Security audit

Alibabacloud Wxz Website Builder

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for building websites through Alibaba Cloud, but it uses cloud credentials and remote actions with weak user-control and credential-handling guidance.

Review before installing. Use a dedicated low-privilege RAM user or short-lived credentials, avoid storing AccessKey secrets in shell profiles, restrict credential-file permissions, confirm which Alibaba Cloud identity will be used, and require approval before accepting later requirement defaults or starting/restarting preview sandboxes.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: references/ak-setup-guide.md:52
Finding: Persistent Plaintext Storage of Long-Lived Alibaba Cloud AccessKey Secrets
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

Location: references/ram-policies.md:18
Finding: RAM Policy Grants an Unimplemented Retry Operation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill performs actions implying access to environment-based credentials and writes files under an output directory, but it does not declare an explicit tool scope or permission boundary. This increases the chance that an agent executes the skill with broader capabilities than the user expects, especially where cloud credentials and local filesystem access are involved.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
Validation

bash
mkdir -p output/alibabacloud-wxz-website-builder for f in skills/ai/service/alibabacloud-wxz-website-builder/scripts/*.py; do python3 -m py_compile "$f" done

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs storing conversation IDs and event summaries in evidence files, but gives no retention, sensitivity, or redaction guidance. These identifiers and summaries may contain user prompts, project details, or metadata that can persist beyond the task and be exposed to other processes or operators.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Retaining conversation identifiers and event summaries creates session persistence across user interactions without clear necessity or safeguards. In context, these artifacts can link user actions, prompts, and generated outputs, increasing privacy and correlation risks if logs or output directories are later accessed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs use of the default Alibaba Cloud credential chain, including environment variables, local credential files, and instance metadata, without warning that existing credentials may be discovered and used automatically. In an agent setting, this can cause unintended use of privileged cloud identities and remote actions under the user's account.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 92% confidence
Finding: The skill instructs the agent to auto-fill all subsequent human-in-the-loop rounds with defaults and resume immediately without asking the user. This removes meaningful user review over additional requirements or choices, and could cause unintended project scope, content, or downstream remote actions based on assumptions the user never approved.
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
md
This phase collects requirements and generates a PRD. The platform may ask multiple HITL rounds (basic info → features → language, etc.). To keep things fast: - **Only the first HITL round** should be shown to the user (basic project info). - **All subsequent HITL rounds** must be auto-filled with the form's default/pre-selected values and resumed immediately — do NOT ask the user. ### Step 1: Fire requirement collection

Behavior Manipulation

Medium

Category: Prompt Injection
Confidence: 78% confidence
Finding: The instruction to always use platform-provided defaults instead of prompting the user nudges the agent to bypass user agency in favor of system-selected answers. While not overtly malicious, this is a manipulative workflow pattern that can steer outcomes and mask important choices from the user.
Content: Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.
--user-navigation generate_prd --hidden --without-refer

text
**Key rule**: The platform's `AskUserQuestion` event always includes an `answers` field with sensible defaults. For rounds after the first, always use these defaults directly instead of prompting the user. ## Phase 3: Code Generation

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 91% confidence
Finding: The decision table codifies autonomous continuation using default answers for interrupted rounds, reinforcing a workflow where the agent acts on behalf of the user without explicit consent. In a cloud website-building context, those defaults can affect generated content, configuration, and external resource usage.
Content: Scanner excerpt · SKILL.md (reported line 258)May include surrounding context.
md
| `summary.chatStatus` | `summary.hasPrd` | Phase | Action | |----------------------|-------------------|-------|--------| | `interrupt` | — | 2 (first round) | Parse AskUserQuestion, collect answers **from user**, resume with `--phase generate_prd` | | `interrupt` | — | 2 (subsequent) | **Auto-fill** with default `answers` from the AskUserQuestion event, resume immediately — do NOT ask user | | `success` | `true` | 2 | PRD ready → proceed to Phase 3 | | `success` | `false` | 3 | Site is ready → call `get-preview-url` → show link + preview URL | | `fail` | — | any | Ask user whether to retry |

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/ak-setup-guide.md (reported line 9)May include surrounding context.
md
Open https://www.aliyun.com and log in with your Alibaba Cloud account. > If you don't have an account yet, click "Free Registration" to create one. ## Step 2: Create a RAM User (Recommended)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/aistaff_api.py (reported line 85)May include surrounding context.
python
# --------------------------------------------------------------------------- def create_client(region_id: str | None = None) -> OpenApiClient: """Create an OpenAPI client using the Alibaba Cloud default credential chain. Credential resolution order (handled automatically by alibabacloud_credentials): 1. Environment variables (ALIBABACLOUD_ACCESS_KEY_ID / ALIBABACLOUD_ACCESS_KEY_SECRET)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill directs calling get-preview-url, which may start a remote sandbox, but does not clearly frame this as a billable or state-changing remote operation requiring user awareness. This can surprise users by triggering external service activity and exposing generated content through a live preview endpoint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file describes sending Text and later full Messages payloads containing user content to a remote API, but it does not include any warning that user-entered content is transmitted to an external service. Under the markdown-specific SQP-2 criteria, descriptions of behaviors affecting user data or privacy should disclose that impact.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The GetAIStaffPreviewUrl documentation states that the first call starts the sandbox and that Restart=true restarts the app after site modifications, which can affect running system state. The section describes the behavior but does not present it as a cautionary warning about system-impacting side effects.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Undeclared Tool Scope

Session Persistence

Validation

Missing User Warnings

Ssd 3

Missing User Warnings

Autonomous Decision Making

Behavior Manipulation

Autonomous Decision Making

Session Persistence

Session Persistence

Missing User Warnings

Missing User Warnings

Missing User Warnings

Static analysis