Security audit

alibabacloud-yike-cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Yike cloud media CLI helper, but it needs Review because its automatic mode can skip the normal post-estimate confirmation for credit-consuming cloud submissions and uploads.

Install only if you are comfortable with Yike receiving the prompts and media you ask it to process and with the CLI using your Yike account credits. Avoid using phrases like 'do not ask' or 'submit directly' unless you intend to bypass the post-estimate confirmation for that task.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill’s 'Automated Execution Mode' explicitly overrides the earlier safeguard requiring a post-estimate confirmation before submitting credit-consuming generation jobs. That creates a path for autonomous cloud actions and billing-triggering submissions without a fresh, informed user consent step, increasing the risk of unintended charges and unauthorized remote processing.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill is designed to upload local files and chat attachments to a remote cloud service, but it does not require a clear user-facing privacy warning at the point of transfer. That can lead users to unknowingly send sensitive local or attachment data off-device, especially when local paths exposed by the agent are treated as eligible upload inputs.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The automated mode permits direct cloud operations and submission without requiring a user-facing warning that local files, prompts, or attachments may be sent to a remote service. In context, this is more dangerous because the skill specifically orchestrates uploads and media generation against a cloud API, so silent automation can cause both privacy leakage and unintended spend.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger scope explicitly activates this skill when the user provides only a vague intent, which can cause the agent to over-assume the user’s goals and generate prompts or perform preparatory actions without sufficient user specificity. In a media-generation skill that can lead to uploads, credit estimation, and eventual paid submission flows, broad activation increases the chance of unintended tool use or incorrect transformation of user intent.

Natural-Language Policy Violations

Medium

Confidence: 77% confidence
Finding: The instruction to prefer Simplified Chinese without user opt-in can cause the agent to rewrite or generate prompt content in a language the user did not request, which may distort brand copy, text rendering requirements, or user intent. In an image-generation context this is mainly an integrity and UX risk, but it can also affect output correctness when exact wording matters.

Ssd 4

Medium

Confidence: 90% confidence
Finding: This section systematically weakens safeguards by allowing the agent to skip confirmation, ignore login-state gating, and proceed non-interactively. While not exploit code, it normalizes autonomous execution of sensitive and potentially billable remote actions, reducing defense-in-depth and making accidental misuse more likely.

Static analysis

No suspicious patterns detected.