Security audit

Alibabacloud Resourcecenter Search

Security checks for vulnerabilities and agentic risk

Overview

The skill looks like a legitimate Alibaba Cloud Resource Center helper, but it needs Review because it asks users to run unverified installer code and make broad, persistent CLI plugin/configuration changes around cloud credentials and admin actions.

Review this before installing. Prefer a preinstalled, audited Aliyun CLI; do not run the `curl | bash` installer from an agent session; avoid enabling global auto-plugin installation; use read-only Resource Center permissions for inventory; and configure credentials outside the agent with short-lived or role-based credentials where possible.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:24
Finding: Unverified Remote Installation Script Executed Directly by Bash
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 24-26
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

text
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see `references/cli-installation-guide.md` for installation instructions.

Technical Analysis

The installation command streams a mutable response from an external URL directly into bash. The payload is not pinned to an immutable release, saved for inspection, or verified using a cryptographic signature or trusted checksum.

Although the URL appears to be an Alibaba Cloud distribution domain, domain ownership alone does not guarantee that every future response will be safe. Compromise of the origin, CDN, DNS path, TLS termination infrastructure, or release process could change the effective code after this Skill has been reviewed.

Executing a network response directly also prevents users from meaningfully reviewing the installer before execution. This behavior is unnecessary for the Skill's resource inventory functionality because package-manager installation or a verified, versioned binary can provide the required CLI without creating a direct remote code-execution channel.

Attack Path

An attacker compromises the installation origin, CDN, DNS resolution path, or upstream release process.

The attacker modifies setup.sh to contain malicious shell commands.

A user or agent follows the prerequisite instructions because Aliyun CLI is absent or outdated.

curl retrieves the attacker-controlled response and immediately passes it to bash.

The payload executes with the privileges of the user running the Skill.

The payload can inspect local files and environment variables, alter executables or configuration, establish persistence where permitted ...[truncated 643 chars]
Remediation: View remediation
Remediation Suggestions

Remove the curl | bash installation path.

Prefer a trusted operating-system package manager with a version constraint.

If direct binary installation is required:

Pin an explicit CLI version rather than using a mutable “latest” artifact.

Download the archive to a local file.

Retrieve the expected checksum or signature through a separately authenticated channel.

Verify the artifact before extraction or execution.

Present the source and verification result to the user before installation.

Do not perform installation automatically from an agent session; request explicit user approval.

Run installation with ordinary user privileges wherever possible and avoid unnecessary sudo execution.

Document the expected publisher, version, checksum algorithm, and signature-verification procedure.

T08 · Insecure Dependencies

Error

Location: SKILL.md:27
Finding: Mandatory Automatic Plugin Installation and Unscoped Plugin Updates
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 27-28
Vulnerability Type: Insecure dependency and plugin management
Risk Level: High

Vulnerable Code

text
> Then **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > Then **[MUST]** run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

Technical Analysis

These instructions persistently enable automatic plugin installation and require updating every existing local plugin. Plugin versions and artifact hashes are not pinned, and the update is not limited to the Resource Center component needed by this Skill.

Automatically retrieving mutable executable components expands the supply-chain trust boundary. Updating unrelated plugins exceeds the minimum changes necessary for resource inventory and may alter otherwise stable components on the user's machine. Persistent automatic installation also allows future CLI invocations to retrieve code without a separate review or confirmation step.

This finding does not establish that an existing plugin is malicious. The vulnerability is the unbounded, mutable dependency acquisition mechanism and the unnecessary modification of unrelated local dependencies.

Attack Path

An attacker compromises a plugin publication account, repository, distribution service, or upstream build pipeline.

A malicious or tampered plugin version becomes available through the configured plugin source.

The user follows the mandatory instructions, enabling automatic installation and updating existing plugins.

The CLI retrieves the compromised component without a Skill-defined version or integrity constraint.

The plugin is subsequently loaded or executed by a legitimate-looking Aliyun CLI invocation.

Malicious plugin code operates with the local privileges and cloud identity available to the CLI proce ...[truncated 546 chars]
Remediation: View remediation
Remediation Suggestions

Do not globally enable automatic plugin installation.

