T09 · Insecure Skill Coding Practices
Error
- Location
scripts/yunxiao_flow_get_pipeline_runs.py:87- Finding
Yunxiao Personal Access Token Can Be Sent to an Arbitrary Host
- Content
View full analysis
- Remediation
View remediation
Security audit
Alibabacloud Yunxiao Flow Analysis
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a Yunxiao pipeline troubleshooting tool, but it includes under-scoped remote terminal access and credential-handling weaknesses that users should review carefully.
Install only if you are comfortable granting the skill access to Yunxiao pipeline logs and, in debug cases, a live build-container terminal. Use a least-privilege read-only PAT, only use trusted Yunxiao domains and terminal URLs, avoid displaying secret-bearing files, and treat any suggested shell command or cache deletion as requiring explicit review.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/webTerminal.py:31- Finding
Web Terminal Disables TLS Verification and Trusts an Unrestricted Hostname
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/webTerminal.py:116- Finding
Remote Terminal Command Allowlist Can Be Bypassed with Shell Syntax
- Content
View full analysis
cat /dev/null && grep x /dev/null | ls $() cat /dev/null > ``` Because the backend receives the entire command, the actual security boundary depends on remote shell parsing rather than the local allowlist. The implementation therefore does not enforce its stated read-only restrictions. ### Attack Path 1. The operator connects to a Yunxiao debug terminal. 2. An attacker-controlled instruction or malicious diagnostic suggestion supplies a command beginning with an allowed token. 3. For example, the input starts with `pwd` but appends a semicolon and another command. 4. `validate_command()` extracts only `pwd` and returns `True`. 5. The comple ...[truncated 737 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/flow_build_java.md:37- Finding
Troubleshooting Instructions Can Print Repository Credentials from Build Configuration
- Content
View full analysis
0: ...[truncated 1922 chars]- Remediation
View remediation
` and `` values - Maven server tokens and private keys - npm `_auth` and `_authToken` - Registry-scoped authentication entries - Password and email fields where sensitive 4. Perform redaction inside the terminal environment before data is returned. 5. Add output filtering in `webTerminal.py` as defense in depth. 6. Warn operators never to display secret-bearing configuration or unrestricted environment output. 7. If disclosure may already have occurred, revoke and rotate the affected repository credentials. ]]>
T08 · Insecure Dependencies
Error
- Location
references/flow_build_python.md:32- Finding
Python Dependencies Are Recommended for Installation over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/flow_build_docker.md:72- Finding
Forced Global BuildKit Cache Deletion Is Recommended Without Scope or Confirmation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (104)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest presents the skill as read-only troubleshooting, but the documented behavior includes a remote WebSocket terminal and interactive shell access into an execution environment. That mismatch is dangerous because operators may authorize the skill expecting passive log analysis while it actually enables remote command execution, materially expanding attack surface and potential for misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The manifest presents the skill as read-only troubleshooting, but the documented behavior includes a remote WebSocket terminal and interactive shell access into an execution environment. That mismatch is dangerous because operators may authorize the skill expecting passive log analysis while it actually enables remote command execution, materially expanding attack surface and potential for misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The manifest presents the skill as read-only troubleshooting, but the documented behavior includes a remote WebSocket terminal and interactive shell access into an execution environment. That mismatch is dangerous because operators may authorize the skill expecting passive log analysis while it actually enables remote command execution, materially expanding attack surface and potential for misuse.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Environment Variable | Description | Required | |---------------------|-------------|----------| | YUNXIAO_ACCESS_TOKEN | Yunxiao Personal Access Token (format: `pt-xxx`) | Yes | ## Authentication
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Environment Variable | Description | Required | |---------------------|-------------|----------| | YUNXIAO_ACCESS_TOKEN | Yunxiao Personal Access Token (format: `pt-xxx`) | Yes | ## Authentication
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Environment Variable | Description | Required | |---------------------|-------------|----------| | YUNXIAO_ACCESS_TOKEN | Yunxiao Personal Access Token (format: `pt-xxx`) | Yes | ## Authentication
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Environment Variable | Description | Required | |---------------------|-------------|----------| | YUNXIAO_ACCESS_TOKEN | Yunxiao Personal Access Token (format: `pt-xxx`) | Yes | ## Authentication
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python | Environment Variable | Description | Required | |---------------------|-------------|----------| | YUNXIAO_ACCESS_TOKEN | Yunxiao Personal Access Token (format: `pt-xxx`) | Yes | ## Authentication
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python | Environment Variable | Description | Required | |---------------------|-------------|----------| | YUNXIAO_ACCESS_TOKEN | Yunxiao Personal Access Token (format: `pt-xxx`) | Yes | ## Authentication
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python | Environment Variable | Description | Required | |---------------------|-------------|----------| | YUNXIAO_ACCESS_TOKEN | Yunxiao Personal Access Token (format: `pt-xxx`) | Yes | ## Authentication
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python | Environment Variable | Description | Required | |---------------------|-------------|----------| | YUNXIAO_ACCESS_TOKEN | Yunxiao Personal Access Token (format: `pt-xxx`) | Yes | ## Authentication
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | [flow_variables.md](references/flow_variables.md) | Pipeline variable configuration |
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 89% confidence
- Finding
The debug-mode guidance encourages the analyst/operator to proceed with interactive machine access and live command execution as part of normal troubleshooting. In security terms, this weakens safe refusal boundaries by normalizing direct operational access to a privileged environment, which can be abused for unauthorized inspection, modification, or disruption of pipeline assets.
