alibabacloud-ros-agent

• Outcome: Review
• Latest audit: Sep 4, 2026 · 5:58 AM UTC
• Version: 0.3.0

Overview

This appears to be a legitimate Alibaba Cloud ROS Agent bridge, but it deserves review because it can drive high-impact cloud workflows and has under-disclosed environment/profile handling in its optional CLI paths.

Install only if you are comfortable letting this skill send infrastructure requests and context to Alibaba Cloud ROS Agent using your selected Alibaba Cloud credentials. Prefer the default code transport or tightly administered local policy; avoid remote CLI mode unless you understand what environment variables and host executor behavior are involved, and use least-privilege RAM permissions limited to ros:StartChat and ros:StopChat as documented.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (26)

Dangerous chain: exec() wrapping compile

Critical

• Category: Dangerous Code Execution

Content

raise RuntimeError("The ROS Agent bridge source shard is unavailable: {}".format(filename)) from exc
    if len(source) > 128 * 1024:
        raise RuntimeError("The ROS Agent bridge source shard exceeds the 128 KiB limit: {}".format(filename))
    exec(compile(source, str(path), "exec"), globals())


for _source_shard in _SOURCE_SHARDS:

• Confidence: 97% confidence
• Finding: The code reads Python source from sibling shard files and executes it with exec(compile(...), globals()), which is arbitrary code execution if those files can be modified or replaced. Although the filenames are fixed and there is a size check, there is no integrity verification, signature check, or safer import boundary, so compromise of the package, workspace, or deployment path leads directly to code execution in the skill process.

Ae1

High

• Category: analysis-evasion

Content

The bridge reads an optional `config.json` beside this `SKILL.md`. If it is absent, the transport defaults to `code`, the endpoint defaults to `ros.aliyuncs.com

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _remote_cli_subprocess_environment(names: Iterable[str], values: Dict[str, str]) -> Dict[str, str]:
    environment = dict(os.environ)
    for name in _validate_remote_cli_forward_env_names(list(names)):
        environment.pop(name, None)
    environment.update(values)

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

prompt = _read_workspace_file(workspace, raw_path, MAX_PROMPT_BYTES, "The prompt file")
    if not prompt.strip():
        raise BridgeError("invalid_input", "The prompt file must not be empty.")
    return prompt


def _load_json_file(workspace: pathlib.Path, raw_path: str, maximum: int, label: str) -> Any:

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

exec() call detected

High

• Category: Dangerous Code Execution

Content

raise RuntimeError("The ROS Agent bridge source shard is unavailable: {}".format(filename)) from exc
    if len(source) > 128 * 1024:
        raise RuntimeError("The ROS Agent bridge source shard exceeds the 128 KiB limit: {}".format(filename))
    exec(compile(source, str(path), "exec"), globals())


for _source_shard in _SOURCE_SHARDS:

• Confidence: 95% confidence
• Finding: The exec() call executes file contents as Python code in the current global namespace, giving the loaded shard full control over the process. In an agent skill that can handle cloud credentials and remote infrastructure operations, this substantially raises risk because any tampering with shard files becomes immediate arbitrary code execution with access to secrets and API capabilities.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents and expects powerful capabilities including shell execution, file read/write, network access, and environment interaction, yet it declares no explicit tool scope or allowlist. In a security-sensitive agent environment, this creates an over-privileged and under-constrained execution surface where the runtime may permit broad operations without a clear policy boundary, increasing the risk of command execution, data exfiltration, or unintended cloud actions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

The returned `transport` is installation policy, not an Agent choice. In an AgentHub-managed ephemeral runtime, if `check` returns `sdk_not_installed`, use the same Python interpreter to install only the exact bundled dependencies from `scripts/requirements.txt` into that ephemeral runtime, without `sudo` or system changes, and then rerun `check` once. This readiness repair does not authorize a transport change, alternative tooling, or credential access. If installation, the repeated `check`, or any other readiness check fails, report the exact error and stop. Never edit `config.json`, propose or attempt another transport, pass a transport override, or fall back to `aliyun_cli` to bypass the failure. Only the user or installation administrator may change this policy outside the infrastructure task, after which a new `check` is required.

Add `--aliyun-path <path>` to `check` or `start` only when the effective credential path requires native aliyun CLI and it is not on `PATH`; the managed job preserves it for later requests. Use the returned credential source and region without asking the user to choose a Profile. Omit `--profile` unless the user explicitly supplied a Profile and local policy did not pin one; never try to override `aliyunCLIProfile`. Never pass credentials on the command line, put them in prompt files, or expose CLI configuration.

## Optional local policy

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

`permissionResponse` records the bounded correlation payload sent by the bridge. For a live Pipeline reentry, require `permissionAck.accepted: true` before reporting acceptance. For a serial or recovered permission, interpret the resumed stream normally and surface any next `inputRequired` event. Treat `permissionWait.status=suspended` with `resumable=true` as a recoverable pause: ask for the decision against the original `inputRequired` and call `respond` on the same job. Treat `permissionRecovered` as continuation of that same job; never start a replacement session.

Never use `continue` to poll a working Pipeline after `respond`. StartChat has no status-query operation, and a new natural-language message is a real Pipeline interrupt. Use only `follow` to observe the original parent SSE. If `respond` returns `input-required`, present and answer that newly visible permission. If it returns only `permission-responded` because other already-presented `pendingPermissions` remain, answer those permissions separately; otherwise keep following the current job. Do not ask the user to choose between `follow` and `continue`.