Determine whether the Resource Center plugin is already present before making changes.

Install only the specific plugin required for this Skill.

Pin the plugin to an explicitly reviewed version and verify its publisher, signature, or cryptographic checksum.

Do not update unrelated plugins as part of this Skill.

Obtain explicit user approval before installing or updating executable dependencies.

If a configuration setting is temporarily changed, record its previous value and restore it at every exit path.

Prefer a pre-provisioned, audited CLI environment for agent execution.

T09 · Insecure Skill Coding Practices

Warning

Location: references/cli-installation-guide.md:103
Finding: Long-Lived Cloud Credentials Recommended as Command-Line Arguments
Content: View full analysis
Vulnerability Details

File Location: references/cli-installation-guide.md, lines 103-108
Vulnerability Type: Insecure credential handling
Risk Level: Medium

Vulnerable Code

bash
aliyun configure set \ --mode AK \ --access-key-id <your-access-key-id> \ --access-key-secret <your-access-key-secret> \ --region cn-hangzhou

Technical Analysis

The linked installation guide recommends supplying an access-key identifier and secret directly as command-line arguments. Depending on the operating system and execution environment, command arguments may be exposed through:

Shell history.

Terminal or session recording.

CI/CD and agent execution logs.

Process inspection tools.

Error reports, debugging output, or copied command transcripts.

The same guide documents storage in ~/.aliyun/config.json, while later recommending restrictive permissions. This approach creates greater exposure than short-lived identity mechanisms such as STS, OAuth, or attached instance roles.

The guidance also conflicts with the stronger rules in SKILL.md, which prohibit asking users to provide access keys in the conversation or command line. Because SKILL.md directly links to this guide as an installation alternative, users may still follow the insecure examples.

Attack Path

A user follows the quick-start command and replaces the placeholders with real long-lived credentials.

The shell, terminal recorder, CI system, agent framework, or process monitor records the complete command.

A local user, log reader, support operator, or attacker with access to those records obtains the access key and secret.

The attacker configures another client with the stolen credentials.

The attacker invokes Alibaba Cloud APIs within the permissions granted to that identity and continues until the credentials are revoked or expire.

Impact Assessment

The impact is bounde ...[truncated 636 chars]
Remediation: View remediation
Remediation Suggestions

Remove examples that place secrets directly in command-line arguments.

Align the guide with SKILL.md: credential configuration must occur outside the agent conversation and must not expose secret values to the agent.

Prefer, in order:

ECS RAM roles or workload identity where available.

OAuth or another interactive identity mechanism.

Short-lived STS credentials with narrowly scoped permissions.

Long-lived access keys only as a last resort.

Use a secure interactive prompt or protected secret manager that does not echo or log secret values.

Ensure ~/.aliyun/config.json has permissions no broader than 0600.

Disable command history temporarily when sensitive command entry cannot be avoided, and ensure agent and CI logs redact relevant values.

Add instructions for immediate credential rotation if a secret appears in history, logs, transcripts, or process-monitoring output.

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/ram-policies.md:5
Finding: Destructive Disable Permission Included in the Claimed Minimum Inventory Policy
Content: View full analysis
Vulnerability Details

File Location: references/ram-policies.md, lines 5-12
Vulnerability Type: Excessive cloud permissions and least-privilege violation
Risk Level: Medium

Vulnerable Code

text
### Single Account Operations The following are the minimum RAM permissions required for single-account resource search and inventory: `resourcecenter:EnableResourceCenter` `resourcecenter:DisableResourceCenter` `resourcecenter:GetResourceConfiguration` `tag:ListTagKeys` `tag:ListTagValues`

Technical Analysis

The policy describes resourcecenter:DisableResourceCenter as a minimum permission for single-account search and inventory. Disabling a service is an administrative, destructive operation and is not needed to search resources, retrieve configurations, or list tags.

