Aliyun AI Guardrail

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:42 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent guardrail purpose, but it installs a persistent always-on hook that broadly intercepts requests and stores cloud credentials with insufficient scoping and safety guidance.

Review carefully before installing. Use only a dedicated least-privilege Alibaba Cloud RAM credential, avoid committing openclaw.json, restrict file permissions, and install only in environments where all agent-session LLM-like request content may be sent to Alibaba Cloud and potentially rewritten. Prefer a version with endpoint allowlisting, bounded caching, sanitized logs, pinned dependencies, and a clear disable/uninstall path.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T08 · Insecure Dependencies

Warning

• Location: assets/aliyun-ai-guardrail/package.json:8

Finding

Non-Reproducible Installation of Unlocked Third-Party Dependencies

Content

View full analysis

/aliyun-ai-guardrail "$TMPDIR/aliyun-ai-guardrail" cd "$TMPDIR/aliyun-ai-guardrail" && npm install openclaw hooks install "$TMPDIR/aliyun-ai-guardrail" ``` ```json "dependencies": { "@alicloud/openapi-client": "^0.4.12" } ``` ### Technical Analysis The installation procedure runs `npm install` without a committed lockfile or package-integrity verification. The caret version range permits npm to resolve a version newer than the one originally reviewed. Transitive dependency versions are also resolved at installation time. Depending on the packages selected by the registry, npm may execute dependency lifecycle scripts during installation. Consequently, reviewing this repository alone does not establish the exact code that will be installed and executed on a user's system. ### Attack Path 1. An attacker compromises the declared dependency, one of its transitive dependencies, or the relevant package-publishing account. 2. A malicious version satisfying `^0.4.12` is published. 3. A user follows the documented installation procedure. 4. `npm install` resolves and downloads the compromised version. 5. Malicious lifecycle code executes during installation, or malicious runtime code executes when the hook loads. 6. The code runs with the privileges of the user operating OpenClaw and can access data available to that process. ### Impact Assessment A compromised package could execute arbitrary code with the installing user's privileges. It could read OpenClaw configuration, access Alibaba Cloud credentials available in the process environment, modify installed hooks, or communicate with external systems. The scope is limited by the operating-system privileges and filesyst ...[truncated 37 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:22

Finding

Long-Lived Alibaba Cloud Secret Stored in Plaintext Configuration

Content

View full analysis

", "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "" } } ``` ``` ### Technical Analysis The instructions require collecting a reusable Alibaba Cloud AccessKey secret and persisting it directly in `openclaw.json`. No requirement is provided for restrictive file permissions, secret-manager storage, short-lived credentials, least-privilege policies, repository exclusions, or credential rotation. A project-root configuration file may be accidentally committed to source control, included in backups, or made readable to unrelated local users and processes. Persisting the secret also increases the exposure period compared with short-lived credential delivery. ### Attack Path 1. The user supplies an Alibaba Cloud AccessKey ID and AccessKey Secret. 2. The agent writes the credentials into `openclaw.json`. 3. The file is exposed through permissive filesystem permissions, a repository commit, a backup, malware, or another local process. 4. An attacker recovers the reusable secret. 5. The attacker authenticates to Alibaba Cloud and invokes any operation permitted by the associated identity. ### Impact Assessment The attacker obtains the cloud permissions assigned to the compromised AccessKey. The precise scope depends on the associated Alibaba Cloud RAM policies. If the credential is not restricted to the guardrail API, compromise could ...[truncated 67 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Warning

