Get Ali Searches

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:39 PM UTC
• Version:
  1.0.0

Overview

This is a narrow, instruction-only skill for getting Alibaba Cloud related search terms, with no bundled code or hidden behavior found.

Before installing, confirm which MCP server receives the robotId and whether that server is trusted. Treat the robotId as potentially sensitive unless your Alibaba Cloud/RPA setup confirms it is only a non-secret identifier.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation requires a credential-like identifier (`robotId`, explicitly tied to `ALIYUN_RPA_RobotId`) but provides no warning about sensitivity, storage, logging, or sharing risks. Even if `robotId` is not a full secret by itself, exposing operational identifiers in prompts, logs, or transcripts can enable unauthorized use, account correlation, or follow-on attacks in integrated systems.

VirusTotal

66/66 vendors flagged this skill as clean.