The Skill declares enable and disable functionality, and SKILL.md requires explicit confirmation before disabling Resource Center. Those safeguards reduce accidental use but do not make disable permission necessary for ordinary inventory workflows. If the identity is compromised or the confirmation process is bypassed, the pre-granted permission is immediately available.

The same section also combines service activation with routine read operations. This prevents administrators from granting a genuinely read-only default role and violates the principle of least privilege.

Attack Path

An administrator follows the documented “minimum” policy for an inventory-only user or agent.

The resulting RAM identity receives resourcecenter:DisableResourceCenter.

The local session, agent, or credentials are compromised, or an erroneous workflow invokes the disable API.

The attacker or faulty process calls DisableResourceCenter using the unnecessarily granted permission.

Resource Center visibility and dependent workflows are disrupted within the affected account.

Impact Assessment

This permission doe ...[truncated 664 chars]
Remediation: View remediation
Remediation Suggestions

Redefine the default inventory policy as strictly read-only.

Remove DisableResourceCenter and EnableResourceCenter from the claimed minimum search and inventory permissions.

Create separate policies for:

Routine resource search, statistics, configuration retrieval, and tag discovery.

One-time service activation.

Service disablement.

Cross-account administration.

Grant activation or disablement permissions temporarily and only after explicit approval.

Use separate identities or profiles for read-only inventory and administrative workflows.

Retain the existing high-risk confirmation requirement, but treat it as defense in depth rather than a substitute for access control.

Review product-specific read permissions as well, since Resource Center result visibility inherits permissions from the underlying cloud products.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (75)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description promises a broad Resource Center skill for inventory, search, statistics, and service control. The code only lists available resource types and filters them locally by keyword across ResourceType, ProductName, and ResourceTypeName. This is related to Resource Center, but it is a materially narrower purpose than declared. The only overlap is that it supports a limited form of resource-type lookup, which could assist resource search indirectly, but it does not implement the main advertised capabilities.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The instruction to run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash executes a remotely fetched script directly in the shell without verification, which is a classic supply-chain and remote code execution risk. This danger is amplified because the same skill also requires enabling auto-plugin installation and updating plugins, expanding trust to additional remote code sources.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
md
> **Pre-check: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see `references/cli-installation-guide.md` for installation instructions. > Then **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > Then **[MUST]** run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill clearly instructs execution of multiple shell commands (aliyun, curl | bash, plugin updates) but does not declare any explicit tool scope or allowed-tools boundaries. Missing scope controls increase the chance that an agent or runtime will execute broader shell actions than intended, which is risky in a skill that can install software and change CLI configuration.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.
md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.
md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.
md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.
Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text
### Windows

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document shows non-interactive commands that place access key material directly on the command line, which can leak via shell history, terminal logging, audit trails, or process inspection. It also normalizes storing long-lived secrets in local config without an immediate warning about exposure and safer alternatives.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.
md
1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once ### Configuration Modes

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The environment variable examples expose cloud credentials to child processes, debugging tools, CI logs, crash dumps, and shared shell sessions if mishandled. Without an explicit warning, users may adopt this pattern in automation contexts where secrets are easily inherited or printed.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.
bash
# Restrict permissions chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The guide for a Resource Center skill expands into installing arbitrary Alibaba Cloud product plugins and exploring unrelated product commands such as ECS and Function Compute. In an agent or operator context, this broadens operational scope beyond the stated skill purpose and can encourage use of extra capabilities with broader permissions than necessary.
Content: No source excerpt is available for this finding.

