ClawHub
Back to skill

Security audit

Alibabacloud Waf Security Monitor

Security checks across malware telemetry and agentic risk

Overview

This WAF monitoring skill is mostly purpose-aligned, but it needs Review because it can change the local CLI/plugin environment and writes raw WAF inspection data to a shared temporary log file.

Install only if you are comfortable letting the agent use an existing Alibaba Cloud profile, update Aliyun CLI plugins, and create a raw WAF output log. Prefer installing the CLI/plugins yourself, use least-privilege read-only RAM credentials or temporary credentials, avoid pasting access keys into chats or shell history, and delete or protect /tmp/waf_skill_output.log after the run.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill is presented as a read-only monitoring workflow, but it changes host-side CLI state by enabling auto plugin installation and updating plugins. Even though these are local changes rather than cloud resource mutations, they expand execution capability and can alter the operator environment in ways unrelated to the inspection task.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
Enabling automatic plugin installation allows the tool to fetch and execute additional code on demand, which is unnecessary for a monitoring-only skill and increases supply-chain and arbitrary code execution risk. In this context, the skill is supposed to inspect WAF state, so adding a capability to install executable extensions makes the behavior materially more dangerous.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The documentation claims all permissions and operations are read-only and that no resources are provisioned, but the workflow still mutates the local execution environment. This mismatch can mislead users and downstream agents into granting more trust than warranted, causing hidden local-side changes to be executed without informed consent.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The guide demonstrates configuring long-lived Access Key credentials and shows they are stored in a local config file before giving strong, upfront warnings about credential sensitivity and safer alternatives. In an agent/automation context, this can normalize insecure handling of secrets, increasing the chance that users paste real keys into shell history, CI logs, screenshots, or persist them on disk without proper controls.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The guide explicitly instructs appending full CLI command output to /tmp/waf_skill_output.log without any warning, redaction, or access-control guidance. WAF API responses can include sensitive operational data such as instance identifiers, domain/configuration details, traffic and attack telemetry, and error payloads; writing these verbatim to a shared temporary location increases the risk of unintended disclosure to other local users, processes, or support tooling.

External Script Fetching

High
Category
Supply Chain
Content
**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions.

**Pre-check: Aliyun CLI plugin update required**
Confidence
99% confidence
Finding
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.