Alibabacloud Video Forge

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:40 AM UTC
• Version: 0.0.2

Overview

This skill mostly matches its Alibaba Cloud video-processing purpose, but it asks for risky installer/update behavior and includes broad credential/environment loading plus forceable cloud deletion.

Review before installing. Use a dedicated low-privilege RAM role scoped to one OSS bucket/prefix, avoid the full-access policy examples, do not run curl-to-bash or unverified latest binary installers, avoid enabling automatic CLI plugin installation, and do not use --force for recursive deletes. Put only the required Alibaba Cloud settings in a dedicated config environment rather than mixed shell or .env files.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (8)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:12

Finding

Unverified Remote Installer Executed Through a Shell Pipeline

Content

View full analysis

**Pre-check: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update, > or see `references/cli-installation-guide.md` for installation instructions. ``` ### Technical Analysis The installation command pipes a response fetched from a mutable external URL directly into Bash. The effective code is not included in the audited package and can change after review. No version pin, checksum validation, digital-signature verification, or local inspection step is required. HTTPS authenticates the connection to the responding server but does not establish artifact immutability. Compromise of the origin, CDN, DNS resolution, publishing account, or deployment pipeline could result in arbitrary commands being returned and immediately executed. This behavior is not necessary for video processing. A package-manager installation or a separately downloaded and verified, versioned artifact would provide the required CLI without direct remote-to-shell execution. ### Attack Path 1. An attacker compromises the remote installer, its publishing pipeline, or the content-delivery infrastructure. 2. The response at `https://aliyuncli.alicdn.com/setup.sh` is replaced with malicious shell commands. 3. A user or agent follows the Skill's prerequisite instruction. 4. `curl` downloads the modified response. 5. Bash immediately executes it without an integrity or review boundary. 6. The payload runs with the invoking user's privileges and can access local files, environment variables, cloud configuration, and credentials available to that user. ### Impact Assessment Successful exploitation provides arbitrary code execution under the account running the Skill. Depending on ...[truncated 221 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:17

Finding

Mandatory Automatic Installation and Updating of Mutable CLI Plugins

Content

View full analysis

**Pre-check: Aliyun CLI plugin update required** > [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ``` ### Technical Analysis The Skill requires automatic plugin installation and forces existing plugins to update to whatever release is currently available. No approved-version list, version pin, checksum, signature-verification procedure, or user review is specified. Plugins are executable components. Requiring mutable remote updates means the code ultimately executed by the Skill can change after the Skill itself has been audited. This creates both a remote-payload risk and an insecure dependency lifecycle. Automatic plugin installation is broader than the minimum required for the declared workflow. Only plugins demonstrably required by the selected operation should be installed, and installation should occur with explicit approval. ### Attack Path 1. An attacker compromises a plugin package, registry account, update service, or distribution channel. 2. A malicious plugin release becomes the current version. 3. The Skill requires the user to enable automatic installation and execute `aliyun plugin update`. 4. The CLI downloads and installs the malicious executable component. 5. A subsequent legitimate-looking CLI command loads or invokes that component. 6. The component runs in a process that may have access to Alibaba Cloud credentials and cloud permissions. ### Impact Assessment A compromised plugin could execute local code, access the default credential chain, alter cloud requests, steal media or credentials, and perform unauthorized OSS or MPS operations within the user's granted permissions. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/load_env.py:278

Finding

Broad Shell-File Parsing Imports Unrelated Secrets into the Process Environment

Content

View full analysis

dict: result = {} try: with open(filepath, "r", encoding="utf-8", errors="replace") as f: for line in f: line = line.rstrip("\n") stripped = line.strip() if not stripped or stripped.startswith("#"): continue m = _KV_RE.match(line) if m: key = m.group(1) value = m.group(3) result[key] = value except (OSError, IOError): pass return result ``` ```python for filepath in _ENV_FILES: if not os.path.isfile(filepath): continue parsed = _parse_env_file(filepath) if not _file_contains_target(parsed): continue for key, value in parsed.items(): if key not in os.environ: os.environ[key] = value newly_loaded[key] = value ``` ### Technical Analysis The loader scans general-purpose shell startup files and `~/.env`. If a file contains at least one target Alibaba Cloud configuration variable, the code imports every syntactically valid assignment from that file—not just the target variables. Such files frequently contain unrelated database passwords, API tokens, signing keys, service credentials, proxy settings, and application configuration. Importing all of them into `os.environ` unnecessarily exposes them to the entire Python process, imported SDKs, diagnostic code, and any child processes. The behavior exceeds minimum privilege because the video workflow onl ...[truncated 1020 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/load_env.py:446

