Alibaba Cloud Compute FC Serverless Devs

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:04 PM UTC
• Version: 1.0.3

Overview

This skill is a coherent Alibaba Cloud Function Compute guide, but it asks users to handle cloud credentials and run deploy/remove tooling with unnecessary elevated local privileges and weak safety guidance.

Review this skill carefully before installing. Prefer a pinned, user-scoped Serverless Devs install, do not run the CLI with sudo, avoid putting Alibaba Cloud secrets directly in commands or exported JSON where they may be logged, and use least-privilege or short-lived credentials. Treat deploy and remove as explicit mutating/destructive cloud actions and verify region, account, and target resources first.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20
• Finding: Unpinned npm Package Installation and Automatic Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-25`, `SKILL.md:111` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash sudo npm install @serverless-devs/s -g sudo s -v ``` ```bash npx -y @serverless-devs/s -v ``` ```bash printf 'y\n' | npx -y @serverless-devs/s deploy ``` ### Technical Analysis The documented commands install or execute `@serverless-devs/s` without specifying an exact reviewed version or validating package integrity. Consequently, npm resolves whichever package version is current when the command is run. The `npx -y` option automatically accepts package installation and immediately executes the resolved package. The global installation command is more sensitive because it invokes npm using `sudo`, allowing package installation hooks or executable code to run with elevated local privileges. Although the referenced package is consistent with the Skill's stated purpose, this execution pattern creates a supply-chain trust boundary that is not fixed to the version reviewed during the audit. A compromised package release, npm account, registry response, or transitive dependency could alter the code executed by future users. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or a transitive dependency. 2. The attacker publishes a malicious version under the legitimate package name. 3. A user follows the Skill and runs the unpinned global installation or `npx -y` command. 4. npm resolves and downloads the malicious release without requiring version review. 5. Package lifecycle hooks or CLI initialization code execute on the local host. 6. During deployment, the malicious code may access configured Alibaba Cloud credentials and perform operations using the user's cloud permissions. 7. If the global installation is run through `sudo`, malicious installation code may execute with root privileges. ### Impact Assessment Successful e ...[truncated 628 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@serverless-devs/s` to an exact reviewed version rather than resolving the latest release. 2. Install the dependency locally in a controlled project directory and commit a lockfile with integrity metadata. 3. Invoke the pinned local executable instead of using an unversioned `npx -y` command. 4. Avoid running npm with `sudo`; use a user-owned npm prefix, package manager isolation, or a disposable container. 5. Review package provenance, maintainers, release signatures, and transitive dependency changes before upgrading. 6. Use npm integrity and provenance verification where available. 7. Disable package lifecycle scripts during installation when compatible with the tool, or inspect them before execution. 8. Execute deployment tooling with short-lived, least-privilege Alibaba Cloud credentials in an isolated environment. 9. Replace the documented commands with an explicitly versioned form, such as: ```bash npm install --save-exact @serverless-devs/s@<reviewed-version> npx --no-install s -v npx --no-install s deploy ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:41
• Finding: Alibaba Cloud Secrets Exposed Through Command Arguments and Environment Variables<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:41`, `SKILL.md:47`, `SKILL.md:53` **Vulnerability Type**: Insecure credential handling **Risk Level**: Medium ### Vulnerable Code ```bash s config add -a default --AccessKeyID <AK> --AccessKeySecret <SK> -f ``` ```bash s config add -a default -kl AccessKeyID,AccessKeySecret -il ${ALIBABA_CLOUD_ACCESS_KEY_ID},${ALIBABA_CLOUD_ACCESS_KEY_SECRET} -f ``` ```bash export default_serverless_devs_key='{\"AccountID\":\"<AccountID>\",\"AccessKeyID\":\"<AK>\",\"AccessKeySecret\":\"<SK>\"}' ``` ### Technical Analysis The first command places the Alibaba Cloud access-key secret directly in command-line arguments. Depending on the operating system, shell, and logging configuration, command arguments may be retained in shell history, terminal transcripts, process accounting, audit logs, CI logs, or diagnostic output. They may also be temporarily observable through process inspection by other sufficiently privileged local users. The second command expands secret-bearing environment variables into command arguments before execution. Although the source values originate in environment variables, shell expansion causes their plaintext values to become part of the resulting process argument list. The exported JSON credential object keeps a long-lived access-key secret in the shell environment. Exported variables are inherited by descendant processes, broadening the number of programs that can access the credential and increasing the risk of leakage through crash reports, debugging tools, environment dumps, build logs, or compromised child processes. ### Attack Path 1. A user replaces the placeholders with active Alibaba Cloud credentials or defines the referenced environment variables. 2. The user executes one of the documented credential-configuration commands. 3. The shell expands the secret into the process argument list, records the command in history, or exports the credential to descendant processes. 4. ...[truncated 1010 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not place access-key secrets directly in command-line arguments. 2. Prefer an interactive credential prompt that suppresses terminal echo, or use an Alibaba Cloud credential provider that does not expose secrets in process arguments. 3. Use short-lived credentials obtained through RAM roles, Security Token Service, workload identity, or instance roles instead of persistent access keys. 4. If a credential file is required, create it with restrictive permissions, store it outside the project, and ensure it is excluded from version control and evidence artifacts. 5. Avoid exporting a complete JSON credential object into the general shell environment. 6. Disable shell tracing before handling secrets and ensure secret-bearing commands are not retained in shell history. 7. Configure CI and logging systems to mask credential values and prevent environment dumps. 8. Run the deployment tool in a clean, isolated process with only the minimum required environment variables. 9. Rotate any credential that may already have been used through these command forms. 10. Attach least-privilege policies restricted to the necessary Function Compute resources, actions, region, and deployment duration. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (13)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Global install (requires sudo):

```bash
sudo npm install @serverless-devs/s -g
sudo s -v
```

