Security audit

Alibabacloud Sms Send Short Message

Security checks across malware telemetry and agentic risk

Overview

This SMS skill is mostly coherent, but it also performs unconfirmed runtime plugin installation and documents access to sensitive account-qualification identity records, so it needs review before use.

Review before installing. Use least-privilege RAM permissions and avoid granting qualification-detail permissions unless an admin workflow truly needs them. Preinstall and pin the Alibaba CLI/plugin yourself if automatic runtime installation is not acceptable. For bulk or marketing SMS, confirm recipient consent and compliance requirements, and redact any qualification details before displaying or sharing them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The file documents qualification-query APIs that expand the skill from SMS sending into account-level discovery of SMS qualification records and related review metadata. In a sending-focused skill, this is an unnecessary capability increase that broadens accessible data and operational scope, creating avoidable exposure of internal business and compliance information.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The documented single-qualification detail response includes sensitive PII such as ID-card numbers, admin phone numbers, and document/image URLs, but that access is not justified by the stated purpose of sending SMS messages. Even though the notes mention redaction, the skill still exposes a retrieval path for highly sensitive identity and business-license data, increasing the risk of privacy violations, overcollection, and accidental disclosure.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script will automatically install the dysmsapi plugin if it is missing, which performs a host modification and network retrieval as a side effect of simply running the skill. In agent or automation contexts, this can violate change-control expectations, expand the trusted computing base, and introduce supply-chain risk without explicit operator approval.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill handles phone numbers and message content and sends them to a third-party cloud provider, but it does not clearly warn about privacy, consent, or regulatory obligations. In an agent context, this omission increases the risk of users unknowingly transmitting personal data or marketing content in ways that may violate internal policy or telecom/privacy rules.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Triggering plugin installation automatically causes a networked system change without prior warning or confirmation from the user at execution time. In a skill environment, unexpected package/plugin installation is dangerous because it can alter the host state, fetch unreviewed code, and surprise users who intended only to send or query SMS.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/send_sms.sh:202