Finding

Verbose Environment Diagnostics Disclose Secret Prefixes

Content

View full analysis

4 else "****" print(f"[load_env] 设置 {key}={display}", file=sys.stderr) ``` ```python for var in sorted(_TARGET_VARS): val = os.environ.get(var, "") if val: display = val[:4] + "****" if len(val) > 4 else "****" status = f"✅ 已设置 ({display})" else: status = "❌ 未设置" print(f" {var}: {status}") ``` ### Technical Analysis Verbose mode logs variable names and the first four characters of loaded values. Because the loader can import unrelated assignments from general shell files, this output can disclose prefixes of credentials and tokens that are unrelated to the Skill. Partial masking is not sufficient for secrets. Prefixes can reveal credential type, tenant or account association, token family, or enough information to correlate a leaked value with another data source. Diagnostic output may be retained in CI logs, terminal capture, agent transcripts, or centralized logging systems. ### Attack Path 1. A qualifying shell or `.env` file contains a sensitive assignment. 2. The user invokes the loader or another script in verbose mode. 3. The loader imports the sensitive assignment. 4. The variable name and first four value characters are written to standard error. 5. Logs or transcripts expose that information to operators or systems that should not receive it. ### Impact Assessment The direct disclosure is limited to variable names and four-character prefixes, but it can expose metadata about credentials and materially assist credential identification or cor ...[truncated 95 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:10

Finding

Python Dependencies Are Installed Without Reproducible Version and Hash Pinning

Content

View full analysis

=0.3.0,<1.0.0 alibabacloud-mts20140618>=6.0.0,<7.0.0 alibabacloud-tea-openapi>=0.3.0,<1.0.0 oss2>=2.18.0,<3.0.0 ``` ### Technical Analysis The documented installation commands do not use the provided requirements file and therefore select whichever release is current. The requirements file itself uses broad compatible ranges rather than exact versions and contains no package hashes. The instructions also permit multiple package indexes. Consequently, installations performed at different times or through different mirrors may retrieve different executable code despite using the same Skill package. Dependencies run in processes that can access cloud credentials and media. No specific malicious package was identified in the repository; the finding concerns the lack of reproducible supply-chain controls. ### Attack Path 1. A malicious or compromised release satisfying one of the broad version ranges appears on an accepted package index or mirror. 2. A user follows the unpinned `pip install` command. 3. Dependency resolution selects the affected release. 4. Installation hooks or imported package code execute locally. 5. The dependency accesses the process environment, credential provider, local media, or cloud APIs. ### Impact Assessment A compromised dependency could execute with the Skill u ...[truncated 216 chars]

Remediation

View remediation

`. 4. Use one approved package index and avoid switching between mirrors without separate trust review. 5. Prefer binary wheels from verified publishers where available. 6. Scan locked dependencies for known vulnerabilities and review updates before changing the lock file. 7. Update all documentation to invoke the locked requirements file rather than package names without versions. ]]>

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:22

Finding

Unverified Moving CLI Archives Are Installed into a Privileged System Path

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/ram-policies.md:266

Finding

Full-Service Cloud Access Is Recommended Despite Narrower Policies Being Available

