Security audit

alibabacloud-rocketmq-inspection

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly aligned with read-only RocketMQ inspection, but its setup changes the host Aliyun CLI environment through global auto-plugin installation and updates.

Install only if you are comfortable with the skill changing the local Aliyun CLI plugin environment. Prefer running it in a dedicated shell/container or workstation profile with read-only RAM permissions, review any Aliyun CLI installer/plugin update before use, and avoid granting write or wildcard cloud permissions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill claims to be a read-only RocketMQ inspection tool, but it also directs users to change local CLI configuration, auto-install plugins, and create persistent local files. Those side effects broaden the trust boundary from cloud-read-only inspection to host modification, which can surprise users and increase supply-chain and local-environment risk.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The documentation instructs downloading and executing an external installer script via curl|bash-style workflow and enabling automatic plugin installation globally. This creates a software supply-chain risk and expands the skill's effective capability far beyond read-only RocketMQ inspection, because future plugin resolution and updates may execute unreviewed code on the host.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The script explicitly states it will auto-install Aliyun CLI plugins on first run, which modifies the local environment despite the skill being presented as a read-only inspection tool. Automatic installation pulls and executes additional code/plugins from outside the script without an explicit user confirmation step, increasing supply-chain and unexpected side-effect risk.

Description-Behavior Mismatch

Medium

Confidence: 99% confidence
Finding: This loop attempts to install missing aliyun CLI plugins by invoking commands with `--auto-plugin-install true`, causing writes under `~/.aliyun/plugins`. In a supposedly inspection-only skill, that behavior creates hidden side effects and can expose users to unreviewed plugin code execution or supply-chain compromise if the plugin source or resolution path is abused.

Missing User Warnings

Low

Confidence: 77% confidence
Finding: The skill asks the operator to run shell commands and permits local file creation/modification without a prominent warning that the host environment will be changed. While the changes appear operational rather than overtly malicious, insufficient disclosure can lead to unintended configuration drift or execution of setup steps in sensitive environments.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.