- Content
md Job workspace must be obtained from the `PROJECT_DIR` in the Pipeline Cache step ## terminalUrl If the job has debug mode enabled (i.e., the debugPolicy field in the job's params object is not none), you can request the terminalUrl from the user to log into the build machine and execute shell commands to troubleshoot issues and verify solutions. Since the terminalUrl link has a time limit, use `webTerminal.py` to connect first before troubleshooting or solution verification. **Note**: Executing any upload commands is prohibited. Every command executed and its results must be displayed. Execute `exit` to quit when troubleshooting is complete. Commands need a newline character \n to trigger execution.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 77% confidence
- Finding
The wording around debug mode and immediate use of webTerminal.py encourages the agent/operator to proceed with interactive troubleshooting rather than maintaining normal safety boundaries. While not overtly malicious, this pushes toward bypassing safer, passive analysis modes and can pressure downstream systems or operators into executing commands in a sensitive environment.
- Content
md Job workspace must be obtained from the `PROJECT_DIR` in the Pipeline Cache step ## terminalUrl If the job has debug mode enabled (i.e., the debugPolicy field in the job's params object is not none), you can request the terminalUrl from the user to log into the build machine and execute shell commands to troubleshoot issues and verify solutions. Since the terminalUrl link has a time limit, use `webTerminal.py` to connect first before troubleshooting or solution verification. **Note**: Executing any upload commands is prohibited. Every command executed and its results must be displayed. Execute `exit` to quit when troubleshooting is complete. Commands need a newline character \n to trigger execution. ## Maven Build Information
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The document discusses inspecting /root/.npmrc during builds, and .npmrc files commonly contain registry credentials or auth tokens. Telling an agent to access or display that file creates a realistic credential exposure path, especially in CI environments where tokens are often provisioned automatically.
- Content
md ## npm/pnpm/cnpm Build Information 1. During `npm/pnpm/cnpm` build, it references `/root/.npmrc` by default. If there is an `npmrc` file in the current directory, the current directory's `npmrc` file takes priority. 2. The `Configure .npmrc File` pipeline step downloads the `npmrc` file from the pipeline global configuration. The file should be downloaded to `/root/.npmrc` (recommended), or to the directory where the build command is executed. 3. If the build fails, you can view the `.npmrc` used during the build via the `cat` command.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
Referring to /root/.npmrc in conjunction with viewing it during troubleshooting increases the likelihood of accessing a privileged user's credential file. Because this is in a CI/build context, the file may contain organization-wide package registry credentials with meaningful reuse value.
- Content
md ## npm/pnpm/cnpm Build Information 1. During `npm/pnpm/cnpm` build, it references `/root/.npmrc` by default. If there is an `npmrc` file in the current directory, the current directory's `npmrc` file takes priority. 2. The `Configure .npmrc File` pipeline step downloads the `npmrc` file from the pipeline global configuration. The file should be downloaded to `/root/.npmrc` (recommended), or to the directory where the build command is executed. 3. If the build fails, you can view the `.npmrc` used during the build via the `cat` command. ## Job Working Directory
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
Referring to /root/.npmrc in conjunction with viewing it during troubleshooting increases the likelihood of accessing a privileged user's credential file. Because this is in a CI/build context, the file may contain organization-wide package registry credentials with meaningful reuse value.
- Content
md ## npm/pnpm/cnpm Build Information 1. During `npm/pnpm/cnpm` build, it references `/root/.npmrc` by default. If there is an `npmrc` file in the current directory, the current directory's `npmrc` file takes priority. 2. The `Configure .npmrc File` pipeline step downloads the `npmrc` file from the pipeline global configuration. The file should be downloaded to `/root/.npmrc` (recommended), or to the directory where the build command is executed. 3. If the build fails, you can view the `.npmrc` used during the build via the `cat` command. ## Job Working Directory
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The guidance continues to normalize handling .npmrc in the build command directory, which may still contain plaintext tokens or scoped registry credentials. Even when not under /root, directing agents to inspect such files can leak secrets into logs or conversation transcripts.
