alibabacloud-web-application-attacks-analysis

• Outcome: Pass
• Latest audit: Aug 31, 2026 · 2:15 AM UTC
• Version: 0.0.1

Overview

This skill analyzes a user-provided web access log locally and writes a report, with no evidence of network use, credential access, persistence, or destructive behavior.

Installers should understand that this is not strictly filesystem read-only: it will read the log file you name and save a generated report, by default under the skill's output directory with a fallback to the current working directory. Use an explicit --output path if you want tighter control over where reports are written, and only provide logs you are comfortable analyzing locally because access logs can contain IPs, URLs, user agents, and other operational data.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill is described as read-only and no-credentials, but it instructs execution of a local Python script and documents report output paths, which implies shell execution, file reads, and file writes without an explicit permission declaration. This mismatch is dangerous because users or policy engines may trust the metadata while the skill can access local files and create artifacts, increasing the chance of over-privileged or unexpectedly executed behavior.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill advertises itself as read-only, but the script generates and saves report files by default. This is a security-relevant integrity issue because users and orchestrators may grant broader trust to a supposedly non-mutating skill, and the file writes can alter the local filesystem outside the input log.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The code creates an output directory, writes a probe file, and writes the final report even though the documentation says it only processes the specified input file offline and read-only. This mismatch can violate sandbox or policy expectations and may cause unintended writes in the skill directory or current working directory.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The module docstring makes strong assurances that the analyzer never modifies files and only handles the user-specified input, but the implementation writes additional files. In an agent skill context, deceptive safety claims are dangerous because they can cause operators to run the tool with permissions they would not otherwise grant.

Static analysis

No suspicious patterns detected.