Alicloud Security Center Sas

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a coherent Alibaba Cloud Security Center helper, but it can use cloud credentials to make account changes and save local API artifacts.

Install only if you intend the agent to help manage Alibaba Cloud Security Center. Use a dedicated least-privilege Alibaba Cloud AccessKey, confirm any mutating action before it runs, and review the generated output directory for sensitive security details.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If used with sufficient Alibaba Cloud permissions, the agent may change Security Center settings or resources.

Why it was flagged

The skill explicitly covers mutating Alibaba Cloud Security Center operations. This is purpose-aligned, but those actions can change security configuration or resources.

Skill content

Change/configure: prefer `Create*` / `Update*` / `Modify*` / `Set*` APIs for mutations.

Recommendation

Use read/list APIs first, confirm the exact region, resource ID, and intended change, and use least-privilege credentials.

Note

ASI03: Identity and Privilege Abuse

What this means

The agent can act with the permissions of the configured Alibaba Cloud credentials.

Why it was flagged

The skill instructs the agent to use Alibaba Cloud credentials from environment variables or a local credentials file. This is expected for Alibaba Cloud management, but it grants delegated cloud account authority.

Skill content

Environment variables: `ALICLOUD_ACCESS_KEY_ID` / `ALICLOUD_ACCESS_KEY_SECRET` / `ALICLOUD_REGION_ID` ... Shared config file: `~/.alibabacloud/credentials`

Recommendation

Provide a dedicated, least-privilege AccessKey limited to the needed Security Center actions and avoid using broad administrator credentials.

Note

ASI06: Memory and Context Poisoning

What this means

Security-related cloud details may remain on disk after the task completes.

Why it was flagged

The skill stores local artifacts that may include Security Center resource identifiers or response summaries. This is disclosed and scoped, but users should treat those files as potentially sensitive.

Skill content

Save artifacts, command outputs, and API response summaries under `output/alicloud-security-center-sas/`. Include key parameters (region/resource id/time range) in evidence files for reproducibility.

Recommendation

Review generated output files before sharing them and delete or redact them if they contain sensitive resource or security information.