Security audit

Alibabacloud Yunxiao Flow Analysis

Security checks across malware telemetry and agentic risk

Overview

The skill mostly fits Yunxiao pipeline troubleshooting, but it also includes live build-container terminal access that is broader and less safely scoped than its read-only framing suggests.

Install only if you explicitly need Yunxiao CI troubleshooting and are comfortable granting access to pipeline logs and, when used, a live build-container terminal. Use the least-privileged read-only PAT available, treat terminalUrl values and retrieved logs as sensitive, review every terminal command before it runs, and avoid using the terminal feature on builds that may contain secrets until TLS verification and stricter command controls are fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (48)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill manifest describes capabilities that read environment variables, files, access the network, and invoke shell commands, but it does not declare permissions accordingly. This weakens reviewability and policy enforcement because consumers may trust the manifest's stated scope while the actual toolset can access sensitive runtime data and execute commands.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior goes beyond pipeline diagnosis into interactive remote terminal access and general command execution, while the description frames the skill as read-only troubleshooting. This mismatch is dangerous because it can mislead operators into approving a skill that enables broader host/container inspection or action, especially when SSL verification is reportedly disabled for the terminal connection.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest claims read-only troubleshooting, yet the listed toolset includes an interactive debug terminal. An interactive terminal materially expands the attack surface because it may permit arbitrary environment inspection, filesystem browsing, and potentially unintended operational actions inconsistent with a read-only support skill.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: For a workflow centered on API and log analysis, an interactive container debug terminal is unnecessary and over-privileged. Even if used for troubleshooting, such access can expose secrets in environment variables, mounted credentials, source code, and internal network details beyond the stated purpose.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The documentation states that no cleanup is required because the skill only performs read operations, but the presence of a debug terminal indicates broader interactive access. This inconsistency can cause underestimation of risk during review and may bypass controls that would normally apply to interactive or command-executing tooling.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill explicitly authorizes obtaining a time-limited terminal URL and executing shell commands on a build machine, which goes beyond passive troubleshooting and grants interactive access to a sensitive execution environment. In the context of a troubleshooting skill, this creates a real risk of command misuse, unintended state changes, or lateral exposure of secrets and infrastructure, especially since the guidance frames shell access as part of normal operation.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill explicitly authorizes connecting to a live build machine through terminalUrl and executing shell commands for troubleshooting. That expands the skill from passive diagnosis into active interactive access on user infrastructure, creating risk of unauthorized changes, secret exposure, environment tampering, and harmful command execution if the agent follows these instructions automatically or with insufficient guardrails.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The documentation explicitly authorizes connecting to a live build machine via terminalUrl and executing shell commands. That expands the skill from passive log analysis into active remote operations on customer infrastructure, creating risk of unintended system changes, access to secrets, or abuse if the agent follows these instructions automatically.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The file initially frames the skill as analyzing logs and a knowledge base, but later permits remote shell access and command execution. This hidden expansion of capability is dangerous because users and higher-level orchestrators may trust the skill as read-only troubleshooting when it can actually perform actions on a build environment.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The documentation expands a log-analysis troubleshooting skill into interactive access to a live build machine via terminalUrl and shell command execution. That materially increases capability from passive diagnosis to active remote system interaction, creating risk of unauthorized modification, data exposure, or misuse of privileged build environments if invoked without strict authorization and guardrails.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: For a skill described as diagnosing pipeline and deployment failures, instructing the agent to connect to a build machine and execute arbitrary shell commands is broader than necessary. This unjustified remote execution capability can be abused to inspect secrets, alter files, disrupt builds, or pivot within the environment under the guise of troubleshooting.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill is described as a pipeline log analysis/troubleshooting capability, but these lines expand it into interactive remote shell access on build machines. That creates a materially different and higher-risk capability because an agent could execute commands on live infrastructure, exposing secrets, modifying artifacts, or impacting running environments beyond passive diagnosis.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Interactive shell access is not justified by the stated purpose of diagnosing pipeline failures from logs. Granting or encouraging terminal access violates least privilege and can turn a read-oriented support workflow into arbitrary command execution on build hosts, which can be abused to inspect secrets, alter source or build outputs, or disrupt CI infrastructure.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to connect to an interactive terminal on the build machine and execute shell commands for troubleshooting. That exceeds passive log analysis and creates a path for arbitrary command execution on CI infrastructure, which could expose secrets, alter build state, or disrupt systems; the surrounding note banning uploads is not a sufficient safety control.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill is presented as a log-analysis and troubleshooting aid, but these lines expand its scope into logging into build machines and running shell commands interactively. That creates a materially different capability boundary: direct execution on CI/build hosts can expose secrets, alter artifacts, or change system state far beyond what is needed for passive diagnosis.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documented ability to connect via terminalUrl and execute arbitrary shell commands on the build machine is not justified by the stated purpose of diagnosing pipeline failures from logs. In CI environments, such access can reveal credentials, source code, environment variables, network topology, and can also modify files or tamper with the build environment, making abuse or accidental damage likely.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill broadens a log-analysis troubleshooting workflow into interactive remote shell access on build machines via terminalUrl and webTerminal.py. This materially increases capability from passive analysis to active command execution on CI infrastructure, creating risk of unauthorized system access, exposure of source code/secrets, and unintended modification of build environments.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The documentation authorizes interactive shell access without clearly demonstrating that such privileged access is necessary for the stated purpose of diagnosing pipeline failures and reporting causes. Unjustified shell access violates least privilege and can be abused to inspect files, environment variables, credentials, network reachability, or alter the machine state beyond troubleshooting needs.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documentation explicitly instructs the agent to obtain a terminal URL and execute shell commands on the build machine for troubleshooting. That exceeds passive log analysis and creates a path for arbitrary command execution in a sensitive CI/build environment, which could expose secrets, modify artifacts, alter source state, or disrupt builds.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The documented `webTerminal.py` capability expands the skill from passive troubleshooting into interactive shell access on a live container environment. That materially increases the attack surface because an agent or user following the documentation could execute arbitrary commands, modify systems, access secrets, or disrupt workloads beyond the stated diagnostic scope.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The documentation states all scripts authenticate exclusively through `YUNXIAO_ACCESS_TOKEN`, but the web terminal command is an exception that takes only a `terminalUrl`. This inconsistency can mislead reviewers and users about the actual trust boundary and authentication model, potentially causing them to treat a bearer-style terminal URL as lower risk than it is.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The authentication section broadly claims all scripts use `x-yunxiao-token`, yet the terminal-login script appears to bypass that model in favor of a terminal URL. This creates inaccurate security assurances and can lead operators or downstream agents to mishandle a powerful access artifact, increasing the chance of unauthorized shell access if the URL is exposed.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The verification script constructs shell command strings with interpolated user-controlled parameters and executes them via os.popen. Even though this is presented as a verification example, it normalizes shell execution inside a troubleshooting skill and creates command-injection risk if operators paste untrusted org, pipeline, or domain values.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: This second example repeats the same unsafe pattern for log retrieval, building a shell command from multiple external parameters and executing it through os.popen. Because the skill handles operational identifiers and domains that may come from tickets, logs, or users, the context increases the chance that malicious input could trigger arbitrary local command execution.

Context-Inappropriate Capability

Low

Confidence: 80% confidence
Finding: The minimal working example also demonstrates shell execution with interpolated variables, which broadens the accepted pattern for users copying the code. While simpler than the full workflow, it still teaches an unsafe invocation style that can become exploitable when values are attacker-controlled.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.generated_source_template_injection, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/ram-policies.md:42

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:39

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: references/acceptance-criteria.md:226

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/webTerminal.py:56