alibabacloud-remote-skills-connector

• Outcome: Pass
• Latest audit: Jul 27, 2026 · 7:25 AM UTC
• Version: 0.0.1

Overview

This skill is a disclosed Alibaba Cloud remote-agent connector with sensitive but purpose-aligned credential, network, and local state handling.

Install only if you intend to let an Alibaba Cloud hosted remote agent handle cloud tasks using your selected Alibaba credentials. Prefer OAuth or an existing aliyun CLI profile over manually storing an AccessKeySecret, review any approval page carefully, and do not put secrets in task messages.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill instructs the agent to use shell, filesystem, environment, and network capabilities extensively, but no explicit permission model is declared. In a remote-connector skill that can authenticate, discover agents, send messages, and invoke local commands, this creates a large implicit trust boundary and increases the risk of unintended command execution or data exposure if the skill is misused or the implementation diverges from the documented constraints.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This file adds local profile and credential onboarding behavior for AccessKey and OAuth profiles, which extends beyond the connector manifest’s stated role of interacting with hosted Alibaba Cloud remote skills. Even if intended for setup convenience, collecting credentials and writing them to local config expands the trust boundary and creates a path for misuse, especially in an agent-related runtime where users may assume only remote connector actions are performed.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code directly prompts for an AccessKeySecret and persists it locally via save_agenthub_profile, creating clear secret-handling responsibility inside the skill runtime. Although it avoids echoing the secret and checks for an interactive TTY, this still increases exposure to credential theft, accidental persistence, or abuse if the component is invoked in an unexpected context or if the local config protection is weak.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Hard Boundaries

- Never call a local Alibaba Cloud product CLI, SDK, OpenAPI, Terraform, ROS, or shell script to operate cloud resources.
- Preserve the user's original text in execution messages sent to a remote Agent. Except when splitting a multi-product request, do not summarize, translate, polish, add background, add resource IDs, or rewrite it.
- If the user explicitly says "send the following content to the remote Agent: ...", send only the exact text after that boundary. Otherwise, send the user's complete original request.
- Never place a keyword or message in command-line arguments, environment variables, arbitrary file paths, or heredocs. Use only managed input IDs or real process stdin.
- Never display or ask the user to paste an AccessKey, Secret, STS Token, OAuth token, verification code, Cookie, Authorization header, or password.

• Confidence: 77% confidence
• Finding: write it. - If the user explicitly says "send the following content to the remote Agent: ...", send only the exact text after that boundary. Otherwise, send the user's complete original request. - Nev

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.