alibabacloud-rds-copilot

• Outcome: Review
• Latest audit: Aug 24, 2026 · 3:22 AM UTC
• Version: 0.0.5

Overview

This RDS Copilot skill is purpose-aligned overall, but it asks agents to make host-level CLI, plugin, and credential changes automatically before use.

Install only if you are comfortable with the agent checking and potentially changing your Alibaba Cloud CLI setup, installing or updating the rdsai plugin, and helping configure credentials. Use a dedicated least-privilege RAM user, review any install or sudo command before approval, avoid pasting secrets or sensitive production data into prompts, and override the default region/language/timezone if they do not match your environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The document claims the skill is read-only, but earlier sections instruct the agent to install software, enable plugins, update CLI components, and configure credentials. This mismatch can mislead users and security controls into approving a skill that performs system-modifying actions beyond its stated scope.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill is presented as an RDS Copilot Q&A and troubleshooting assistant, but the embedded workflow expands into host-level package installation, plugin management, and credential setup. This scope expansion increases trust-based risk because users may invoke a seemingly informational skill that can alter the local environment and security posture.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill authorizes autonomous installation and upgrade of local software, including network-fetched installer scripts and package-manager actions, even though its main purpose is interacting with a cloud assistant. This introduces supply-chain and host-integrity risk because execution of fetched installers can modify the system and expand attack surface unnecessarily.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to install, upgrade, and potentially use privileged commands without a clear upfront warning that invoking the skill may change the local system. Users may reasonably expect an assistant skill to answer questions, not alter software, credentials, or machine configuration.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The acceptance criteria instruct the skill to send `Language=zh-CN` and `Timezone=Asia/Shanghai` by default for business API calls without indicating that these values should come from user preference or environment. This can cause unintended disclosure of assumed locale, incorrect language responses, and operational mistakes if users are in other regions or expect a different language context.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The example command hard-codes Chinese language and Shanghai timezone as if they are universally correct, which can steer the agent into forcing a locale the user did not request. In an operations assistant, this may lead to confusing responses, incorrect regional assumptions, and privacy concerns from inferring user location or language preference.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation explicitly instructs sending free-form user queries, SQL text, troubleshooting details, instance identifiers, and operational context to a remote AI service, but it does not warn about privacy, data classification, or the risk of including sensitive database metadata. In an RDS operations skill, users are especially likely to paste production SQL, error logs, hostnames, or account-related details, so the omission materially increases the chance of unintended data disclosure to a third-party processing endpoint.

Context Leakage

High

• Category: Data Exfiltration

Content

--user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}' 2>&1)
echo "$RESULT"

# Extract ConversationId
CONV_ID=$(echo "$RESULT" | grep -oP '"ConversationId":"[^"]+' | head -1 | cut -d'"' -f4)
echo "ConversationId: $CONV_ID"

• Confidence: 89% confidence
• Finding: The verification flow captures the full CLI output into `RESULT` and then echoes it verbatim before extracting and printing the `ConversationId`. In a troubleshooting/operations assistant context, CLI responses may contain sensitive prompts, SQL text, instance identifiers, account metadata, or other conversation context, so logging full output and correlation IDs can leak operationally sensitive data into terminal history, CI logs, or shared support transcripts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Agent Execution Contract

Before calling RDS Copilot, the agent must make the local environment ready by itself whenever command execution is available. Do not ask the user to install CLI or plugins first if the agent can install or upgrade them directly.
If install or upgrade needs network access, sudo, or tool approval, request that approval with the concrete command and continue after approval.

**Hard gate**: Do not execute `aliyun rdsai chat-messages` until all readiness checks pass:

• Confidence: 95% confidence
• Finding: The skill explicitly directs the agent to make the environment ready by itself and not ask the user to install prerequisites first. This encourages autonomous system changes, reducing human review before software installation, plugin enablement, and credential-related actions on the host.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Option 2: Install via PKG package
curl -O https://aliyuncli.alicdn.com/aliyun-cli-latest.pkg
sudo installer -pkg aliyun-cli-latest.pkg -target /

# Option 3: Install via one-click script
/bin/bash -c "$(curl -fsSL https://aliyuncli.alicdn.com/install.sh)"

• Confidence: 93% confidence
• Finding: The skill includes sudo/root-level installation paths and remote-script execution patterns, which can materially affect the host if invoked. In the context of a conversational assistant skill, privileged installation steps substantially increase the blast radius of accidental or unsafe activation.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.