alibabacloud-ai-innovation-lab-skill

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly requires outputting deploy_url "原样完整输出" and forbids stripping or parameter removal, which forces the LLM to reproduce any embedded query parameters or tokens verbatim — creating an exfiltration risk if those URLs contain secrets or API tokens.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—at runtime the required workflow runs python scripts/fetch_ai_lab.py --summary and --format json, which fetches and parses outsider-authored public web content from https://www.aliyun.com/daily-act/ecs/ai-innovation-lab (or the OSS snapshot URL) and then injects the resulting scraped/free-text fields (titles/descriptions/URLs) into the agent’s LLM response context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches live page content and an OSS JSON snapshot at runtime and injects those fetched fields (e.g., deploy_url, parent_tabs counts) directly into the agent's output, notably from https://www.aliyun.com/daily-act/ecs/ai-innovation-lab and https://ai-innovation-lab.oss-cn-beijing.aliyuncs.com/ai-innovation-lab.json, so these URLs are runtime dependencies that directly control prompts.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill explicitly instructs the agent to "create cron" scheduled tasks (including a "system crontab fallback") and persist subscription state, which modifies the host's state and could require elevated privileges or system-level changes.