alibabacloud-sas-log-to-oss

• Outcome: Review
• Latest audit: Aug 6, 2026 · 1:57 AM UTC
• Version: 0.0.1

Overview

The skill matches its Alibaba Cloud log-archival purpose, but it needs review because it can install/update external CLI code and create, stop, or delete cloud log export jobs using sensitive cloud credentials.

Install only if you are comfortable letting the agent manage Alibaba Cloud SLS export tasks. Use a tightly scoped RAM user or temporary credentials, confirm the exact SLS project, LogStores, OSS bucket, region, encryption, retention, and access policy before creating exports, and be especially careful with delete or --force because it can stop future log archival. Prefer a verified package-manager or manually reviewed CLI installation path over curl-to-bash and automatic plugin updates.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill requires access to sensitive environment variables such as Alibaba Cloud credentials and account ID, but no declared permissions boundary is present. This creates an authorization gap where the agent may access secrets beyond what is explicitly documented or approved, increasing the risk of unintended credential use in a cloud-administration workflow.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The referenced document is materially misaligned with the skill's stated purpose of automating SLS log export to OSS for archival. Instead of covering export-task creation, management, and secure archival patterns, it teaches generic bucket creation and file handling, which can mislead an agent into performing unrelated storage operations and omitting required controls for log-shipping workflows.

Context-Inappropriate Capability

Low

• Confidence: 90% confidence
• Finding: Including instructions for generating temporary file-sharing URLs introduces a capability outside the stated cold-storage archival use case. In a security-log backup context, this can normalize ad hoc access and increase the chance that archived logs or related objects are exposed through shareable links, even if time-limited.

Context-Inappropriate Capability

Low

• Confidence: 92% confidence
• Finding: Manual upload and download instructions are unrelated to automated SLS log export and broaden the skill's operational scope unnecessarily. In practice, this can cause an agent or operator to validate workflows with arbitrary files, bypassing the real export pipeline and increasing the risk of handling the wrong data or misconfiguring archival processes.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger list contains broad phrases like 'delete export task', 'cleanup export task', and generic 'SLS'/'OSS' terms that can activate the skill for requests outside its narrow intended scope. In a skill capable of stopping or deleting cloud export jobs, overbroad invocation increases the chance of accidental destructive actions or misrouting user requests to the wrong automation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill includes delete and force-delete commands for export tasks without a strong inline warning that these actions are destructive and may immediately terminate log archival workflows. Although it notes that OSS data is not deleted, it does not clearly require explicit user confirmation or explain the operational impact of removing export tasks.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide instructs users to execute a remote script directly via curl piped to bash, which bypasses review and integrity verification of downloaded code. If the distribution endpoint, TLS trust chain, or hosting infrastructure were compromised, this could lead to arbitrary code execution on the operator's machine.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The credential setup examples prominently encourage use of long-lived AccessKey credentials without immediately warning that they are sensitive secrets stored locally in configuration. In an automation skill context, this increases the risk of credential persistence, accidental disclosure, and overuse of static credentials where safer ephemeral methods may exist.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation lists `delete-export` as a supported command, including a `--force` option, but does not warn that deleting an OSS export task can permanently stop log archival workflows and may disrupt retention, compliance, or incident-response visibility. In a skill specifically designed to manage security log backup/export, omission of a deletion-impact warning increases the chance of accidental destructive use by an operator or downstream agent.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The `create-export` and `batch-create` commands move potentially sensitive logs from SLS into OSS, but the documentation does not warn about privacy, data-classification, cross-boundary transfer, retention, or bucket-access implications. Because this skill is explicitly for log archival and Security Center backup, exported data may contain security telemetry or sensitive identifiers, so missing safeguards can lead to inadvertent exposure or noncompliant storage.

Self-Modification

High

• Category: Rogue Agent

Content

**Pre-check: Aliyun CLI >= 3.3.3 required**
> [MUST] Verify: `aliyun version` — must be >= 3.3.3.
> - **First install or major upgrade:** `/bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh)"`
> - **Routine update (CLI >= 3.3.5):** `aliyun upgrade` — prefer this built-in self-update over re-running the install script.
> - See [references/cli-installation-guide.md](references/cli-installation-guide.md) for full installation instructions.

**Pre-check: Aliyun CLI plugin update required**

• Confidence: 96% confidence
• Finding: self-update

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.