Content

View full analysis

aliyun ram attach-policy-to-user --policy-type System --policy-name AliyunOSSFullAccess --user-name ``` ``` ### Technical Analysis The documentation recommends full MPS and OSS service policies as a convenience alternative. These permissions exceed the video's required operations and can cover unrelated resources and administrative capabilities. The same document already supplies narrower, feature-specific policies and bucket-scoped OSS resources. Therefore, recommending full access is unnecessary and contradicts least-privilege requirements. It also compounds the impact of remote installers, mutable plugins, and third-party dependencies. ### Attack Path 1. A user follows the full-access recommendation instead of creating the narrower policy. 2. The Skill, CLI, and dependencies run with complete MPS and OSS access granted to that RAM principal. 3. A compromised installer, plugin, package, or local process obtains access to that principal's credential chain. 4. The attacker performs operations beyond the intended bucket and video workflow. ### Impact Assessment The precise scope depends on Alibaba Cloud's definitions of the two system policies, but it can include broad access to unrelated OSS objects, buckets, pipelines, templates, jobs, and other MPS resources. Data confidentiality, integrity, and availability across the account may be affected. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/oss_delete.py:230

Finding

Force Mode Bypasses Whole-Bucket Recursive Deletion Safeguards

Content

View full analysis

0: print(f"\n⚠️ 严重警告：您正在尝试删除整个 Bucket 的所有内容！", file=sys.stderr) print(f"Bucket: {bucket.bucket_name}", file=sys.stderr) print(f"文件总数：{file_count}", file=sys.stderr) if not force: confirm_msg = input("\n输入 Bucket 名称以确认删除：").strip() if confirm_msg != bucket.bucket_name: print("Bucket 名称不匹配，操作已取消", file=sys.stderr) return False ``` ```python if not safety_check_delete(bucket, args.prefix, is_recursive=True, force=args.force): print("安全检查未通过，操作已取消", file=sys.stderr) return 0 if not args.dry_run and not confirm_delete( f"即将删除 {len(keys)} 个文件（前缀：{args.prefix}）", args.force ): print("操作已取消") return 0 success_count, fail_count = delete_objects_batch( bucket, keys, args.dry_run, args.verbose ) ``` ### Technical Analysis For root-like prefixes, the bucket-name confirmation is performed only when `force` is false. The final confirmation also returns success automatically in force mode. Therefore, a command such as a recursive deletion with prefix `/` and `--force` can bypass all interactive safeguards. The deletion feature is declared and ordinarily asks for confirmation, but allowing force mode to disable the special whole-bucket protection is unsafe. Automation convenience should not override the strongest guard protecting an entire bucket. ### Attack Path 1. Automation, a user, or a compromised caller supplies a root-like prefix such as `/`. 2. The command includes `--recursive --force`. 3. The script lists every object matching the prefix. 4. `safety_check_delete()` detects the dangerous scope but skips bucket-name confirmation because force mode is enabled. 5. `confirm_delete()` also accepts the operation auto ...[truncated 388 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (78)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a functional Alibaba Cloud Media Processing Service workflow skill covering video upload, transcoding, snapshots, moderation, and standardized production flows. The supplied code does none of these tasks. It only checks for the presence of three Python packages using importlib and emits installation instructions. While these dependencies are related to Alibaba Cloud services, this is merely a supporting setup utility, not the described media-processing skill itself. Therefore, the code chunk's actual behavior is materially different from the declared primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a functional media-processing skill that performs video upload, transcoding, snapshots, moderation, and related workflow orchestration. The code shown does not implement any of those media operations. Instead, its primary purpose is operational diagnostics: checking runtime prerequisites, credentials, OSS access, MPS SDK/client setup, and generating a health report. While these checks are related to the Alibaba Cloud MPS ecosystem, they are only supporting/setup behavior and do not match the declared end-user capability of processing video assets. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises a one-stop Alibaba Cloud MPS media-processing skill handling video upload, transcoding, snapshots, moderation, and workflow orchestration. The supplied code does not implement any of those media-processing actions. Instead, it focuses on local environment bootstrapping and credential/configuration support: scanning user home-directory config files, loading environment variables, checking dependencies, inferring OSS regions, and preparing OSS auth. These are support/setup behaviors, but here they are the entirety of the provided code chunk, making the actual primary purpose materially different from the declared skill purpose. Additionally, the code accesses local shell/profile files, which is not disclosed in the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description claims a broad, one-stop MPS video processing skill covering upload, transcoding, snapshots, moderation, and integrated distribution workflows. The supplied code chunk only implements content moderation via MPS media censor APIs: submitting censor jobs, querying job details, polling results, and formatting audit findings. It accepts either a public URL or an OSS object reference, but does not upload media itself. It also does not perform transcoding, multi-resolution output generation, or general snapshot extraction; the only image-related behavior is optional configuration to save abnormal frames from moderation results. Therefore the description materially overstates the implemented functionality and the primary purpose of this code chunk is much narrower than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code chunk is narrowly focused on media information detection via MPS SubmitMediaInfoJob and polling the result. It accepts a public URL or OSS object, creates an MPS