ClawHub
Back to skill

Security audit

alibabacloud-waf-report

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only Alibaba Cloud WAF reporting skill with clear boundaries; its main privacy consideration is that optional IP ownership lookups send queried IP addresses to ipinfo.io.

Install this only for authorized Alibaba Cloud WAF assessments. Use a dedicated least-privilege read-only RAM identity, avoid supplying raw credentials, redact sensitive values in outputs, and skip or separately approve external ipinfo.io lookups when customer IP telemetry or incident indicators must not leave the approved environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill documents sending IP addresses to a third-party service (ipinfo.io) for enrichment but does not explicitly warn that this shares customer-observed indicators with an external provider. In a security reporting workflow, those IPs may be sensitive operational data, so analysts could unintentionally disclose customer traffic details or incident indicators outside the approved environment.

Static analysis

No suspicious patterns detected.