Alibabacloud Pds Multimodal Search

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 0.0.3

Overview

This skill is mostly a disclosed Alibaba Cloud PDS helper, but it is labeled as search while also enabling uploads, downloads, cloud writes, analysis, local writes, persistent CLI changes, and credential-backed access.

Install only if you intend to let the agent use Alibaba Cloud PDS credentials for broad file operations, not just search. Use a least-privilege or short-lived account, review every upload/download destination, avoid sensitive local files unless explicitly chosen, protect CLI config and signed-URL result files, and prefer manual review of CLI/plugin updates before running them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill exposes capabilities for shell execution, network access, and file read/write without declaring permissions, reducing transparency and preventing effective policy enforcement. In an agent setting, this can lead to users or orchestrators authorizing a seemingly harmless search skill that can actually modify the host, fetch remote content, and access local files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared behavior is limited to multimodal search, but the instructions expand into document/video/audio analysis, remote result retrieval, content transformation, and PPTX generation. This mismatch is dangerous because trust decisions may be made based on the manifest while the actual workflow performs broader data access and processing on potentially sensitive cloud-drive content.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: A skill advertised for search also instructs agents to upload and download files, which materially changes its risk profile from read-oriented discovery to data movement. That creates risk of unintended exfiltration, overwrite, or transfer of sensitive enterprise, team, or personal files under a misleading interface.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill extends beyond search into analysis, quick view, and summarization of user files, which can expose sensitive document, audio, and video contents to additional processing paths. Because this is not declared in the manifest, users and control planes may permit the skill under false assumptions about its scope.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill includes installation, plugin updates, and configuration changes unrelated to a simple search workflow, which increases attack surface on the host environment. Requiring system modification in a search skill is especially risky because it normalizes privileged changes that users would not expect from the stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Installing an extra Python dependency for multipart upload is unrelated to the declared search functionality and silently broadens the runtime environment. Even a common package install can introduce supply-chain risk and enables capabilities beyond what the user consented to for a search task.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The document materially expands a search skill into file download behavior, including obtaining signed download URLs and writing files locally. This scope creep is dangerous because an agent or user may treat the skill as search-only while being guided into data exfiltration or unintended local file retrieval workflows.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The documentation presents non-search commands under the multimodal-search skill branding, which can mislead downstream agents into believing download-related operations are within the approved capability set. That increases the risk of policy bypass, over-broad tool use, and accidental execution of data-access actions beyond the skill’s declared purpose.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This document adds file-upload and remote directory-creation procedures to a skill whose declared purpose and triggers are limited to search. That scope mismatch is dangerous because an agent or operator may invoke data-modifying actions under the guise of a read-only/search capability, enabling unintended exfiltration of local files and unauthorized changes to remote storage.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Documenting local file upload in a multimodal search skill expands the effective capability from search to data exfiltration. In this context, the mismatch is especially risky because users and orchestrators may trust the skill as search-only while it provides commands that transmit local file contents and metadata to a remote PDS service.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The directory traversal and create-file steps teach the skill how to create remote folders, which is unrelated to a declared search-only scope and introduces state-changing behavior. This increases the blast radius from information retrieval to remote modification, making misuse or accidental alteration of cloud storage more likely.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The guide expands a search workflow into a write operation by directing the agent to upload a user-provided local image into system drive space before searching. This creates an unintended data-ingestion path that can persist user content in cloud storage, exceeding the manifest's apparent search-only scope and increasing privacy, retention, and authorization risk.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: The file implements document/video analysis polling, which exceeds the declared skill scope of filename and image search. Scope drift is dangerous because users and policy systems may grant this skill permissions appropriate for search while the code performs richer content-analysis operations that can expose or process sensitive document contents unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The code persists raw analysis results, including signed URLs, to local storage even though the skill is described as performing search operations. Writing sensitive analysis metadata to disk broadens the data exposure surface, especially in shared or multi-tenant environments where /tmp contents may be accessible to other processes or retained longer than expected.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide provides concrete examples for supplying long-lived access keys via command-line flags and environment variables, but it does not warn that secrets passed on the CLI may be captured in shell history, process listings, CI logs, or agent telemetry. In an agent/automation context, this is more dangerous because non-interactive commands are likely to be copied directly into scripts or executed by tools that log inputs, causing credential exposure and persistent compromise of Alibaba Cloud accounts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide explicitly states that the user's token will be preset in the Aliyun CLI configuration file, but it does not warn that this creates locally persisted credentials that may be readable by other local users, captured in backups, or reused by other processes. In an agent-skill context, instructing automated setup of persistent auth without disclosure increases the chance that sensitive tokens are stored on shared or insufficiently secured systems.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The download examples write to a local output filename without warning about overwrite risk, path safety, or use of a controlled destination. In an agent setting, this can lead to clobbering existing files, writing sensitive content into unsafe locations, or enabling user-controlled filename/path misuse if parameters are templated unsafely.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation explicitly recommends saving raw JSON results that contain signed URLs, but does not warn that these URLs may grant time-limited access to potentially sensitive derived content. In an agent skill context, this is more dangerous because logs, artifacts, or shared workspaces may inadvertently expose those URLs to other users or systems before expiration.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The formatter behavior automatically downloads content from signed URLs without any privacy, egress, or trust-boundary warning. In a skill setting, this can cause unintended network transmission of sensitive analysis outputs and may fetch remote content into the agent environment without operator awareness, increasing exposure of confidential files and metadata.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guide instructs uploading a local path without prominently warning that file contents, filenames, hashes, and related metadata will be sent to a remote cloud service. In an agent setting, that omission can cause users to expose sensitive local data without informed consent, especially because the surrounding skill is framed as a search tool rather than a transfer tool.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation states that `check-name-mode` defaults to `ignore` and describes it as overwrite behavior, but does not prominently warn that existing cloud files may be replaced. This can lead to silent data loss or corruption if an agent follows defaults during an upload to a path containing a file with the same name.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The instructions tell the agent to upload a local image into system space without an explicit warning that this writes user data to remote cloud storage. In an agent setting, this is dangerous because users may believe they are performing a read-only search while the skill silently transfers and stores potentially sensitive local content.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The function issues requests to arbitrary URLs taken from result data with no host allowlist, scheme restriction, or provenance check. If an attacker can influence the JSON input, this can enable server-side request forgery behavior, unexpected external network access, and retrieval of internal or sensitive resources depending on the execution environment.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script fetches a remote JSON document from a URL embedded in the input data without validating the destination or warning the user. If an attacker can control the input JSON, this can trigger unintended outbound requests to arbitrary hosts, enabling SSRF-style behavior, internal network probing, or unexpected data egress from the execution environment.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The image download helper retrieves arbitrary URLs supplied indirectly by the input JSON and stores the response in memory. In a hostile environment, this enables attacker-directed outbound requests and can be abused for SSRF or resource exhaustion if very large responses are returned, especially because there is no host restriction, content-type validation, or size limit.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.