client, submits an asynchronous media info job, and formats metadata output. It does not implement the broad workflow described in the declaration: there is no upload handling, no snapshot extraction, no transcoding job submission, no moderation/review logic, and no integrated production pipeline for distribution scenarios. Although media info probing is related to media processing, the declared description materially overstates the implemented functionality, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a comprehensive media-processing skill focused on handling video upload and running MPS workflows like transcoding, snapshots, and moderation. The supplied code does not perform those tasks. Instead, it manages MPS pipeline resources: creating an SDK client, searching/listing pipelines, selecting an active pipeline, and optionally creating new pipelines of specific types (standard, narrowband, audit, smarttag). This is a materially different primary purpose. While pipeline selection could support a larger video-processing system, this code chunk itself only handles infrastructure/resource management and not the advertised end-to-end video processing operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description emphasizes a broad, one-stop media processing workflow centered on video upload, snapshot generation, multi-resolution transcoding, and content moderation. However, the supplied code chunk does not implement those core functions. Instead, it specifically submits MPS SubmitSmarttagJob requests for intelligent analysis of a video, including video/text labels, ASR, OCR, metadata, and summarization-related NLP parameters, and optionally polls for results. This is not merely a subset framed as generic video processing; its primary purpose is materially different from the declared end-to-end production workflow. Therefore the description does not accurately represent the actual code behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description presents a broad, one-stop video processing skill covering video upload, transcoding, snapshot generation, content moderation, and complete distribution workflows. The actual code chunk is narrowly focused on submitting MPS snapshot jobs (normal or sprite thumbnails), formatting results, polling job status, and optionally downloading snapshot outputs from OSS. While snapshot generation is consistent with part of the description, the code does not implement the other prominently declared capabilities such as uploading media, transcoding to multiple resolutions, or moderation. Therefore the description materially overstates the skill's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code chunk is focused specifically on video transcoding. It builds MPS SubmitJobs requests, optionally calls MediaInfoJob to inspect source resolution, supports preset/custom/template-based outputs, submits jobs, and polls for completion. It also performs input validation and pipeline selection. However, it does not implement video upload, snapshot extraction/generation, or content moderation. The declared description presents a broad 'one-stop' MPS workflow covering upload, snapshots, moderation, and full standardized asset production, which materially overstates the actual functionality in this code chunk. The code’s actual primary purpose is narrower: transcoding and related job orchestration only.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description promises a Media Processing Service workflow focused on video upload, transcoding, snapshots, and moderation. The actual code does none of those things. It is solely an OSS object deletion script: it authenticates to OSS, validates keys/prefixes, enumerates objects under a prefix, and deletes one or many objects with confirmations and dry-run support. This is a materially different primary purpose and an undeclared destructive capability affecting OSS storage resources, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description centers on Alibaba Cloud Media Processing Service workflows for video upload and processing. The supplied code does not interact with MPS or implement any video-processing pipeline. Instead, it uses the OSS SDK to access an OSS bucket, generate signed download URLs, and download objects to the local filesystem. This is a materially different primary purpose and accesses a different service/resource type than described. Therefore the description does not accurately represent the code's behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description centers on Alibaba Cloud MPS media-processing functionality: video upload, transcoding, snapshot generation, and content moderation in a unified workflow. However, the code only implements an OSS object listing script. It reads bucket/endpoint configuration, obtains OSS auth, calls oss2.Bucket.list_objects with an optional prefix, and outputs object names, sizes, timestamps, and etags. There are no MPS API calls, no media-processing job creation, no upload pipeline logic beyond listing existing objects, and no moderation or snapshot behavior. This is a materially different primary purpose and accesses a different service surface (OSS object listing vs. MPS processing), so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad Alibaba Cloud Media Processing Service workflow covering video upload plus downstream processing tasks like transcoding, snapshot extraction, and content moderation. The supplied code only implements OSS upload of a local file to an OSS bucket, with input validation, dry-run support, and optional presigned URL generation. There are no calls to MPS APIs, no job submission, no video processing pipeline, and no moderation logic. While video upload is mentioned in the description, the primary purpose and capabilities of this code chunk are materially narrower and centered on OSS storage, not MPS one-stop media processing. Therefore the description does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill instructs users to execute a remote installation script via curl piped directly to bash. This pattern creates a direct remote code execution path if the distribution server, transport, or script content is compromised, and it bypasses normal review of what will run on the host.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

