Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed, read-only Alibaba Cloud SLS data-question workflow that uses credentials to query Context Models and logs, with no evidence of hidden persistence, exfiltration, or destructive behavior.
Install only if you intend the agent to query Alibaba Cloud SLS data. Use a dedicated Python environment and least-privilege read-only Alibaba Cloud credentials, and avoid running it against projects or logstores containing data the agent should not inspect.
The skill's declared purpose is end-user business QA, but the instructions spend significant effort on retrieving model metadata and catalog structure. That mismatch increases the chance of unreviewed information disclosure because the skill can reveal semantic-layer details not obviously needed by users who only requested business answers.
The skill's declared purpose is end-user business QA, but the instructions spend significant effort on retrieving model metadata and catalog structure. That mismatch increases the chance of unreviewed information disclosure because the skill can reveal semantic-layer details not obviously needed by users who only requested business answers.
The skill's declared purpose is end-user business QA, but the instructions spend significant effort on retrieving model metadata and catalog structure. That mismatch increases the chance of unreviewed information disclosure because the skill can reveal semantic-layer details not obviously needed by users who only requested business answers.
The skill's declared purpose is end-user business QA, but the instructions spend significant effort on retrieving model metadata and catalog structure. That mismatch increases the chance of unreviewed information disclosure because the skill can reveal semantic-layer details not obviously needed by users who only requested business answers.
The skill's declared purpose is end-user business QA, but the instructions spend significant effort on retrieving model metadata and catalog structure. That mismatch increases the chance of unreviewed information disclosure because the skill can reveal semantic-layer details not obviously needed by users who only requested business answers.
The skill's declared purpose is end-user business QA, but the instructions spend significant effort on retrieving model metadata and catalog structure. That mismatch increases the chance of unreviewed information disclosure because the skill can reveal semantic-layer details not obviously needed by users who only requested business answers.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
message = getattr(error, "message", None)
message = str(message or "Request failed; check credentials, endpoint and network access")
# Do not print SDK objects/tracebacks, which may contain signed requests.
for key, value in os.environ.items():
if value and any(word in key.upper() for word in ("SECRET", "TOKEN", "ACCESS_KEY")):
message = message.replace(value, "[REDACTED]")
result = {"code": str(code), "message": message}
The skill instructs the agent to use Python scripts that can access credentials, local files, and networked SLS resources, but it declares no explicit tool scope or permission boundary. That creates an over-privileged execution model where a caller may trigger data discovery and querying behavior beyond what is clearly constrained by the skill contract.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Do not automatically switch an ordinary indexed query to SCAN because its results are incomplete.
- Use time partitioning only when partial results can be combined to reproduce the original query result. The windows must cover the original time range without overlap.
Do not automatically modify indexes or resource configuration.
The code supports listing models and retrieving catalog metadata despite the description stating the skill is not for inspecting or managing models themselves. This mismatch can enable unauthorized discovery of model names, sources, schemas, and example/query elements, increasing information disclosure and making downstream abuse easier.
The skill exposes direct SLS index inspection and raw log querying capabilities, which exceed the stated business-purpose boundary of answering questions through Context Models. In an agent setting, this expands access to underlying telemetry structures and can reveal schema details or sensitive operational metadata that a user did not intend to expose through the higher-level model abstraction.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
return catalog.overview(csv_names(args.sources), args.max_bytes)
if args.operation == "resolve":
return catalog.resolve(args.schema)
typ, element = next((typ, getattr(args, typ)) for typ in ELEMENTS if getattr(args, typ) is not None)
return catalog.get(typ, element, csv_names(args.members), args.max_bytes)
No suspicious patterns detected.