ClawHub
Back to skill

Security audit

alibabacloud-waf-lua-extension-dev

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documentation-style helper for creating Alibaba Cloud WAF Lua plugins, with the traffic-blocking impact clearly disclosed and manually controlled.

Installers should understand that this skill helps produce WAF logic that may block real web traffic after manual console deployment. Review generated Lua carefully, keep secrets in KMS-backed parameters, run the console debug cases, and associate the plugin with production rules only after confirming the block conditions are narrow enough.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Env Variable Harvesting

High
Category
Data Exfiltration
Content
**Parameter value - manual input**: fill in the concrete value directly.

**Parameter value - KMS credential**: reference an existing credential in Key Management Service (KMS) to store sensitive data securely. The credential must be bound with a tag before it can be referenced by WAF:

| Tag Key | Tag Value |
| --- | --- |
Confidence
24% confidence
Finding
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Static analysis

No suspicious patterns detected.