> **Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.

> **Pre-check: Aliyun CLI plugin update required**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The design explicitly scans ~/.env and other shell startup files for environment variables, which are common locations for credentials and sensitive configuration. In an agent/skill context, reading user credential stores and profile files increases exposure to unrelated secrets and broadens the blast radius if later code logs, forwards, or misuses those values.

Content

Scanner excerpt · scripts/load_env.py (reported line 11)May include surrounding context.

python

~/.bashrc
    ~/.profile
    ~/.bash_profile
    ~/.env

  目标变量（只要文件中存在其中任意一个，该文件就会被加载）：
    ALIBABA_CLOUD_OSS_BUCKET

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Including ~/.env in the automatic candidate file list causes the skill to access a file that often contains secrets unrelated to this tool. Even though parsing is line-based and loading is conditional, the file is still read and parsed, which is risky in a multi-tool agent environment handling user data and credentials.

Content

Scanner excerpt · scripts/load_env.py (reported line 284)May include surrounding context.

python

os.path.expanduser("~/.bashrc"),
    os.path.expanduser("~/.profile"),
    os.path.expanduser("~/.bash_profile"),
    os.path.expanduser("~/.env"),
]

# KEY=VALUE 行的正则（支持带引号的值）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mps_snapshot.py (reported line 417)May include surrounding context.

python

oss_key = path
                    files_to_download.append((oss_key, f"snapshot_{time_offset}ms.jpg"))
                except Exception:
                    # Fallback: try to extract key from URL directly
                    if f"{bucket}.{endpoint}" in url:
                        oss_key = url.split(f"{bucket}.{endpoint}/")[-1]
                        files_to_download.append((oss_key, f"snapshot_{time_offset}ms.jpg"))

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill instructs use of shell, network, environment, and file-reading capabilities but does not declare any explicit tool scope such as allowed-tools or permissions. That ambiguity increases the chance an agent will invoke powerful capabilities more broadly than intended, especially in a skill that manages credentials, uploads data, and performs deletion operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description is broad enough that an orchestrating agent may invoke it for generic video-related requests outside the intended Alibaba Cloud MPS workflow. In a skill with upload, cloud processing, credential use, and deletion operations, overbroad triggering increases the risk of unnecessary data transfer or unintended cloud actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes uploading videos and processing artifacts in Alibaba Cloud services but does not clearly warn that user media and derived outputs are transmitted to and stored in OSS/MPS. For user-generated or sensitive video content, that omission can lead to privacy, compliance, or data residency violations if users think processing is local.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The skill documents a force-delete mode that skips confirmation for OSS object deletion. In the context of recursive and cloud-backed storage operations, bypassing confirmation materially increases the risk of accidental or automated destructive actions against user data.

Content

Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.

md

# Delete all files under directory (recursive delete)
python scripts/oss_delete.py --prefix output/ --recursive

# Force delete (skip confirmation, for script automation)
python scripts/oss_delete.py --oss-key output/video.mp4 --force

# Preview mode (view files to be deleted without actually deleting)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/related-commands.md (reported line 74)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version