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/error-codes.md (reported line 4)May include surrounding context.
md
# Resource Center API error codes | StatusCode | Code | Message | | ---------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 400 | DependencyViolation.Config | ResourceCenter cannot be disabled, because the Config has been enabled. | | 400 | DependencyViolation.ResourceGroup | Unable to disable resource center while associate transfer is enabled. |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/error-codes.md (reported line 6)May include surrounding context.
md
# Resource Center API error codes | StatusCode | Code | Message | | ---------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 400 | DependencyViolation.Config | ResourceCenter cannot be disabled, because the Config has been enabled. | | 400 | DependencyViolation.ResourceGroup | Unable to disable resource center while associate transfer is enabled. |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/error-codes.md (reported line 7)May include surrounding context.
md
# Resource Center API error codes | StatusCode | Code | Message | | ---------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 400 | DependencyViolation.Config | ResourceCenter cannot be disabled, because the Config has been enabled. | | 400 | DependencyViolation.ResourceGroup | Unable to disable resource center while associate transfer is enabled. |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/error-codes.md (reported line 8)May include surrounding context.
md
# Resource Center API error codes | StatusCode | Code | Message | | ---------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 400 | DependencyViolation.Config | ResourceCenter cannot be disabled, because the Config has been enabled. | | 400 | DependencyViolation.ResourceGroup | Unable to disable resource center while associate transfer is enabled. |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/error-codes.md (reported line 9)May include surrounding context.
md
# Resource Center API error codes | StatusCode | Code | Message | | ---------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 400 | DependencyViolation.Config | ResourceCenter cannot be disabled, because the Config has been enabled. | | 400 | DependencyViolation.ResourceGroup | Unable to disable resource center while associate transfer is enabled. |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/error-codes.md (reported line 10)May include surrounding context.
md
# Resource Center API error codes | StatusCode | Code | Message | | ---------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 400 | DependencyViolation.Config | ResourceCenter cannot be disabled, because the Config has been enabled. | | 400 | DependencyViolation.ResourceGroup | Unable to disable resource center while associate transfer is enabled. |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/error-codes.md (reported line 11)May include surrounding context.
md
# Resource Center API error codes | StatusCode | Code | Message | | ---------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 400 | DependencyViolation.Config | ResourceCenter cannot be disabled, because the Config has been enabled. | | 400 | DependencyViolation.ResourceGroup | Unable to disable resource center while associate transfer is enabled. |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/error-codes.md (reported line 12)May include surrounding context.
md
# Resource Center API error codes | StatusCode | Code | Message | | ---------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 400 | DependencyViolation.Config | ResourceCenter cannot be disabled, because the Config has been enabled. | | 400 | DependencyViolation.ResourceGroup | Unable to disable resource center while associate transfer is enabled. |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/error-codes.md (reported line 13)May include surrounding context.
md
# Resource Center API error codes | StatusCode | Code | Message | | ---------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 400 | DependencyViolation.Config | ResourceCenter cannot be disabled, because the Config has been enabled. | | 400 | DependencyViolation.ResourceGroup | Unable to disable resource center while associate transfer is enabled. |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/error-codes.md (reported line 14)May include surrounding context.
md
# Resource Center API error codes | StatusCode | Code | Message | | ---------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 400 | DependencyViolation.Config | ResourceCenter cannot be disabled, because the Config has been enabled. | | 400 | DependencyViolation.ResourceGroup | Unable to disable resource center while associate transfer is enabled. |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/error-codes.md (reported line 15)May include surrounding context.
md
# Resource Center API error codes | StatusCode | Code | Message | | ---------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 400 | DependencyViolation.Config | ResourceCenter cannot be disabled, because the Config has been enabled. | | 400 | DependencyViolation.ResourceGroup | Unable to disable resource center while associate transfer is enabled. |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/error-codes.md (reported line 16)May include surrounding context.
md
# Resource Center API error codes | StatusCode | Code | Message | | ---------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 400 | DependencyViolation.Config | ResourceCenter cannot be disabled, because the Config has been enabled. | | 400 | DependencyViolation.ResourceGroup | Unable to disable resource center while associate transfer is enabled. |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/error-codes.md (reported line 17)May include surrounding context.
md
# Resource Center API error codes | StatusCode | Code | Message | | ---------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 400 | DependencyViolation.Config | ResourceCenter cannot be disabled, because the Config has been enabled. | | 400 | DependencyViolation.ResourceGroup | Unable to disable resource center while associate transfer is enabled. |

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Tp4

External Script Fetching

Undeclared Tool Scope

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Extract and install

Missing User Warnings

Session Persistence

Missing User Warnings

Sudo/Root Execution

Troubleshooting

Context-Inappropriate Capability

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing