Alibaba Cloud Compute FC Agentrun

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:04 PM UTC
• Version: 1.0.3

Overview

The skill is purpose-aligned for Alibaba Cloud AgentRun management, but it uses cloud credentials for resource creation and deletion with weak endpoint scoping and no deletion confirmation.

Review before installing. Use short-lived, least-privilege RAM credentials, set AGENTRUN_ENDPOINT only to an official endpoint from references/endpoints.md, and avoid running cleanup_runtime.py unless you have verified the account, region, runtime ID, and endpoint ID. Treat files written under output/compute-fc-agentrun/responses as potentially sensitive cloud metadata.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/quickstart.py:29

Finding

Unvalidated API Endpoint in Quickstart Script Redirects Authenticated Requests

Content

View full analysis

Vulnerability Details

File Location: scripts/quickstart.py:29-40
Vulnerability Type: Unvalidated credential-bearing API endpoint
Risk Level: Medium

Vulnerable Code

python

endpoint = get_env("AGENTRUN_ENDPOINT")
access_key_id = get_env("ALICLOUD_ACCESS_KEY_ID")
access_key_secret = get_env("ALICLOUD_ACCESS_KEY_SECRET")
security_token = os.getenv("ALICLOUD_SECURITY_TOKEN") or os.getenv("ALIBABA_CLOUD_SECURITY_TOKEN")

config = open_api_models.Config(
    access_key_id=access_key_id,
    access_key_secret=access_key_secret,
    endpoint=endpoint,
)
if security_token:
    config.security_token = security_token

Technical Analysis

The AGENTRUN_ENDPOINT environment variable is passed directly to the Alibaba Cloud SDK client without checking that it identifies an approved Alibaba Cloud AgentRun service. The project documents a finite set of official public and VPC endpoints in references/endpoints.md, but the implementation does not enforce that list.

The same configuration object contains the AccessKey ID, AccessKey secret, and optional temporary security token used to sign requests. The secret is normally used locally for signing rather than transmitted directly; however, a malicious endpoint can receive signed authentication metadata, the AccessKey ID, an optional security token, request parameters, and resource information. Depending on the signature freshness and SDK behavior, captured signed requests may also present a limited replay risk.

Exploitation requires an attacker to influence the process environment, launch configuration, wrapper script, CI configuration, or agent-generated command that sets AGENTRUN_ENDPOINT.

Attack Path

1. The attacker influences AGENTRUN_ENDPOINT and sets it to an attacker-controlled host.
2. A user or automation process supplies valid Alibaba Cloud credentials and runs quickstart.py.
3. The script constructs an SD ...[truncated 917 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the arbitrary endpoint variable with a validated region identifier and derive the endpoint from a static region-to-host mapping.
• If custom endpoints are required, parse and normalize the value before use and allow only the exact official hosts listed in references/endpoints.md.
• Require TLS and reject plaintext HTTP, embedded user information, unexpected ports, IP literals, malformed hostnames, and hostname suffix tricks.
• Ensure redirects are disabled or restricted so that authenticated requests cannot be redirected to an unapproved host.
• Prefer short-lived RAM credentials with only the ListAgentRuntimes permission required by this script.
• Add automated tests for malicious endpoint values such as look-alike domains, subdomain suffix attacks, user-information syntax, IP addresses, and non-TLS URLs.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/runtime_flow.py:28

Finding

Unvalidated API Endpoint in Runtime Flow Redirects Privileged Resource Requests

Content

View full analysis

Vulnerability Details

File Location: scripts/runtime_flow.py:28-39
Vulnerability Type: Unvalidated credential-bearing API endpoint
Risk Level: Medium

Vulnerable Code

python

endpoint = get_env("AGENTRUN_ENDPOINT")
access_key_id = get_env("ALICLOUD_ACCESS_KEY_ID")
access_key_secret = get_env("ALICLOUD_ACCESS_KEY_SECRET")
security_token = os.getenv("ALICLOUD_SECURITY_TOKEN") or os.getenv("ALIBABA_CLOUD_SECURITY_TOKEN")

config = open_api_models.Config(
    access_key_id=access_key_id,
    access_key_secret=access_key_secret,
    endpoint=endpoint,
)
if security_token:
    config.security_token = security_token

Technical Analysis

The runtime creation workflow accepts AGENTRUN_ENDPOINT as an unrestricted environment value and associates it with credentials capable of creating runtimes, publishing versions, and creating runtime endpoints. No validation ensures that the destination is one of the documented Alibaba Cloud AgentRun endpoints.

An attacker-controlled destination can receive the signed creation requests, authentication metadata, optional temporary security token, runtime names, descriptions, and endpoint configuration. Although the AccessKey secret is normally retained locally and used only to calculate signatures, the authentication material and signed requests visible to the malicious service may support request replay during their validity window or facilitate further targeted attacks.

Because this workflow requires resource-creation permissions, it is likely to be run with credentials carrying broader privileges than the read-only quickstart script.

Attack Path

1. An attacker modifies the environment, CI variables, execution wrapper, or agent-generated command so that AGENTRUN_ENDPOINT points to an attacker-controlled host.
2. The operator runs runtime_flow.py with credentials authorized to create and publish AgentRun resources.
3. The s ...[truncated 983 chars]

Remediation

View remediation

Remediation Suggestions

• Accept a region identifier rather than an arbitrary endpoint, then select the corresponding host from a hard-coded allowlist.
• If endpoint configurability is necessary, compare the normalized hostname against the exact public and VPC endpoints documented in references/endpoints.md.
• Enforce TLS and reject IP literals, embedded credentials, nonstandard ports, malformed hostnames, and unapproved URL schemes.
• Disable cross-host redirects for authenticated SDK requests.
• Use short-lived RAM credentials restricted to the exact runtime creation and publishing operations needed by this workflow.
• Add a confirmation step summarizing the validated region, account, and intended resource operations before performing creation actions.
• Add security tests proving that look-alike and attacker-controlled endpoints are rejected before credentials are loaded into the client.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cleanup_runtime.py:28

Finding

Unvalidated API Endpoint in Cleanup Script Redirects Destructive Requests

Content

View full analysis

Vulnerability Details

File Location: scripts/cleanup_runtime.py:28-39
Vulnerability Type: Unvalidated credential-bearing API endpoint
Risk Level: Medium

Vulnerable Code

python

endpoint = get_env("AGENTRUN_ENDPOINT")
access_key_id = get_env("ALICLOUD_ACCESS_KEY_ID")
access_key_secret = get_env("ALICLOUD_ACCESS_KEY_SECRET")
security_token = os.getenv("ALICLOUD_SECURITY_TOKEN") or os.getenv("ALIBABA_CLOUD_SECURITY_TOKEN")

config = open_api_models.Config(
    access_key_id=access_key_id,
    access_key_secret=access_key_secret,
    endpoint=endpoint,
)
if security_token:
    config.security_token = security_token

Technical Analysis

The cleanup workflow uses an unrestricted environment-controlled endpoint when constructing a client with credentials authorized to delete AgentRun endpoints and runtimes. It does not verify the endpoint against the official service hosts documented by the project.

If the endpoint is attacker-controlled, signed deletion requests and their resource identifiers are sent to the attacker. The AccessKey secret should remain local under the SDK signing model, but the receiving service can observe the AccessKey ID, signature data, optional temporary security token, request timestamps, runtime IDs, and endpoint IDs. Captured signed deletion requests may be subject to replay attempts while valid.

This instance is particularly sensitive because the credentials are expected to possess destructive permissions and the request payload identifies resources selected for deletion.

Attack Path

1. The attacker influences AGENTRUN_ENDPOINT through the execution environment, automation configuration, wrapper script, or generated command.
2. An operator runs cleanup_runtime.py using credentials with runtime and endpoint deletion permissions.
3. The SDK sends signed deletion requests to the attacker-controlled service.
4. The attacker captures ...[truncated 973 chars]

Remediation

View remediation

Remediation Suggestions

• Derive the endpoint from a validated region identifier instead of accepting an arbitrary hostname.
• Restrict destinations to exact official AgentRun public or VPC endpoints and perform validation after canonicalizing the hostname.
• Require TLS and reject embedded credentials, IP literals, nonstandard ports, unapproved schemes, and hostname suffix bypasses.
• Prevent authenticated requests from following redirects to different hosts.
• Use short-lived cleanup credentials restricted to deleting only the intended AgentRun resources where resource-level controls are supported.
• Require explicit confirmation of the validated account, region, runtime ID, and endpoint ID before deletion.
• Verify deletion through a separate request to the validated official endpoint rather than relying solely on the response from the configured destination.
• Add negative tests covering malicious, malformed, and look-alike endpoint values.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill documents use of environment variables containing cloud credentials and instructs writing output files, but it does not declare any explicit tool scope or permissions boundaries. In an agent setting, missing scope declarations can lead to broader-than-expected access to environment secrets and filesystem writes, increasing the risk of credential exposure or unintended file modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The cleanup section instructs users to run a script that deletes runtime and endpoint resources, but it does not clearly warn that the action is destructive or irreversible. In an infrastructure-management skill, omission of such warning increases the chance of accidental deletion of production resources, especially when agents or operators are troubleshooting under time pressure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code performs irreversible delete operations against a runtime endpoint and the runtime itself, but there is no confirmation prompt or explicit user-facing warning before execution. Although the docstring mentions deletion, that is not a visible runtime disclosure to the user invoking the script.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script accesses ALICLOUD_ACCESS_KEY_ID, ALICLOUD_ACCESS_KEY_SECRET, and optional security token environment variables to authenticate API calls. There is no user-facing warning, explanatory comment, or docstring disclosure that the skill reads sensitive credentials from the environment, which matches the missing-warning criterion for credential access in code files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script serializes full cloud API responses for runtime creation, version publishing, and endpoint creation to a local JSON file without filtering or warning the user. These responses can contain resource identifiers, endpoint details, request metadata, or other operationally sensitive information that may later be exposed through shared workspaces, logs, artifacts, or insecure filesystem permissions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document is written entirely in Chinese, including the title and section descriptions, with no indication that language selection is optional or that the file is intended only for a Chinese-language audience. Under the policy, a fixed language without opt-in can be a natural-language policy violation when no justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file presents all user-facing guidance exclusively in Chinese. The policy for natural-language content requires avoiding forced language constraints unless the skill offers a language choice or clearly documents and justifies the locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document title and content are entirely in Chinese, which constitutes a language-specific constraint in natural-language content. There is no indication that the skill offers a language choice or that the Chinese-only requirement is justified by a region-specific purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script creates an output directory and saves the full API response to a JSON file, which may contain account or runtime metadata. While it prints the saved path afterward, there is no pre-action warning, confirmation, or explanatory comment/docstring disclosing that service data will be persisted locally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.