Security audit

Alibabacloud Tech Solution Animation Creation Auto Deploy

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent as an Alibaba Cloud auto-deployer, but it handles live credentials and IAM in unsafe, broad, and persistent ways.

Review this carefully before installing. Run it only in a dedicated Alibaba Cloud account or tightly scoped deployment identity, avoid shared terminals or logs because it prints a live API key, verify the Devs template before deployment, and plan manual cleanup of the API key, IAM policy grants, role trust changes, public domain, functions, project, and OSS bucket.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/create-api-key.sh:31
Finding: Bailian API Key Is Exposed in Standard Output and Session Logs
Content: View full analysis
`. 4. An agent transcript, CI log, terminal recorder, or other logging system retains the output. 5. An attacker or unauthorized log reader retrieves the key. 6. The attacker uses the key to invoke Bailian services until the key is revoked or otherwise restricted. ### Impact Assessment An exposed key may allow unauthor ...[truncated 412 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/attach-policies.sh:7
Finding: Skill Automatically Grants Account-Wide Function Compute and OSS Access
Content: View full analysis
&1) IDENTITY_TYPE=$(echo "$IDENTITY" | python3 -c "import sys,json; print(json.load(sys.stdin)['IdentityType'])") if [ "$IDENTITY_TYPE" = "RAMUser" ]; then RAM_USER=$(echo "$IDENTITY" | python3 -c "import sys,json; print(json.load(sys.stdin)['Arn'].split('/')[-1])") echo "RAM user: $RAM_USER, auto-attaching required policies..." for POLICY in $POLICIES; do aliyun ram attach-policy-to-user --policy-type System --policy-name "$POLICY" --user-name "$RAM_USER" --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy 2>&1 | grep -v '"RequestId"' || true done echo "Policies attached." else echo "Root account detected, skipping policy attachment." fi ``` ### Technical Analysis The script automatically attaches the `AliyunOSSFullAccess` and `AliyunFCFullAccess` system policies to the current RAM user. These policies are account-wide and are broader than the individual actions identified in `references/ram-policies.md`. The declared workflow needs to create and inspect a specific bucket, deploy specific FC functions and triggers, and create a specific custom domain. It does not inherently require permanent full access to every OSS bucket and FC resource in the account. The policies are attached directly to the user's long-lived identity rather than to a dedicated deployment role. They are not removed during teardown or cleanup. In addition, `|| true` suppresses policy attachment failures, after which the script still prints `Policies attached.` This produces unreliable security state reporting. The caller must alr ...[truncated 1273 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/setup-role.sh:8
Finding: Existing RAM Role Trust Policy Is Destructively Replaced and Reused Without Permission Validation
Content: View full analysis
/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin)['AccountId'])") fi export MY_UID echo "UID: $MY_UID" # Check if role exists; create if not ROLE_POLICY=$(aliyun ram get-role --role-name "$ROLE_NAME" --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy 2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin)['Role']['AssumeRolePolicyDocument'])" 2>/dev/null || echo "") if [ -z "$ROLE_POLICY" ]; then echo "Role $ROLE_NAME not found, creating..." aliyun ram create-role --role-name "$ROLE_NAME" --assume-role-policy-document "$TRUST_POLICY" --description "Role for Devs and FC services" --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy echo "Role created." elif echo "$ROLE_POLICY" | grep -q "fc.aliyuncs.com"; then echo "Role trust policy already includes fc.aliyuncs.com, skipping update" else echo "Updating role trust policy to include fc.aliyuncs.com..." aliyun ram update-role --role-name "$ROLE_NAME" --new-assume-role-policy-document "$TRUST_POLICY" --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy fi ``` ### Technical Analysis The script uses the fixed role name `aliyundevscustomrole`. If that role already exists and its trust policy does not contain the literal string `fc.aliyuncs.com`, the script replaces the entire trust policy with a hardcoded doc ...[truncated 1744 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/render-and-update.sh:28
Finding: Unversioned Remote Devs Template Is Rendered and Deployed with the API Key
Content: View full analysis
&1) # Filter custom-domain from render result and build UpdateEnvironment body UPDATE_BODY=$(echo "$RENDER_OUTPUT" | python3 -c " import sys,json data = json.load(sys.stdin) services = {k:v for k,v in data['services'].items() if k != 'custom-domain'} body = {'name':'$ENV_NAME','spec':{'roleArn':'$ROLE_ARN','stagedConfigs':{'services':services}}} print(json.dumps(body, ensure_ascii=False)) ") # Update environment config (must use --body, not --spec) aliyun devs update-environment \ --project-name "$PROJECT_NAME" \ --name "$ENV_NAME" \ --body "$UPDATE_BODY" \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy ``` ### Technical Analysis The Skill renders the remote `animation-creation` template by name without specifying an immutable version, commit, or content digest. The returned `services` configuration is accepted almost wholesale. The only validation removes the service named `custom-domain`. The Skill does not verify: - Function source packages or container image digests - Runtime commands and handlers - Environment variables - Network destinations - Trigger authentication settings - Resource limits - Additional roles or permissions - Unexpected services other than `custom-domain` The Bailian API key and role ARN are supplied during rendering. A compromised or unexpec ...[truncated 1473 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/create-custom-domain.sh:68
Finding: Application Is Exposed Through a Public Plaintext HTTP Custom Domain
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (93)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to deploy an animation app, but it also creates Model Studio resources, generates API keys, and states that the full key value is printed. Secret generation and disclosure materially expand the risk surface because exposed API keys can be reused to consume paid services, access data, or create follow-on compromise.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to deploy an animation app, but it also creates Model Studio resources, generates API keys, and states that the full key value is printed. Secret generation and disclosure materially expand the risk surface because exposed API keys can be reused to consume paid services, access data, or create follow-on compromise.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The authentication section forbids printing AK/SK or secrets, but a later step says the API key creation script prints the full Bailian API key value. This contradiction is dangerous because operators may expose a live credential in terminal logs, transcripts, or chat output, enabling unauthorized use of the associated cloud AI service.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: The cleanup instructions include recursive forced deletion of the OSS bucket contents using a variable-derived bucket name. Although cleanup is a legitimate function, destructive commands with -r -f become risky if variables are unset, altered, or reused incorrectly, potentially causing irreversible data loss within the targeted bucket.
Content: Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.
md
aliyun devs delete-project --name "$PROJECT_NAME" --force true --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy # 3. Delete OSS Bucket (recursively delete all objects first, then delete the Bucket) aliyun oss rm "oss://$BUCKET_NAME" -r -f --region cn-hangzhou --ua AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy aliyun oss rm "oss://$BUCKET_NAME" -b -f --region cn-hangzhou --ua AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy # 4. Delete Bailian API Key (API_KEY_ID is output during create-api-key.sh execution)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 91% confidence
Finding: Deleting the bucket itself with force after recursive object removal is inherently destructive and depends entirely on the correctness of BUCKET_NAME. In an automated shell workflow, weak parameter validation can turn cleanup into accidental resource destruction, especially if environment variables are stale or manipulated.
Content: Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.
md
# 3. Delete OSS Bucket (recursively delete all objects first, then delete the Bucket) aliyun oss rm "oss://$BUCKET_NAME" -r -f --region cn-hangzhou --ua AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy aliyun oss rm "oss://$BUCKET_NAME" -b -f --region cn-hangzhou --ua AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy # 4. Delete Bailian API Key (API_KEY_ID is output during create-api-key.sh execution) aliyun modelstudio delete-api-key --api-key-id "$API_KEY_ID" --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script provisions a long-lived API key and exports it into the current shell, even though the stated purpose is deploying an animation story app. Creating persistent credentials during automation is dangerous because they may outlive the deployment session, be reused elsewhere, and become a durable compromise point if exposed in logs, shell history, or downstream processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The script prints the newly created API key value directly to stdout, which can expose the secret to terminal logs, CI logs, shell scrollback, transcript capture, and any supervising agent framework. Because this is a freshly provisioned valid credential, disclosure can immediately enable unauthorized API access under the user's account.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/create-custom-domain.sh (reported line 27)May include surrounding context.
sh
FC_FUNCTION="${PROJECT_NAME}-web" # 6a. Get domain verification token TOKEN=$(curl -s --connect-timeout 10 --max-time 30 -A AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy -X POST "https://domain.devsapp.net/token" \ --data-urlencode "type=fc" \ --data-urlencode "user=$MY_UID" \ --data-urlencode "region=$REGION" \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/create-custom-domain.sh (reported line 51)May include surrounding context.
sh
--region "$REGION" --user-agent AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy # 6c. Register devsapp.net DNS CNAME DNS_RESULT=$(curl -s --connect-timeout 10 --max-time 30 -A AlibabaCloud-Agent-Skills/alibabacloud-tech-solution-animation-creation-auto-deploy -X POST "https://domain.devsapp.net/domain" \ --data-urlencode "type=fc" \ --data-urlencode "user=$MY_UID" \ --data-urlencode "region=$REGION" \

