Alibabacloud Sls Sdk Guidance

• Outcome: Pass
• Latest audit: Jul 9, 2026 · 10:52 PM UTC
• Version: 0.0.1

Overview

This is a documentation-only Alibaba Cloud SLS SDK guidance skill, with no executable behavior, but its examples should be used carefully around credentials and log data.

Install only if you want Codex to help with Alibaba Cloud SLS SDK usage. Before using generated examples in production, prefer STS or role-based credentials, avoid static AccessKeys in mobile apps, grant least-privilege SLS access, redact secrets and personal data from logs, and review retention, consent, and data-residency requirements for anything sent to SLS.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The Android guidance shows configuring long-lived Alibaba Cloud credentials directly in client-side code via environment variables, which is inappropriate for a mobile app threat model. Even if environment variables are only illustrative, this normalizes shipping or injecting powerful credentials into an untrusted client, where they can be extracted and abused to write, read, or tamper with cloud logs.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The document’s primary example promotes static AccessKey configuration, while a later section says mobile clients should prefer STS tokens. This contradiction is dangerous because developers often copy the first working snippet they see, leading to deployment of recoverable long-term secrets in Android apps despite the later warning.

Missing User Warnings

Medium

• Confidence: 72% confidence
• Finding: The guide advertises asynchronous background transmission and optional persistent local binlog storage without warning about privacy, retention, or consent implications. In a mobile context, buffered and persisted logs can contain identifiers, error details, or user activity data that remain on-device and are later transmitted, increasing exposure if the device is compromised or if the app logs sensitive content.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The example combines credential configuration with on-device persistent logging but provides no warning about secure credential handling or the sensitivity of locally stored log data. In mobile apps, this can mislead developers into unsafe designs where secrets and potentially sensitive telemetry are exposed through reverse engineering, device compromise, backups, or forensic access.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The example instructs users to load long-lived cloud access credentials from environment variables without any guidance on secure handling, least privilege, or safer alternatives such as RAM roles/STS. In practice, readers may copy this pattern into production, increasing the risk of credential exposure through process environments, logs, crash dumps, shell history, or overly broad secret distribution.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The quick start includes example code that reads long-lived cloud credentials and applies them directly in a mobile SDK setup. Even though the note says 'For quick testing only' and later advises preferring STS tokens, mobile-focused guidance that demonstrates AccessKey use can normalize unsafe patterns and lead developers to embed or mishandle sensitive credentials in client-side apps, where extraction risk is high.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation encourages asynchronous background transmission and optional offline persistence of logs on a mobile device, but it does not warn that logs may contain sensitive user or device data and may remain stored locally across restarts. In a mobile context, this can lead developers to enable persistent caching without considering privacy disclosures, data minimization, encryption, retention, or local-device exposure risks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The quick-start shows long-lived cloud access key environment variables for authenticating the appender, but provides no guidance on secure secret handling, least privilege, rotation, or safer credential mechanisms. In practice, readers may copy this pattern into production and expose highly sensitive credentials through process environments, build logs, config management mistakes, or overprivileged static keys.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document encourages forwarding application logs directly to SLS and lists the full set of transmitted fields, but it does not clearly warn that logs often contain secrets, personal data, tokens, stack traces, or other sensitive content that will be sent off-host over the network. In guidance for a logging appender, this omission is security-relevant because users may enable centralized logging with no code changes and unintentionally exfiltrate sensitive data to a remote service.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document explicitly promotes sending application logs to a remote Alibaba Cloud Logstore and discusses credentialed access, but it provides no warning that logs may contain sensitive data such as tokens, PII, stack traces, or internal identifiers. In a logging integration guide, omission of privacy and data-handling cautions can lead users to exfiltrate sensitive information off-host by default, especially because the appender requires only configuration changes and no code review.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The quick-start configuration shows direct use of environment-sourced cloud credentials in application logging configuration without any guidance on secret handling, rotation, scope restriction, or safer alternatives. This is dangerous because configuration files, process environments, debug output, and operational tooling can expose secrets, and the example may encourage long-lived access keys for a high-volume logging path.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document instructs users to forward application logs directly to Alibaba Cloud SLS but does not warn that logs commonly contain sensitive data such as credentials, tokens, PII, stack traces, or internal identifiers. In this context, the omission is risky because the guidance emphasizes seamless forwarding with no code changes, which can cause users to export sensitive local telemetry to a third-party cloud service without considering data minimization, redaction, retention, or compliance requirements.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document instructs users to ship application logs to a remote Alibaba Cloud Logstore and includes credential configuration, but it provides no warning that logs may contain sensitive data or that secrets must be handled carefully. In a logging integration guide, this omission can lead users to forward PII, tokens, or internal application details to a third-party service without considering privacy, retention, or access controls.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guidance instructs users to forward application logs and metadata to Alibaba Cloud SLS but does not warn that messages, stack traces, MDC fields, source/topic values, and other contextual data may contain secrets, personal data, or internal system details. In a logging configuration skill, this omission is security-relevant because users may enable broad logging export without implementing redaction, minimization, or compliance review.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The quick start and capability sections show how to configure authenticated access using Alibaba Cloud access keys and explicitly reference write, query, and resource management operations, but the file does not warn that these examples can act on real cloud logging resources. In a guidance skill, that omission can cause users to run examples with production credentials or against production endpoints without understanding the operational and security consequences.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.