alibabacloud-tls-cert-diagnosis

• Outcome: Pass
• Latest audit: Aug 31, 2026 · 2:15 AM UTC
• Version: 0.0.1

Overview

This is a disclosed read-only TLS certificate diagnostic skill for user-supplied targets, with no evidence of hidden persistence, credential use, exfiltration, or destructive behavior.

Install only if you are comfortable with a local diagnostic script making DNS, TCP, and TLS connections to targets you provide. Review batch files before use and avoid broad scans unless you are authorized to test those endpoints.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_cmd(cmd: List[str], input_data: Optional[bytes] = None, timeout: float = 10.0) -> tuple[int, str, str]:
    """Run a command and return (returncode, stdout, stderr)."""
    try:
        result = subprocess.run(
            cmd,
            input=input_data,
            capture_output=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["-servername", servername])

    try:
        result = subprocess.run(
            cmd,
            stdin=subprocess.DEVNULL,
            stdout=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["-CAfile", _CA_FILE])

    try:
        result = subprocess.run(
            cmd,
            stdin=subprocess.DEVNULL,
            stdout=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Most of the code matches the declared TLS certificate diagnostic purpose: it resolves DNS, tests TCP connectivity, fetches certificates with openssl, parses SAN/CN and validity dates, and evaluates trust and chain issues. However, the description says it only checks domains the user explicitly provides, while the code also supports bulk scanning from a file of domains and can inspect IP addresses directly. It also allows arbitrary ports, which broadens behavior beyond the stated browser/HTTPS certificate diagnosis focus. These are additional capabilities not reflected in the description, so this should be flagged as a mismatch.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The manifest describes diagnosing certificate problems for a user-provided domain and emphasizes only checking domains the user explicitly provides. The CLI adds a `--file` mode that reads and processes multiple domains from a local file, which broadens the behavior from single explicit-domain diagnosis to batch enumeration/scanning.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: On Linux, the skill invokes `bash -c` pipelines for telnet/grep and `/dev/tcp` probing instead of using direct socket operations or simple argument-list subprocesses. While port reachability checks are relevant to TLS diagnosis, spawning a shell is a broader execution capability than the manifest's narrowly scoped read-only certificate diagnostic intent suggests.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The module docstring explicitly states that all subprocess calls use argument lists with timeouts. However, the Linux branch of `check_port` passes shell command strings to `bash -c`, which contradicts that security claim because a shell interprets the embedded command text.

Unvalidated Output Injection

High

• Category: Output Handling

Content

def run_cmd(cmd: List[str], input_data: Optional[bytes] = None, timeout: float = 10.0) -> tuple[int, str, str]:
    """Run a command and return (returncode, stdout, stderr)."""
    try:
        result = subprocess.run(
            cmd,
            input=input_data,
            capture_output=True,

• Confidence: 95% confidence
• Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Session Persistence

Medium

• Category: Rogue Agent

Content

MANDATORY:

- **Read-only**: this skill only inspects and reports. It performs no write operations and requires no credentials of any kind.
- **Single entry point**: all checks MUST be executed through the entry script `scripts/check_tls.py`. Do not hand-assemble diagnostic command chains.
- **User-provided targets only**: only check domains the user explicitly provides.
- **No scanning**: never scan, sweep, or probe unknown or unspecified addresses.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.