ClawHub
Back to skill

Security audit

alibabacloud-sls-index-config-management

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Alibaba Cloud SLS index-management helper; it can change or delete real cloud index settings, but its instructions are coherent and include user-control guardrails.

Use this skill only with a RAM profile scoped to the intended Alibaba Cloud project and Logstore. Review generated index configs before applying them, because update replaces the full index config and delete can disrupt indexed search and SQL analytics. Do not paste access keys into the chat; configure credentials outside the session. For stricter least privilege, prefer SLS get-index checks over the optional ECS region test, and verify vendor CLI downloads before running sudo install commands.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description centers on managing Alibaba Cloud SLS index configurations through the aliyun CLI. The actual code chunk does none of that. It only loads a local manifest, validates a version string, and prints a randomized User-Agent string. This is an implementation utility unrelated to the declared primary skill behavior. Because the actual behavior is materially different from the declared purpose and lacks any SLS index-management functionality, this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/related-apis.md (reported line 215)May include surrounding context.

md
## DeleteIndex

`DELETE /logstores/{logstore}/index` — invoke via `aliyun sls delete-index`.

### Input — Required

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
Follow the reference matching the user's request:

| If the user wants to …                                                                                                      | Go to                                                                            |
| --------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| View / create / update / delete an index, or change a field, TTL, `max_text_len`, full-text, automatic index discovery, log_reduce, etc. | [references/manage-index-config.md](references/manage-index-config.md)           |
| Build an index for a Logstore that has none, or rebuild from scratch using user-provided structured log samples             | [references/generate-index-from-logs.md](references/generate-index-from-logs.md) |

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 103)May include surrounding context.

--keys '{"new_field":{"type":"long","doc_value":true}}'

text

**Why**: `update-index` is overwrite — submitting only `keys` drops `line`, `max_text_len`, `log_reduce`, and every existing field that was not re-included.

### 5. CreateIndex vs UpdateIndex — pick by current state

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 29)May include surrounding context.

bash
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz
tar -xzf aliyun-cli-macosx-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 41)May include surrounding context.

bash
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz
tar -xzf aliyun-cli-macosx-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 51)May include surrounding context.

bash
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz
tar -xzf aliyun-cli-macosx-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 163)May include surrounding context.

md
3. **Rotate access keys** regularly.
4. **Prefer STS or ECS RAM Role** for temporary or in-cloud workflows.
5. **Never commit `~/.aliyun/config.json`**; add it to `.gitignore`.
6. `chmod 600 ~/.aliyun/config.json` to restrict local file permissions.

## Troubleshooting

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file instructs users to create, replace, or delete SLS index configurations, which can materially affect system integrity and log searchability. While it notes that update overwrites the whole config, it does not provide a clear warning that delete/replace operations may disrupt queries or analytics and should be used cautiously.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/related-apis.md (reported line 33)May include surrounding context.

md
The same JSON object is shared by `CreateIndex`, `UpdateIndex`, and the response of `GetIndex`.

| Field                   | Type     | Required                | Description                                                                                                     |
| ----------------------- | -------- | ----------------------- | --------------------------------------------------------------------------------------------------------------- |
| `line`                  | object   | conditional             | Full-text index. At least one of `line` / `keys` / `scan_index` must be present.                                |
| `line.token`            | string[] | yes (if `line` present) | Tokenizer delimiters, e.g. `[",", " ", ";", "=", "(", ")", "[", "]", "{", "}", ":", "\n", "\t", "\r"]`.         |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/related-apis.md (reported line 37)May include surrounding context.

md
| ----------------------- | -------- | ----------------------- | --------------------------------------------------------------------------------------------------------------- |
| `line`                  | object   | conditional             | Full-text index. At least one of `line` / `keys` / `scan_index` must be present.                                |
| `line.token`            | string[] | yes (if `line` present) | Tokenizer delimiters, e.g. `[",", " ", ";", "=", "(", ")", "[", "]", "{", "}", ":", "\n", "\t", "\r"]`.         |
| `line.caseSensitive`    | boolean  | no                      | Default `false`.                                                                                                |
| `line.chn`              | boolean  | no                      | Enable Chinese tokenization. Default `false`; enabling substantially reduces tokenization and write throughput. |
| `line.auto_key_detect`  | boolean  | no                      | Enable automatic index discovery. Default `false`; discovered names are added to `line.auto_text_keys`. |
| `line.auto_text_keys`   | string[] | no                      | Discovered text indexes with analytics enabled; inherit `line.token` and `line.caseSensitive`. Returned by `GetIndex` and preserved on updates. |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/related-apis.md (reported line 59)May include surrounding context.

md
### `IndexKey` (entry value of `keys`)

| Field           | Type     | Required | Description                                                                                       |
| --------------- | -------- | -------- | ------------------------------------------------------------------------------------------------- |
| `type`          | string   | yes      | One of `text` / `long` / `double` / `json`.                                                       |
| `doc_value`     | boolean  | no       | `true` enables SQL analytics (`SELECT`, `GROUP BY`, `WHERE`) on this field. **Required for SQL.** |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/related-apis.md (reported line 241)May include surrounding context.

md
## Reference Documentation

| Document                                                                                             | Description                                               |
| ---------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
| [GetIndex API](https://help.aliyun.com/zh/sls/developer-reference/api-sls-2020-12-30-getindex)       | Official API reference                                    |
| [CreateIndex API](https://help.aliyun.com/zh/sls/developer-reference/api-sls-2020-12-30-createindex) | Official API reference                                    |

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill is scoped to Alibaba Cloud SLS index configuration management via the aliyun CLI, but this guide instructs use of aliyun ecs describe-regions to test authentication. Calling ECS is not necessary to inspect or modify SLS indexes and introduces a cross-service capability not justified by the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This markdown file contains verification commands such as aliyun ecs describe-regions and aliyun sls get-index that make outbound API requests using the user's configured credentials. While the guide discusses credential handling and security best practices, it does not explicitly warn in the verification section that these commands contact Alibaba Cloud and may expose account, region, and access-pattern metadata.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file repeatedly directs users to help.aliyun.com/zh/... documentation, which imposes a specific language/locale in the skill's reference material. The file does not offer an alternative language option or note that the references are Chinese-only, so it can violate the language/locale choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The reference table links exclusively to /zh/ documentation pages, again forcing a specific locale in the skill's natural-language guidance. Because no opt-in, alternative locale, or justification is provided in the file, this is a policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.