• Location: assets/aliyun-ai-guardrail/hooks/aliyun-ai-guardrail/handler.ts:90

Finding

Process-Wide Fetch Replacement Intercepts Unrelated Requests

Content

View full analysis

{ if ((init as any)?.[SECURITY_MARKER]) { return originalFetch(input, init as any); } try { const bodyText = typeof init?.body === 'string' ? init.body : ''; if (bodyText && bodyText.startsWith('{')) { const parsed = JSON.parse(bodyText); if (Array.isArray(parsed?.messages) && parsed.messages.length > 0) { const url = typeof input === 'string' ? input : (input instanceof URL ? input.href : (input as Request).url); let bodyChanged = false; // Message inspection and replacement occur here. } } } catch (err) { const bodyPreview = typeof init?.body === 'string' ? init.body.slice(0, 200) : String(init?.body); console.warn(`[aliyun-ai-guardrail] fetch inspect error: ${(err as Error).message}, body: ${bodyPreview}`); } const markedInit = init ? { ...init, [SECURITY_MARKER]: true } : { [SECURITY_MARKER]: true }; return originalFetch(input, markedInit as any); }; globalThis.fetch = patchedFetch; ``` ### Technical Analysis The bootstrap hook replaces the process-wide `globalThis.fetch` function. It treats any string JSON request containing a nonempty `messages` array as an LLM request, regardless of the destination hostname, URL path, HTTP method, initiating component, or expected schema. As a result, unrelated OpenClaw components and third-party modules share the modified networking primitive. Their request content may be inspected, submitted to Alibaba Cloud for classification, delayed by the guardrail request, or rewritten if it resembles a chat payload. This introduces a broad trust boundary and compatibility change be ...[truncated 1050 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/aliyun-ai-guardrail/hooks/aliyun-ai-guardrail/handler.ts:26

Finding

Collision-Prone Cache Can Reuse a Verdict for Different Content

Content

View full analysis

(); function hashContent(content: string): string { let h = 0; for (let i = 0; i < content.length; i++) { h = ((h << 5) - h + content.charCodeAt(i)) | 0; } return String(h); } ``` ```typescript const key = hashContent(lastUserContent); if (!contentCache.has(key)) { console.log(`[aliyun-ai-guardrail] LLM request detected -> ${url.slice(0, 80)}, checking content...`); try { const { blocked, reasons } = await checkContent(lastUserContent); if (blocked) { const reason = reasons.join('; '); const blockText = `[aliyun-ai-guardrail][⚠️ Current user message MUSKED by Aliyun AI Guardrail: ${reason}. Please explain this to the user.]`; contentCache.set(key, { blocked: true, blockText }); } else { contentCache.set(key, { blocked: false, blockText: '' }); } } catch (err) { contentCache.set(key, { blocked: false, blockText: '' }); } } const cached = contentCache.get(key); if (cached?.blocked) { replaceUserContent( parsed.messages.find((m: any) => getUserContent(m) === lastUserContent && m.role === 'user'), cached.blockText ); bodyChanged = true; } ``` ### Technical Analysis The cache key is a signed 32-bit rolling hash. It is not collision-resistant, and the cache does not store and compare the original content before reusing a security verdict. Two different strings can therefore produce the same key and share the same allow or block result. Because the hash algorithm is deterministic and simple, an attacker who can submit repeated content may search for or construct collisions. An allowed cached entry can suppress scanning of different malicious conten ...[truncated 993 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: assets/aliyun-ai-guardrail/hooks/aliyun-ai-guardrail/handler.ts:26

Finding

Unbounded Process-Lifetime Content Cache Enables Memory Exhaustion

Content

View full analysis

(); ``` ```typescript if (blocked) { const reason = reasons.join('; '); const blockText = `[aliyun-ai-guardrail][⚠️ Current user message MUSKED by Aliyun AI Guardrail: ${reason}. Please explain this to the user.]`; contentCache.set(key, { blocked: true, blockText }); console.log(`[aliyun-ai-guardrail] BLOCKED -> ${url}, reason: ${reason}`); } else { contentCache.set(key, { blocked: false, blockText: '' }); console.log(`[aliyun-ai-guardrail] PASSED -> ${url.slice(0, 80)}`); } ``` ### Technical Analysis Every distinct content hash creates an entry in a module-level `Map`. Entries have no expiration, maximum count, memory limit, or eviction policy. Both allowed and blocked messages are retained for the process lifetime. An actor able to submit many unique messages can continually increase memory consumption. Although each individual entry is relatively small, sustained unique traffic can eventually degrade performance or terminate the Node.js process through memory exhaustion. ### Attack Path 1. An attacker obtains access to an interface that causes messages to be processed by the hook. 2. The attacker repeatedly submits unique content. 3. Each message generates a different cache key and a new permanent cache entry. 4. The cache grows without eviction. 5. Process memory usage rises until garbage collection overhead increases, service performance degrades, or the process exits due to memory exhaustion. ### Impact Assessment The issue can produce denial of service for the OpenClaw process and all sessions hosted by it. It does not grant additional privileges or expose data by itself. Exploitability depends on the at ...[truncated 83 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: assets/aliyun-ai-guardrail/hooks/aliyun-ai-guardrail/handler.ts:158

