metadata, creating a scope mismatch that can hide higher-risk remote-access functionality from users and reviewers. In a cloud job-management skill, undeclared terminal or token-sharing features are more sensitive than ordinary read/list operations because they may enable interactive access or credential-bearing session delegation.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The documentation introduces `get-web-terminal` and `get-token` operations that are outside the declared manifest scope and triggers, creating hidden capability surface beyond what a caller would reasonably expect. This is dangerous because web terminal access can provide interactive access to running workloads, and token generation can delegate visibility into logs/events/metrics that may contain sensitive information.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: `get-web-terminal` enables interactive terminal access to a live pod, which is materially more powerful than ordinary job management or passive monitoring. In this skill context, undocumented or weakly justified terminal access is especially risky because it could expose shell-level access to workloads, secrets, data, or infrastructure reachable from the container environment.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The verification guide expands the skill's operational scope from DLC job management into AIWorkSpace resource discovery, which can cause an agent to enumerate additional cloud assets and identifiers not declared in the manifest. This broadens available capabilities and data exposure, increasing the risk of unauthorized discovery, misuse of adjacent services, and policy bypass if the agent follows the guide literally.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The document instructs the environment to install an additional CLI plugin at runtime, introducing a capability expansion path not justified by the stated DLC job-management purpose. Allowing a skill to modify the toolchain or fetch new components can bypass intended trust boundaries, create supply-chain exposure, and enable unreviewed functionality in the execution environment.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The guide shows non-interactive CLI commands with `--access-key-id` and `--access-key-secret`, which causes secrets to be entered directly on the command line and stored in the local CLI config. Command-line secrets can be exposed via shell history, process inspection, CI logs, and persisted plaintext configuration, increasing the chance of credential compromise in agent-driven or shared environments.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: Recommending `--log-level=debug` for authentication troubleshooting without a warning can expose sensitive request metadata, tokens, signed requests, or other credential-adjacent details in console output and log collectors. In automated agent or CI contexts, verbose logs are often centralized, which increases the blast radius of accidental disclosure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.