Security audit

Alibabacloud Sls Query

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed, mostly read-only Alibaba Cloud SLS log-query helper, but users should handle CLI installation and credentials carefully.

Install only if you intend to let an agent help query Alibaba Cloud SLS logs with your local aliyun CLI profile. Use least-privilege RAM permissions limited to the needed projects and logstores, prefer temporary credentials or RAM roles when possible, do not paste access keys into chat, review remote installer commands before running them, and confirm region/timezone choices before executing incident or compliance queries.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The troubleshooting section expands the skill from query execution into cross-region project discovery and endpoint switching, which broadens operational scope beyond the stated purpose. That can expose project metadata across regions or cause the agent to probe alternate endpoints without a clear user request, increasing the chance of unintended information disclosure or overreach.

Context-Inappropriate Capability

Medium

Confidence: 81% confidence
Finding: Including cross-region project discovery in a log-query skill introduces a capability that is not tightly aligned to the declared function. Even if intended for supportability, it can enable enumeration of projects or regions and increases blast radius if the skill is invoked in an unexpected context.

Vague Triggers

Medium

Confidence: 70% confidence
Finding: The trigger list includes broad phrases like generic log query/analysis terms, which may cause the skill to activate in situations the user did not intend. Unintended activation matters here because the skill is capable of issuing cloud CLI commands and reading log data, so accidental invocation can lead to unnecessary access or confusing execution paths.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: Defaulting to the machine's local timezone when the user does not specify one can silently query the wrong time window. In a log-analysis skill, that can mislead investigations, omit relevant events, or surface unrelated logs from a different period, which is especially risky during incident response or compliance work.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The guide instructs users to execute a remote installer directly via `curl | bash`, which bypasses normal integrity review and runs whatever the server returns at execution time. In an agent skill context, this is riskier because users may copy-paste commands without validating the script source, exposing them to supply-chain compromise or malicious content injection if the hosting endpoint is compromised.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation shows users passing long-lived access-key credentials directly on the command line and storing them in the local CLI config file, but does not clearly warn that command-line arguments may be exposed in shell history, process listings, logs, or persisted plaintext configuration. In a skill designed to guide CLI usage, this can normalize unsafe secret handling and increase the chance of credential leakage.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The statement "在所有场景中都适用" makes the skill appear universally applicable without any constraints, preconditions, or caveats. In a security-sensitive assistant context, this can encourage inappropriate use of regex-based extraction on arbitrary log data, increasing the chance of misuse, overreach, or user reliance outside intended bounds.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.