Security audit

Alibabacloud Pds Multimodal Search

Security checks for vulnerabilities and agentic risk

Overview

This search-labeled skill is not clearly malicious, but it needs Review because it can install/update local tools, use persistent cloud credentials, and upload, download, and analyze PDS files beyond simple search.

Review before installing. Use this only in an environment where Aliyun CLI and the PDS plugin are already installed from verified sources, avoid curl-pipe-to-bash and global plugin updates, use least-privilege temporary credentials, and require explicit approval before uploading local files, downloading PDS files, saving signed analysis results, or generating local output files.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:68
Finding: Mutable Remote Installation Scripts Are Executed Directly by Bash
Content: View full analysis
= 3.3.3 ``` ### Technical Analysis The installation instructions download mutable shell scripts from external URLs and pipe their contents directly into Bash. The downloaded payload is neither version-pinned nor verified using a cryptographic signature or checksum before execution. HTTPS provides transport protection but does not establish that the remote script is immutable or safe. The effective code can change after this Skill has been reviewed. A compromise of the hosting infrastructure, CDN, DNS resolution path, vendor account, or publication pipeline could therefore turn the documented installation command into arbitrary code execution. The command executes with all privileges available to the user running the Skill. If the Agent or user runs the command from a privileged account, the remote payload obtains those elevated privileges. This behavior is not necessary for the declared PDS search and analysis functionality. The Skill can instead require a preinstalled, explicitly versioned Aliyun CLI or use a verified package installation process. ### Attack Path 1. An attacker compromises the remote script, its publication pipeline, the hosting account, or a relevant delivery component. 2. The response at `setup.sh` or `install.sh` is changed to include attacker-controlled shell commands. 3. A user or Agent follows the Skill's installation instructions. 4. `curl` downloads the modified script and sends it directly to Bash without an inspection or verification boundary. 5. Bash executes the payload with the invoking user's permission ...[truncated 719 chars]
Remediation: View remediation
aliyun-cli.tgz" | sha256sum -c - tar -tzf aliyun-cli.tgz ``` Installation should proceed only after successful integrity verification. ]]>

T08 · Insecure Dependencies

Error

Location: SKILL.md:78
Finding: Mandatory Automatic Plugin Installation and Unpinned Global Plugin Updates
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/cli-installation-guide.md:41
Finding: Unversioned and Unverified CLI Archives Are Installed into a Privileged Executable Path
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/doc_analysis_formatter.py:19
Finding: Unrestricted URL Fetching Permits Server-Side Request Forgery and Resource Exhaustion
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/cli-installation-guide.md:104
Finding: Credential Configuration Guide Exposes Secrets Through Command-Line Arguments
Content: View full analysis
\ --access-key-secret \ --region cn-hangzhou ``` The guide explicitly recommends this pattern for automation: ```text All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` It also provides repeated Access Key and STS examples: ```bash aliyun configure set \ --mode StsToken \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --sts-token v1.0:XXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` ### Technical Analysis Supplying access-key secrets and STS tokens through command-line flags can expose them through shell history, process inspection, terminal recording, CI/CD logs, debug logs, command auditing, or Agent transcripts. The recommendation is particularly dangerous in “agent-driven automation,” where commands may be retained by orchestration infrastructure. It also directly conflicts with the top-level requirements in `SKILL.md:109-111`, which prohibit asking users for AK/SK values and prohibit using `aliyun configure set` to configure plaintext credentials. The example values appear to be placeholders rather than confirmed live credentials. The vulnerability is the recommended handling method, not a hardcoded active secret. ### Attack Path 1. A user follows the reference guide and substitutes real credentials into the documented command. 2. The shell records the command in history, or the automation platform records it in logs or transcripts. 3. While t ...[truncated 877 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (61)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: Formatting and downloading signed analysis outputs, transcripts, or media metadata goes beyond simple search and can expose sensitive derived content. The danger is amplified because users may invoke a 'search' skill expecting low-risk lookup behavior, not remote retrieval and local processing of analysis results.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Formatting and downloading signed analysis outputs, transcripts, or media metadata goes beyond simple search and can expose sensitive derived content. The danger is amplified because users may invoke a 'search' skill expecting low-risk lookup behavior, not remote retrieval and local processing of analysis results.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Formatting and downloading signed analysis outputs, transcripts, or media metadata goes beyond simple search and can expose sensitive derived content. The danger is amplified because users may invoke a 'search' skill expecting low-risk lookup behavior, not remote retrieval and local processing of analysis results.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Formatting and downloading signed analysis outputs, transcripts, or media metadata goes beyond simple search and can expose sensitive derived content. The danger is amplified because users may invoke a 'search' skill expecting low-risk lookup behavior, not remote retrieval and local processing of analysis results.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Formatting and downloading signed analysis outputs, transcripts, or media metadata goes beyond simple search and can expose sensitive derived content. The danger is amplified because users may invoke a 'search' skill expecting low-risk lookup behavior, not remote retrieval and local processing of analysis results.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Formatting and downloading signed analysis outputs, transcripts, or media metadata goes beyond simple search and can expose sensitive derived content. The danger is amplified because users may invoke a 'search' skill expecting low-risk lookup behavior, not remote retrieval and local processing of analysis results.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Formatting and downloading signed analysis outputs, transcripts, or media metadata goes beyond simple search and can expose sensitive derived content. The danger is amplified because users may invoke a 'search' skill expecting low-risk lookup behavior, not remote retrieval and local processing of analysis results.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Formatting and downloading signed analysis outputs, transcripts, or media metadata goes beyond simple search and can expose sensitive derived content. The danger is amplified because users may invoke a 'search' skill expecting low-risk lookup behavior, not remote retrieval and local processing of analysis results.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is presented as search-only, but the instructions explicitly include upload, download, and cloud analysis operations. That is a direct scope expansion: users authorizing a search skill may unknowingly permit modification, data movement, and broader processing across storage spaces.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The instruction to fetch a remote script and pipe it directly to bash is a classic supply-chain risk. It executes code from the network without prior verification, so compromise of the hosting endpoint, TLS interception, or content changes could lead to arbitrary code execution on the local machine.
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
> ``` > > If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update, > or see `references/cli-installation-guide.md` for installation instructions. > > Verify PDS plugin version:

