Alibabacloud Sls Sdk Guidance

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 0.0.1

Overview

This is a documentation-only skill for Alibaba Cloud SLS SDK guidance; its credential and log-transfer examples are expected for that purpose, but users should apply normal cloud logging precautions.

Before installing, review any generated SDK code for your environment: use least-privilege or temporary Alibaba Cloud credentials, do not hardcode secrets, avoid sending secrets or personal data in logs, and be deliberate about mobile/offline log persistence and SLS retention/access controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (39)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guidance recommends enabling persistent local binlog storage for logs but does not warn that log contents may be written to device storage and retained across app restarts. On Android, logs often contain identifiers, tokens, request metadata, or other sensitive telemetry, so undocumented persistence increases the risk of local data exposure on compromised, rooted, shared, or backup-accessible devices.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file includes a code example that reads sensitive environment variables for Alibaba Cloud access keys and configures a producer that sends data directly to a remote logging endpoint. Although the summary mentions network sending, there is no explicit warning in the usage section about transmitting log data or safely handling credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file explains that the SDK writes logs asynchronously to SLS and links to the service documentation, but it does not warn users that application logs may contain sensitive or personal data and will be sent over the network to a third-party cloud service. For a markdown skill description, this is a safety-relevant omission because the behavior affects privacy and data handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation instructs readers to load ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET from environment variables, which are sensitive credentials. The page provides no warning about protecting these secrets, avoiding hardcoding/logging them, or using least-privilege credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file includes a quick-start snippet that reads ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET from environment variables, which are sensitive credentials. The surrounding documentation does not provide any warning or guidance about protecting, scoping, or securely supplying these secrets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file includes a code example that reads sensitive credentials from environment variables, but the surrounding documentation does not warn users that the skill requires access to cloud secrets or recommend secure handling practices. Because markdown files should disclose behaviors affecting privacy or system integrity, the omission is a meaningful safety gap.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/sdks/aliyun-log-go-sdk/consume-logs.md (reported line 52)May include surrounding context.

md

}
}

func process(shardId int, logGroupList *sls.LogGroupList, checkpointTracker consumer.CheckPointTracker) (string, error) {
    // Save the checkpoint after the batch is processed.
    //   false — save to local memory only (fast); a background task periodically
    //           flushes it to the server (force=true) on its own schedule.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/sdks/aliyun-log-go-sdk/consume-logs.md (reported line 60)May include surrounding context.

md

}
}

func process(shardId int, logGroupList *sls.LogGroupList, checkpointTracker consumer.CheckPointTracker) (string, error) {
    // Save the checkpoint after the batch is processed.
    //   false — save to local memory only (fast); a background task periodically
    //           flushes it to the server (force=true) on its own schedule.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file includes a code example that reads ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET from environment variables to initialize the client. The surrounding documentation does not warn users that the example uses sensitive credentials or advise secure handling, which matches the markdown-file criteria for missing warnings about privacy/system-impacting behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The summary presents the SDK mainly as a logging helper but does not clearly warn that it uploads logs off-device and that companion libraries may collect crash, trace, block, or network telemetry. In a mobile SDK guidance skill, this omission can cause developers to integrate data-exporting components without adequately considering privacy, consent, or data-handling obligations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The guidance promotes asynchronous background transmission and optional persistent local binlog caching, but it does not warn that logs may contain sensitive data, will be sent off-device automatically, and may remain stored on the device across restarts. In a mobile SDK guidance context, omission of privacy and retention cautions can lead developers to enable persistence for production apps without considering user consent, platform data-protection settings, or minimization of logged data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The sample code shows direct use of AccessKey ID and AccessKey Secret in iOS app configuration, which can normalize embedding long-lived cloud credentials in a mobile client. Although the document later says STS tokens are preferred, the earlier example lacks an immediate warning that static credentials in a shipped app are highly recoverable and could allow unauthorized log submission or broader cloud abuse if over-privileged.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file includes sample code that sends log data to Alibaba Cloud SLS and reads access credentials from environment variables. The surrounding skill description does not warn that using the example will transmit data off-system or that credentials are required and sensitive, which fits the markdown-specific missing user warning criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document instructs users to forward standard application logs directly to Alibaba Cloud SLS and lists the captured fields, but it does not warn that those logs may contain secrets, personal data, tokens, stack traces, or other sensitive material that will leave the host boundary. In SDK guidance, this omission can lead operators to enable remote log shipping broadly without redaction, filtering, or data-classification controls, creating a real risk of sensitive data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The summary explicitly promotes sending application logs directly to Alibaba Cloud SLS but omits any warning that logs leave the host and may contain secrets, personal data, tokens, or internal system details. In a logging guidance skill, this omission is security-relevant because users may enable broad log forwarding by configuration only, increasing the chance of unreviewed sensitive-data exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The quick-start example uses long-lived cloud access key environment variables without any guidance on secure credential handling, rotation, or safer alternatives. In SDK setup documentation, examples strongly influence implementation, so this can normalize embedding powerful credentials into runtime environments where they may be leaked via logs, process inspection, CI/CD settings, or misconfiguration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file explicitly instructs users to send logs from an application directly to SLS, which is a network transmission of potentially sensitive operational or user data. While it documents configuration details, it does not include a user-facing warning to review log contents for secrets, PII, or other sensitive data before enabling remote log export.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document encourages shipping existing application logs to Alibaba Cloud SLS via configuration-only integration, but it provides no warning that application logs often contain sensitive data such as tokens, personal data, internal URLs, stack traces, or customer content. In a logging guidance skill, omission of privacy and data-minimization guidance increases the risk that users will centralize sensitive logs without redaction, retention controls, or access restrictions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The quick-start example shows direct use of cloud access credentials in Logback configuration through environment-variable expansion, but it does not warn about secure secret handling, credential scope, or safer alternatives. Because Logback configuration is often checked into source control or widely distributed in deployment artifacts, readers may copy this pattern without protecting credentials or using short-lived/role-based credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document instructs users to forward all Logback/Spring Boot application logs to Alibaba Cloud SLS but does not explicitly warn that logs may contain secrets, personal data, tokens, request bodies, or internal system details that are being transmitted off-host to a third-party cloud service. In a logging configuration guide, this omission can cause operators to enable broad log export without reviewing data minimization, redaction, retention, and access controls, increasing the chance of sensitive data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes using LogClient.put_logs to send log batches over the network and links to external service documentation, but it does not warn that log contents may include sensitive application or user data. For markdown files, omission of privacy/system-impact warnings for data transmission is in scope for missing user warnings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The example explicitly reads ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET, which are sensitive credentials, but the markdown provides no caution about secret management or avoiding exposure. For markdown documentation, this is a missing warning because the behavior can affect account security and privacy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guidance shows how to instantiate an authenticated Alibaba Cloud SLS client using access keys from environment variables and explicitly states the SDK can write logs, query logs, and manage resources, but it does not warn users that these operations can modify cloud resources or access sensitive log data. In an agent skill context, this omission increases the risk that downstream users or agents invoke the SDK with powerful credentials without understanding the security implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This markdown file includes executable sample code that accesses sensitive environment variables for ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET. The surrounding documentation does not warn users that the example depends on privileged credentials or advise careful handling of those secrets.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The official docs section points users to a Chinese-language documentation page (/zh/) without indicating that documentation may be available in other languages or that the locale is required. This can violate language/locale policy expectations when no user opt-in or rationale is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.