Alibabacloud Sre Toolkit

• Outcome: Review
• Latest audit: Jul 24, 2026 · 3:37 AM UTC
• Version: 0.0.1

Overview

This Alibaba Cloud SRE skill is mostly coherent and disclosed, but it includes high-impact onboarding delete actions and persistent raw local traces that deserve human review before installation.

Install only if you are comfortable granting this skill access to Alibaba Cloud profiles and STAROps administration. Use least-privilege RAM permissions, avoid giving routine diagnostic credentials DeleteDigitalEmployee permission, review .aliyun-sre/execution-trace.jsonl for sensitive prompts, and treat delete-employee/account-delete --confirm as administrative actions that should require explicit human approval.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return {"deleted": False, "error": "aliyun CLI not installed", "remediation": ALIYUN_NOT_INSTALLED_REMEDIATION}
    try:
        # Destructive operation — caller must have obtained explicit user confirmation via --confirm flag.
        proc = subprocess.run([cli, "configure", "delete", "--profile", profile], capture_output=True, text=True, timeout=30)
    except (OSError, subprocess.SubprocessError) as e:
        return {"deleted": False, "error": f"aliyun configure delete failed: {e}"}
    return {

• Confidence: 80% confidence
• Finding: This subprocess call performs a destructive local action: deleting an Alibaba Cloud CLI profile from the user's credential store. Although command injection risk is mitigated by shell=False and profile validation, the capability itself exceeds normal session-management expectations and can remove credentials or break other tooling if triggered with confirmation. In an SRE diagnostic skill, bundling credential-destruction logic increases the blast radius of mistakes or abuse.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly instructs use of shell, filesystem reads/writes, environment inspection, and networked CLI/API calls, yet it does not declare permissions or capabilities explicitly. That creates a trust and review gap: a caller may invoke a skill believing it is low-risk documentation, while it can actually access credentials, modify local config/state files, and reach cloud endpoints.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The published description frames the skill as a read-only SRE diagnostic/audit tool, but the content also includes onboarding and administrative behaviors such as creating/deleting digital employees, modifying account mappings, and potentially deleting CLI profiles. That mismatch is dangerous because operators may grant or invoke the skill under a weaker trust model than its real behavior warrants, increasing the chance of unauthorized account/config changes or credential-disruptive actions.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documentation expands the skill from read-only SRE diagnostics into administrative lifecycle actions for digital employees, including creation and deletion. In a skill advertised for diagnosis, embedding privileged mutating capabilities increases the chance an agent invokes account-changing operations outside user expectations, which can lead to configuration drift or accidental resource loss.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: Listing CreateDigitalEmployee and DeleteDigitalEmployee among the core tool dependencies normalizes use of write-capable administrative functions in what should be a diagnostic/read-only integration. That widens the available attack surface and makes accidental or induced misuse by an agent more plausible.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The file states `account-add` never accepts or handles credentials and that users must preconfigure them externally, but later claims add/update authorizes profiles via `aliyun configure set`. That contradiction can mislead operators and downstream agents into invoking commands that modify credential state unexpectedly, creating a risk of unauthorized credential writes, profile replacement, or trust-boundary violations in an SRE tool with cloud-account access.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The document explicitly forbids direct CLI/API fallback options while the skill metadata promises CLI fallback diagnosis when STAROps is unavailable. This inconsistency can cause operators or an agent to refuse the only viable recovery path during outages, producing denial of service for incident response and increasing the chance of incorrect or fabricated diagnostics.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The session manager exposes an account-delete flow that can cascade into deletion of local aliyun CLI profiles, which is a destructive capability not necessary for basic diagnostic session lifecycle handling. In the context of an SRE toolkit, this expands the tool from session/config management into credential-store modification, increasing the chance of accidental denial of service against operators' local environments.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code can invoke 'aliyun configure delete' against a local credential profile, which is a real destructive capability unrelated to diagnosing cloud health. Even with the --confirm gate, a compromised agent workflow, confused deputy scenario, or operator mistake could erase profiles and disrupt access to cloud accounts or automation.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill advertises SRE diagnosis and reporting, but the bundled CLI also supports administrative lifecycle operations for digital employees. That capability expansion increases blast radius: a caller expecting read/diagnostic behavior may unknowingly gain account-modifying powers, which is dangerous in an agent/tooling context where tools may be invoked automatically.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Create/delete operations for STAROps digital employees are powerful administrative actions not clearly necessary for troubleshooting workloads. In an agent environment, exposing destructive operations through the same skill as diagnosis materially raises the risk of accidental or prompt-induced resource deletion or unauthorized provisioning.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger set includes broad operational terms like '诊断', '巡检', '故障排查', and generic resource/problem keywords, which can cause the skill to activate in contexts broader than intended. Because this skill can read environment state, use shell/network access, and manage cloud-related local configuration, accidental activation raises the risk of unnecessary credential inspection, unintended cloud queries, or confusing workflow takeover.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The deletion workflow is documented as a routine subcommand without a prominent destructive-action warning, confirmation requirement, or recovery guidance. This increases the risk that users or agents treat deletion as a normal troubleshooting step and irreversibly remove digital employees.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: _append_trace logs vars(args) for every command, which includes chat questions, thread IDs, config paths, and flags without warning or redaction. Because SRE troubleshooting often contains secrets, incident details, hostnames, and internal context, this creates a persistent local disclosure channel that users may not expect.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The execution trace stores raw command arguments in JSONL, which can capture sensitive user prompts and operational details in plain text on disk. In shared workstations, CI runners, or incident-response environments, these traces may later be read by other users, backup systems, or log collectors.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The --stream, --raw, and --json modes intentionally emit all non-assistant message content as 'thinking' to stderr/stdout, potentially exposing internal prompts, user data, and intermediary conversation text. In many agent settings, stdout/stderr is captured by orchestrators or logs, so this can leak sensitive content beyond the immediate operator.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Invoked via the `starops_manager.py delete-employee` subcommand.

**Request**: `DELETE /digital-employee/{name}`

| Parameter | Location | Type | Description |
|-----------|----------|------|-------------|

• Confidence: 77% confidence
• Finding: A delete operation taking a free-form `{name}` parameter is a high-risk sink because an agent or user can supply an arbitrary digital employee identifier, potentially deleting unintended resources in the bound account. In this skill context, the danger is elevated because the surrounding material is about diagnosis, so destructive parameterized actions are less expected and more likely to be mis-triggered.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def delete_digital_employee(
    name: str, endpoint: str = DEFAULT_ENDPOINT, profile_name: Optional[str] = None,
) -> dict:
    """Delete a STAROps digital employee via DELETE /digital-employee/{name}."""
    path = f"/digital-employee/{quote(name, safe='')}"
    headers, url, _ = _sign_request(
        "DELETE", path, "DeleteDigitalEmployee", endpoint,

• Confidence: 91% confidence
• Finding: delete_digital_employee() performs a destructive remote action based on a direct name parameter with no in-code confirmation, policy check, or narrowing of allowed targets. In an agentic or scripted context, this is vulnerable to tool-parameter abuse: a malicious or mistaken prompt can cause deletion of legitimate STAROps digital employees.

Static analysis

No suspicious patterns detected.