## Safety and output discipline

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: L240-L250 says all outbound HTTP requests use `AlibabaCloud-Agent-Skills/alibabacloud-ros-agent/{session-id}` and describes generating and reusing a session ID. However, L105 states both transports identify requests with the user-agent segment `AlibabaCloud-Agent-Skills/alibabacloud-ros-agent`, which contradicts the later claim that every outbound request must carry the session-id suffix. This is an active documentation inconsistency about what the bridge actually sends for request identification.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code explicitly supports collecting selected local environment variables and forwarding them into remote Alibaba Cloud CLI execution. Although it blocks obviously secret-looking names, this still creates a data exfiltration channel from the local host to a remote execution context, which exceeds a narrow chat-bridge function and relies on fragile name-based filtering. In the context of a remote infrastructure conversation skill, this is more dangerous because local environment values may reveal internal topology, proxy settings, tenant identifiers, or other sensitive operational metadata.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The code assigns `cn-hangzhou` as the default region when no region is provided from arguments, environment, or profile. This imposes a China-specific locale/region choice automatically, and there is no nearby user opt-in or justification in this file for why that locale default is required.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The formatting logic branches explicitly on `language == "zh"` and otherwise falls back to English, producing user-visible status text in only those two languages. This is a natural-language locale constraint embedded in code, and the file does not show an explicit user opt-in or documented justification for restricting output to these locales.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This code sends prompt content, client context, and attachments to Alibaba Cloud ROS via either network requests or CLI/plugin transport. Because those fields may contain infrastructure details, credentials, internal documents, or sensitive deployment context, transmitting them without a visible warning or consent mechanism is dangerous in the context of a remote infrastructure-conversation skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

command = build_command(args, prompt, client_context, attachments)
    with tempfile.TemporaryFile(mode="w+b") as stderr_file:
        try:
            process = subprocess.Popen(
                command,
                cwd=str(workspace),
                stdin=subprocess.DEVNULL,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The runtime explicitly forwards selected environment variables and transient environment data into worker subprocesses and remote CLI execution flows. In a cloud/infrastructure skill, environment variables commonly contain credentials, session tokens, proxy settings, and other secrets, so forwarding them without prominent warning or strict minimization creates a meaningful risk of credential disclosure or unintended propagation to remote services.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

with log_path.open("ab", buffering=0) as log:
            if os.name != "nt":
                os.chmod(str(log_path), 0o600)
            process = subprocess.Popen(
                command,
                stdin=subprocess.DEVNULL,
                stdout=log,

• Confidence: 81% confidence
• Finding: This worker-spawn path launches a new Python subprocess with an environment derived from request data, including forwarded and transient environment values. In the context of a remote ROS/CLI bridge, allowing request-driven environment injection into worker processes can alter subprocess behavior, redirect credentials, or influence downstream CLI/network actions, expanding the attack surface beyond the stated chat function.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

else:
        command = build_stop_command(job, session_id)
        try:
            completed = subprocess.run(
                command,
                stdin=subprocess.DEVNULL,
                stdout=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This file implements a local authenticated HTTP control plane unrelated to the minimum functionality required to send a single ROS conversation request. Even though it binds to 127.0.0.1 and uses a bearer token, it still adds a durable management surface that can be targeted by local malware, abused by other local processes that obtain the token, or surprise users who expected only a simple CLI interaction.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

ready = False
        try:
            with log_path.open("ab", buffering=0) as log:
                process = subprocess.Popen(
                    command,
                    cwd=str(root),
                    stdin=subprocess.DEVNULL,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

_touch_manager_activity()
    with contextlib.suppress(OSError):
        server.activity_mtime_ns = activity_path.stat().st_mtime_ns
    server.timeout = 0.5
    try:
        while True:
            server.handle_request()

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run_check_command(command: List[str], required: bool = False) -> Optional[subprocess.CompletedProcess]:
    try:
        result = subprocess.run(
            command,
            stdin=subprocess.DEVNULL,
            stdout=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The CLI presents itself mainly as a ROS Agent conversation utility, but it also starts and maintains a persistent local HTTP job manager with control endpoints. That hidden control-plane behavior is security-relevant because users and integrators may not realize the skill opens an additional local service capable of starting, continuing, responding to, and canceling jobs.

compile() call detected

Medium

• Category: Dangerous Code Execution

Content

raise RuntimeError("The ROS Agent bridge source shard is unavailable: {}".format(filename)) from exc
    if len(source) > 128 * 1024:
        raise RuntimeError("The ROS Agent bridge source shard exceeds the 128 KiB limit: {}".format(filename))
    exec(compile(source, str(path), "exec"), globals())


for _source_shard in _SOURCE_SHARDS:

• Confidence: 89% confidence
• Finding: compile() is part of the same dangerous execution chain here: bytes are compiled as code and then immediately executed. By itself compile() is not always unsafe, but in this context it directly enables runtime execution of external file content, so the finding is valid as part of the code-loading design.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: The manifest centers on using ROS Agent StartChat for remote infrastructure conversations, but this code reads ~/.aliyun/config.json, plugin manifests, and environment-based profile settings to derive identity and plugin status. While potentially useful for transport setup, this is a local credential/configuration introspection capability not stated in the manifest.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The code sets a preferred language from the prompt and later surfaces preferredLanguage in results, which can steer language behavior implicitly. Under the language/locale policy, language selection should be user-chosen or clearly opt-in rather than inferred automatically unless explicitly justified.

Static analysis

No suspicious patterns detected.