Security audit

alibabacloud-pds-intelligent-workspace

Security checks across malware telemetry and agentic risk

Overview

The skill is meant for Alibaba PDS cloud-drive work, but its setup and sharing guidance can expose credentials or data and reaches beyond the stated PDS scope.

Review this skill carefully before installing. Use least-privilege PDS-only credentials, avoid putting secrets in command lines, prefer verified package-manager installs over curl-to-bash setup, and require passwords, expiration dates, and login restrictions before creating share links. Treat mountapp installation as a privileged persistent system change.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: This guide materially expands the skill’s operational scope from PDS file and mountapp tasks into full Alibaba Cloud CLI installation, account configuration, and general cloud administration. In an agent skill, that scope creep is dangerous because it can enable actions against unrelated cloud services and encourage broad account credential setup that exceeds the least-privilege expectations of the skill.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The text explicitly promotes installing and using all published Alibaba Cloud product plugins, which enables arbitrary service access far beyond PDS operations. In the context of a PDS-focused skill, this increases the chance an agent or user pivots into unrelated, potentially high-impact cloud commands under the same configured credentials.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The guide documents broad account-level authentication modes including long-lived Access Keys, STS tokens, and RAM role assumption patterns suitable for general cloud administration. Within this skill’s context, these patterns encourage configuring credentials with potentially expansive privileges, creating a path to cross-account or elevated access unrelated to PDS file handling.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The AK authentication flow first configures `--authentication-type ak` to list users, but the final step in the same branch tells the agent to configure the selected domain and user with `--authentication-type token`. This inconsistency can cause the agent to switch auth modes unexpectedly, leading to misconfiguration, failed authorization, or use of a different credential path than the user intended.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs running `curl ... | bash` to install software directly from a remote URL. Piped remote-script execution is a well-known supply-chain risk because it executes unreviewed network content with the user's shell privileges and provides no integrity verification, pinning, or trust prompt. In this context, the danger is increased because the skill is operational and may be followed verbatim by an agent or user during setup.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The examples place access key material directly on the command line, which can expose secrets through shell history, process listings, logs, terminal recording, and shared administrative environments. Because this is credential material for cloud access, accidental disclosure can lead to unauthorized use of the associated account or roles.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instructions tell the agent to display a table containing `phone` and `email` for users in the domain. This unnecessarily exposes personal contact data during account selection, increasing privacy risk and potentially disclosing PII to someone who only needs enough information to choose a user identity.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly provides a workflow for creating password-free, never-expiring share links, which creates persistent public access to potentially sensitive files if an operator follows the example without adding safeguards. Although the document includes best-practice guidance elsewhere, the concrete example normalizes an unsafe default and does not require a warning or confirmation before exposing data indefinitely.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill supports cross-organization sharing with external users and anonymous share access, but the overview does not prominently warn that these features may disclose enterprise or personal data outside intended trust boundaries. In an agent skill that may be followed operationally, omission of exposure warnings increases the risk of accidental oversharing.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.