- Content
md ## npm/pnpm/cnpm Build Information 1. During `npm/pnpm/cnpm` build, it references `/root/.npmrc` by default. If there is an `npmrc` file in the current directory, the current directory's `npmrc` file takes priority. 2. The `Configure .npmrc File` pipeline step downloads the `npmrc` file from the pipeline global configuration. The file should be downloaded to `/root/.npmrc` (recommended), or to the directory where the build command is executed. 3. If the build fails, you can view the `.npmrc` used during the build via the `cat` command. ## Job Working Directory Job workspace must be obtained from the `PROJECT_DIR` in the Pipeline Cache step
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 88% confidence
- Finding
The debug-mode guidance normalizes logging into the build machine and using webTerminal.py as part of the expected workflow, which can pressure an agent to bypass ordinary caution around remote command execution. Although it does not explicitly say to ignore safety policies, it encourages operational behavior that weakens refusal boundaries for risky actions.
- Content
md Job workspace must be obtained from the `PROJECT_DIR` in the Pipeline Cache step ## terminalUrl If the job has debug mode enabled (i.e., the debugPolicy field in the job's params object is not none), you can request the terminalUrl from the user to log into the build machine and execute shell commands to troubleshoot issues and verify solutions. Since the terminalUrl link has a time limit, use `webTerminal.py` to connect first before troubleshooting or solution verification. **Note**: Executing any upload commands is prohibited. Every command executed and its results must be displayed. Execute `exit` to quit when troubleshooting is complete. Commands need a newline character \n to trigger execution.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Common Issues ### error An unexpected error occurred "xxxxxxxx" No module found 1. First ask if the dependencies are stored in a private repository. If they are private repository dependencies, you need to configure `/root/.npmrc`, or configure `.npmrc` in the directory where the build command is executed. ### Installing Node version reports specified version not found
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Common Issues ### error An unexpected error occurred "xxxxxxxx" No module found 1. First ask if the dependencies are stored in a private repository. If they are private repository dependencies, you need to configure `/root/.npmrc`, or configure `.npmrc` in the directory where the build command is executed. ### Installing Node version reports specified version not found
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Common Issues ### error An unexpected error occurred "xxxxxxxx" No module found 1. First ask if the dependencies are stored in a private repository. If they are private repository dependencies, you need to configure `/root/.npmrc`, or configure `.npmrc` in the directory where the build command is executed. ### Installing Node version reports specified version not found
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documented purpose is troubleshooting deployment failures, but the instructions authorize logging into build machines and executing shell commands without establishing strict necessity, scope limits, or safety controls. This creates a privilege/capability mismatch where an analysis skill can perform operational actions on hosts, increasing the risk of unintended changes, data access, or abuse.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 88% confidence
- Finding
The debug-mode section encourages proceeding with terminal access and troubleshooting actions when the relevant condition is met, which acts as anti-refusal pressure around a sensitive capability. Although not overtly malicious, this framing reduces safety friction and can push an agent toward executing risky remote actions instead of stopping for stronger authorization or safer alternatives.
- Content
md Job workspace must be obtained from the `PROJECT_DIR` in the Pipeline Cache step ## terminalUrl If the job has debug mode enabled (i.e., the debugPolicy field in the job's params object is not none), you can request the terminalUrl from the user to log into the build machine and execute shell commands to troubleshoot issues and verify solutions. Since the terminalUrl link has a time limit, use `webTerminal.py` to connect first before troubleshooting or solution verification. **Note**: Executing any upload commands is prohibited. Every command executed and its results must be displayed. Execute `exit` to quit when troubleshooting is complete. Commands need a newline character \n to trigger execution. ## Troubleshooting Steps
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs the agent to obtain a terminal URL, log into a build machine, and execute shell commands for troubleshooting. That expands a diagnostic/documentation skill into an operational remote-access capability, creating risk of command execution on customer infrastructure, exposure of secrets in the build environment, and unintended system modification even if uploads are forbidden.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal, suspicious.generated_source_template_injection, suspicious.insecure_tls_verification
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/ram-policies.md:42
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:39
User-controlled placeholder is embedded directly into generated source code.
Critical
- Code
- suspicious.generated_source_template_injection
- Location
- references/acceptance-criteria.md:226
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- scripts/webTerminal.py:56