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: This second remote install command has the same core issue: it retrieves executable content from the internet and runs it immediately. In the context of a search skill, that behavior is especially unjustified and materially increases the risk of arbitrary code execution and host compromise.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
bash
# Install Aliyun CLI (if not installed) curl -fsSL --max-time 10 https://aliyuncli.alicdn.com/install.sh | bash aliyun version # confirm >= 3.3.3 # Enable auto plugin installation

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The | bash chaining pattern is dangerous because it turns network data into immediate code execution with no validation or user review step. This is particularly risky in agent workflows, where users may not realize a nominally benign search skill is instructing shell execution of remote content.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
bash
# Install Aliyun CLI (if not installed) curl -fsSL --max-time 10 https://aliyuncli.alicdn.com/install.sh | bash aliyun version # confirm >= 3.3.3 # Enable auto plugin installation

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The guide normalizes storing a user's token in the Aliyun CLI configuration file without any warning about secure storage, filesystem permissions, or token lifecycle. Credentials persisted in plaintext or weakly protected local config can be recovered by other local users, malware, logs, backups, or support tooling, enabling unauthorized access to PDS resources.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented behavior materially expands the skill from search into file retrieval and local write operations, which is inconsistent with the stated manifest purpose. This creates a capability-confusion risk where an invoking agent or user may authorize a search skill but unknowingly enable exfiltration of remote file contents to the local environment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file materially expands a search-focused skill into a remote write capability by documenting file uploads and cloud directory creation. In an agent setting, that mismatch can cause the system to perform high-impact side effects—uploading local files and altering remote storage—when the user or integrator expects read-only search behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented workflow includes create-file and upload-file operations that can modify remote PDS contents and exfiltrate local data, despite the skill being presented as a multimodal search capability. Because the instructions include step-by-step directory creation and upload flows, an agent could be induced to take unauthorized write actions under a misleading, lower-risk skill identity.
Content: No source excerpt is available for this finding.

Instruction Override

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · scripts/get_semantic_query_prompt.py (reported line 27)May include surrounding context.
python
### When to mark a query as non-semantic (`valid: false`) If the query is only about file metadata or attributes, you must ignore it and mark it as invalid. This includes, but is not limited to: - Specific file attributes such as size, type, creation date, modification date, filename, or path - Exact-match or range filters on attributes

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a skill for exact/fuzzy filename search, semantic file search, and image-to-image search, but this file is dedicated to polling PDS document/video analysis jobs via aliyun pds process with doc/analysis or video/analysis. That behavior is materially different from search and extends into analysis-task orchestration and local result persistence.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file implements PPT extraction and PPTX generation from video-analysis output, which is materially outside the manifested multimodal search behavior. Capability drift is dangerous because it introduces hidden functionality that processes remote content and writes Office documents, expanding the attack surface beyond what reviewers and users would expect from a search skill.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: Pillow==12.1.1 — 16 advisory(ies): CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`); CVE-2026-55798 (Pillow: WindowsViewer.get_command() OS command injection via unescaped shell pat); CVE-2026-54060 (Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_) +13 more

High

Category: Supply Chain
Confidence: 91% confidence
Finding: The requirements file pins Pillow to 12.1.1, which the scanner associates with numerous advisories, including issues relevant to image parsing and platform-specific command execution. Because this skill explicitly performs image-based search, it is more exposed to malformed or adversarial image inputs, making image library vulnerabilities particularly relevant and potentially serious.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares broad operational behavior involving shell, network, file reads, and file writes, but provides no explicit tool scoping or permission boundaries. In an agent environment, that omission increases the chance that a seemingly search-oriented skill can perform higher-risk actions such as local modification, downloads, or credential-adjacent operations without clear containment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs local system modification, plugin updates, and environment changes that are not justified by a narrowly scoped search task. Such setup steps increase supply-chain and integrity risks, especially when they alter the host environment or enable automatic plugin behavior in order to run the skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Credential setup guidance and local dependency installation extend beyond the expected trust boundary of a search workflow. In agent settings, instructions that normalize environment reconfiguration and package installation can lead to unnecessary exposure of secrets, host drift, or execution of unreviewed components.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.
md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.
md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version