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes extensive shell/CLI operations but does not declare any explicit tool scope or allowed-tools boundary. This creates a governance gap: an execution environment may permit broader command execution than reviewers or users expect, increasing the chance of unintended resource changes or abuse.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 2)May include surrounding context.
md
--- name: alibabacloud-tech-solution-animation-creation-auto-deploy description: | Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: alibabacloud-tech-solution-animation-creation-auto-deploy description: | Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
--- name: alibabacloud-tech-solution-animation-creation-auto-deploy description: | Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
md
--- name: alibabacloud-tech-solution-animation-creation-auto-deploy description: | Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
--- name: alibabacloud-tech-solution-animation-creation-auto-deploy description: | Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
--- name: alibabacloud-tech-solution-animation-creation-auto-deploy description: | Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.
md
--- name: alibabacloud-tech-solution-animation-creation-auto-deploy description: | Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.
md
--- name: alibabacloud-tech-solution-animation-creation-auto-deploy description: | Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.
md
--- name: alibabacloud-tech-solution-animation-creation-auto-deploy description: | Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.
md
--- name: alibabacloud-tech-solution-animation-creation-auto-deploy description: | Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.
md
--- name: alibabacloud-tech-solution-animation-creation-auto-deploy description: | Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.
md
--- name: alibabacloud-tech-solution-animation-creation-auto-deploy description: | Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/acceptance-criteria.md (reported line 14)May include surrounding context.
md
--- name: alibabacloud-tech-solution-animation-creation-auto-deploy description: | Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/acceptance-criteria.md (reported line 15)May include surrounding context.
md
--- name: alibabacloud-tech-solution-animation-creation-auto-deploy description: | Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/acceptance-criteria.md (reported line 41)May include surrounding context.
md
--- name: alibabacloud-tech-solution-animation-creation-auto-deploy description: | Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page.

Static analysis

No suspicious patterns detected.