Security audit

Alibabacloud Pai Eas Service Diagnose

Security checks across malware telemetry and agentic risk

Overview

This skill is a real PAI-EAS troubleshooting guide, but it gives an agent broad autonomous read access to cloud services, logs, endpoints, and tokens without enough user control or secret-handling guardrails.

Install only if you are comfortable granting the agent read access to PAI-EAS service metadata, events, logs, endpoint details, and service tokens. Use a least-privilege read-only RAM role, specify the exact region and service before running it, avoid account-wide discovery unless needed, and redact tokens, Authorization headers, access keys, logs, and endpoint details before sharing any diagnostic output.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The skill’s stated purpose is diagnosis, but these sections direct package installation, plugin updates, and potential plugin reinstallation. That expands the operational scope from read-only troubleshooting into modifying the local toolchain, which increases supply-chain and change-management risk if run automatically on a user system.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This file is materially out of scope for an EAS diagnosis skill: it is a broad Aliyun CLI installation and account configuration guide, including authentication setup and plugin usage. In an agent context, scope drift is dangerous because it expands the actions and permissions an operator or downstream agent may take, increasing the chance of unnecessary credential handling and cross-service access unrelated to diagnosing EAS issues.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The guide documents multiple authentication modes and role-assumption patterns, including cross-account and elevated access mechanisms, which are broader than necessary for an EAS diagnosis skill. Even without explicit exploitation, providing these pathways normalizes excessive privilege and can cause operators or agents to configure high-impact credentials when only limited diagnostic access should be needed.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The documentation expands this diagnose skill's effective scope by including a service-listing capability that the manifest explicitly says should be handled by a different skill. This can cause an agent to invoke broader enumeration actions than intended, weakening capability boundaries and increasing the chance of unauthorized discovery of service names and metadata.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The CLI examples actively instruct use of `list-services`, directly contradicting the stated 'Not for' boundary. In agentic systems, executable examples are especially influential; this increases the likelihood the agent will perform out-of-scope resource enumeration and bypass intended skill separation.

Description-Behavior Mismatch

Low

Confidence: 87% confidence
Finding: Advertising `ListServices` in SDK metadata signals that the skill may programmatically call a broader enumeration API than its declared scope allows. Even without an example, this metadata can steer implementation toward out-of-scope behavior and erode separation between diagnostic and management capabilities.

Vague Triggers

Medium

Confidence: 75% confidence
Finding: Broad trigger phrases such as everyday troubleshooting language can cause the skill to activate in cases where the user did not clearly intend log or service-metadata inspection. In this skill, unintended invocation matters because the workflow is designed to autonomously query services, instances, events, and logs across the account.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill explicitly instructs autonomous execution of account and service discovery commands, including service listing and diagnostic log retrieval, without a clear user-facing warning that metadata and logs will be accessed. This creates a consent and privacy risk because logs/events may contain sensitive operational details, and the skill is told not to ask before proceeding.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The API reference explicitly documents a `.Token` field as an access token but provides no warning that it is a secret, should not be logged, and must be redacted in examples or outputs. In a diagnostic skill focused on logs, endpoints, and troubleshooting, operators or downstream agents are especially likely to print full API responses, which can unintentionally disclose credentials.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation shows secrets being passed directly on the command line and via exported environment variables without warning about leakage through shell history, CI logs, process inspection, or transcript capture. In an agent-assisted environment, this is especially risky because commands may be echoed, logged, or stored automatically, exposing long-lived cloud credentials.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guide retrieves a live service Token and immediately uses it in an Authorization header for a curl connectivity test, but provides no warning that the token is a credential or guidance on how to avoid exposing it in shell history, process listings, logs, screenshots, or shared diagnosis reports. In a troubleshooting skill, operators are likely to copy-paste commands into terminals and tickets, which increases the chance of accidental credential leakage and unauthorized access if the token is reused or captured.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation includes commands that retrieve and display a service token and shows using an Authorization header directly in curl examples, but it does not warn that these values are sensitive secrets. In an agent skill context, users or downstream automation may copy, log, echo, or persist these commands, increasing the chance of credential disclosure and unauthorized access to the service.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: **If any command times out:** 1. Retry once with `--read-timeout 60` flag 2. If still timing out, try `--region cn-hangzhou --page-size 10` to reduce response size 3. Do NOT ask the user to troubleshoot network issues — handle it yourself ---
Confidence: 90% confidence
Finding: The instruction to handle failures autonomously and not ask the user to troubleshoot encourages the agent to keep making live API calls and alter execution strategy without consent. In a skill that can enumerate services and read diagnostics, this increases the chance of unintended data access and reduces meaningful user control over account-scoped operations.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: > **[MUST] Execution Rules:** > - You MUST execute each command directly — do NOT write scripts without executing them > - You MUST wait for each command's output before proceeding to the next step > - If a command fails or times out, retry once — do NOT ask the user to troubleshoot > - If a command still fails after retry, skip to the next diagnostic step and report the error at the end > - Do NOT ask the user "should I proceed?" or "please confirm" — just execute the diagnostic workflow
Confidence: 93% confidence
Finding: The workflow mandates direct execution of commands, retries, and continuation without asking 'should I proceed?' or 'please confirm.' That is risky because the skill performs potentially sensitive service, event, instance, and log queries automatically, which can expose operational data without an explicit consent step.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: 6. **[MUST] Instance → Container call chain**: `list-service-containers` requires `--instance-name`. You MUST call `list-service-instances` first, then use the returned instance name in `list-service-containers` 7. **[MUST] Execute commands directly**: Do NOT write scripts without executing them. Do NOT ask the user "should I proceed?" — just execute the diagnostic workflow autonomously 8. **[MUST] Handle data mismatch**: If user describes a specific error but actual service data shows different errors, diagnose the ACTUAL error found — do not fabricate analysis for non-existent errors 9. **[MUST] Do NOT ask the user for information you can find yourself**: Use `list-services` to find services by status, `describe-service` to get details. Do NOT ask for ServiceName, Cluster ID, or other information that can be obtained programmatically ---
Confidence: 94% confidence
Finding: This section reinforces fully autonomous discovery of service name and cluster information and forbids asking the user for information the skill can obtain itself. In context, that means the skill may enumerate account resources and inspect related diagnostics broadly, making accidental over-collection of metadata more likely.

Credential Access

High

Category: Privilege Escalation
Content: |-------|-------------| | `.InternetEndpoint` | Public endpoint | | `.IntranetEndpoint` | Internal endpoint | | `.Token` | Access Token | ---
Confidence: 97% confidence
Finding: Identifying and surfacing an access token field in documentation can facilitate credential exposure when users or agents follow the reference and dump complete endpoint responses during troubleshooting. Because this skill is specifically designed for diagnosis, where verbose output and sharing logs/results are common, the chance of accidental token leakage is materially higher and could enable unauthorized access to the service endpoint.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.