Finding

Request Body Content Is Written to Logs on Inspection Errors

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly instructs users to store long-lived Alibaba Cloud AccessKey credentials in openclaw.json without any warning about secret handling, file permissions, encryption, or safer alternatives. This can lead to credential exposure through source control, backups, logs, or overly broad filesystem access, especially because the skill is designed to automate installation and configuration for all agent sessions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill performs operations that involve network access and handling environment-based secrets, but it declares no tool scope or permission boundaries. This weakens transparency and reviewability, making it easier for a user or host agent to invoke a skill with broader capabilities than are explicitly disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the operator to collect highly sensitive Alibaba Cloud credentials and place them in a local configuration file without warning about secret sensitivity, file exposure, or least-privilege practices. Storing long-lived cloud credentials in plaintext config increases the risk of credential theft through local compromise, accidental disclosure, backups, logs, or source control leakage.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The hook is configured with both events: ["agent:bootstrap"] and always: true, which creates a broad, automatically enabled activation scope without any visible scoping, opt-in, or environment constraints. In a hook that intercepts agent message/tool flows, automatic bootstrap execution increases the attack surface and can cause unintended monitoring, blocking, or side effects across all sessions if the hook is installed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code sends up to 2000 characters of the user's latest message to an external Alibaba Cloud guardrail service for scanning, but there is no visible consent, notice, redaction, or endpoint scoping in this file. That can expose sensitive prompts, secrets, personal data, or regulated information to a third party unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This hook installs a global fetch monkey-patch that inspects, logs about, and can rewrite outbound request bodies containing chat messages. That behavior exceeds a narrow 'install/configure guardrail' expectation and creates broad interception capability over unrelated network traffic, increasing the risk of unintended data capture, compatibility issues, and hidden request tampering.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest focuses on installing/configuring AI security detection, but does not mention credential sourcing or secret handling. This file directly loads cloud credentials from process.env to authenticate external guardrail API calls, which is a distinct capability beyond the stated purpose text.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill reads ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET from environment variables to authenticate outbound API calls. In this file, there is no docstring, comment, or other disclosure explaining that the skill depends on sensitive credentials.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The runtime dependency uses a caret range, which allows newer minor/patch versions to be installed without explicit review. In a security-sensitive hook that intercepts LLM traffic, an unexpected upstream release or compromised package version could alter behavior or introduce supply-chain risk.

Content

Scanner excerpt · assets/aliyun-ai-guardrail/package.json (reported line 9)May include surrounding context.

json

"hooks": ["./hooks/aliyun-ai-guardrail"]
  },
  "dependencies": {
    "@alicloud/openapi-client": "^0.4.12"
  },
  "devDependencies": {
    "@types/node": "^20.0.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 78% confidence

Finding

The devDependency is not pinned to an exact version, which can make builds non-reproducible and expose the development pipeline to supply-chain changes. While this is less severe than an unpinned runtime dependency, compromised or breaking toolchain updates can still affect packaged artifacts or CI environments.

Content

Scanner excerpt · assets/aliyun-ai-guardrail/package.json (reported line 12)May include surrounding context.

json

"@alicloud/openapi-client": "^0.4.12"
  },
  "devDependencies": {
    "@types/node": "^20.0.0",
    "typescript": "^5.0.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 80% confidence

Finding

The TypeScript compiler version is specified with a caret range, allowing unreviewed updates in the build toolchain. Inconsistent compiler behavior or a compromised release could affect generated code, build reliability, or CI security, even if it is not shipped as a runtime dependency.

Content

Scanner excerpt · assets/aliyun-ai-guardrail/package.json (reported line 13)May include surrounding context.

json

},
  "devDependencies": {
    "@types/node": "^20.0.0",
    "typescript": "^5.0.0"
  }
}

Static analysis

No suspicious patterns detected.