Security audit

Alibabacloud Pai Workspace Manage

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it needs review because it can affect an Alibaba Cloud account and includes under-scoped deletion, broad CLI/plugin, and risky credential-handling guidance.

Install only if you intend to let an agent manage Alibaba Cloud PAI workspaces. Use a least-privilege RAM user or role limited to the documented PAI workspace actions, avoid putting access keys in chat, shell history, or persistent environment variables, review any CLI/plugin installation steps before running them, and do not follow the deletion guidance unless you explicitly want irreversible workspace removal.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill claims only create, query, and list behavior, but it also provides deletion instructions for an irreversible operation. That mismatch can cause an agent or user to perform destructive actions outside the expected trust boundary of the skill, increasing the risk of accidental data loss or privilege misuse.

Intent-Code Divergence

Low

Confidence: 94% confidence
Finding: Directing users toward a raw DELETE API endpoint introduces a destructive capability that bypasses the CLI-only operational framing and safety expectations established elsewhere in the skill. This increases the chance of parameter abuse, accidental invocation, or implementation by an agent without adequate confirmation and authorization controls.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: This reference file materially expands the operational scope of a PAI workspace management skill into broad Alibaba Cloud administration, including generic CLI setup, credential configuration, ECS usage, and plugin ecosystem access. In an agent skill context, that unnecessary breadth increases the chance the agent or user is steered into performing unrelated, higher-risk cloud actions with powerful credentials.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The guide encourages users to install arbitrary product plugins and explore unrelated service commands, which broadens the reachable command surface well beyond the stated skill purpose. In an agent-driven environment, this can normalize or enable lateral movement into other cloud services if the same credentials are available.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The documentation shows long-lived access keys and secrets directly on the command line, which can leak through shell history, process listings, audit tools, terminal recording, and CI logs. Because these are reusable cloud credentials, disclosure can lead to unauthorized access across the user's Alibaba Cloud environment, not just PAI.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Exporting credentials as environment variables without warning is risky because they may be inherited by child processes, captured in debugging output, exposed in CI/CD job logs, or retrievable from compromised sessions. In a skill that may be used through automation agents, that exposure path is especially relevant.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.