• Confidence: 92% confidence
• Finding: The skill recommends `sudo npm install @serverless-devs/s -g`, which runs package installation with elevated privileges. If the package or a dependency is malicious or compromised, it gains root-level code execution on the host, substantially increasing impact versus a user-scoped install.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
sudo npm install @serverless-devs/s -g
sudo s -v
```

No-sudo alternative (recommended in restricted environments):

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
sudo npm install @serverless-devs/s -g
sudo s -v
```

No-sudo alternative (recommended in restricted environments):

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill instructs users to execute `npx -y @serverless-devs/s` without pinning a specific version, which causes retrieval and execution of whatever package version is current at runtime. In a security-sensitive CLI/setup skill, this creates supply-chain risk because a compromised or breaking upstream release could be executed immediately on the user's machine.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## Configure Credentials (guided)

```bash
sudo s config add
```

Choose `Alibaba Cloud (alibaba)`, provide `AccountID`, `AccessKeyID`, `AccessKeySecret`, and set alias.

• Confidence: 90% confidence
• Finding: The skill instructs users to run `sudo s config add`, which processes cloud credentials under elevated privileges. This can store configuration files as root, expand blast radius if the CLI is compromised, and normalize unnecessary privileged handling of sensitive cloud access material.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill shows command-line patterns that place `AccessKeyID` and `AccessKeySecret` directly in shell commands and environment variables, but it does not warn about shell history, process-list exposure, terminal logging, or accidental persistence in profiles. Because these are cloud credentials, disclosure could let an attacker access and modify Alibaba Cloud resources.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## Initialize Example (Python)

```bash
sudo s init start-fc3-python
cd start-fc3-python
```

• Confidence: 88% confidence
• Finding: Using `sudo s init start-fc3-python` creates project files through a privileged process, which can leave root-owned artifacts in the workspace and unnecessarily expose users to elevated-code-execution risk. Initialization also fetches/templates content, so the use of root broadens consequences of any compromised dependency or template source.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documented `s remove` command deletes deployed resources, but the section does not clearly warn that it is destructive. In an operational cloud skill, omission of a deletion warning can lead to accidental teardown, downtime, and loss of associated configuration or billing surprises.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## Deploy, Invoke, and Remove

```bash
sudo s deploy
sudo s invoke -e "test"
sudo s remove
```

• Confidence: 93% confidence
• Finding: The deployment command `sudo s deploy` performs a mutating cloud action from a root-privileged local process. This unnecessarily combines elevated local execution with remote infrastructure changes, increasing host-compromise risk if the CLI or dependencies are malicious and making mistakes more damaging.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
sudo s deploy
sudo s invoke -e "test"
sudo s remove
```

• Confidence: 85% confidence
• Finding: Running `sudo s invoke -e "test"` executes the CLI with root privileges for a task that does not require host elevation. Although invocation is less destructive than deployment or removal, unnecessary root execution still raises the impact of any CLI compromise and can mishandle local files or logs as root.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
sudo s deploy
sudo s invoke -e "test"
sudo s remove
```

## Custom Domain Binding (Avoid Default Domain Forced Download)

• Confidence: 94% confidence
• Finding: The skill documents `sudo s remove`, combining destructive cloud resource deletion with root execution on the local machine. This magnifies both the chance and severity of operator error and any compromise of the CLI, since the command can both delete infrastructure and run with full local privileges.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The deployment example pipes confirmation into `npx -y @serverless-devs/s deploy` without a pinned version, combining unattended execution with an unversioned remote package fetch. That increases the danger because users may non-interactively run arbitrary newly published code during a mutating cloud deployment action.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs users to run `s config add` and enter Alibaba Cloud AccountID/AK/SK but provides no warning that these are sensitive long-lived credentials or guidance on secure handling. In a CLI setup guide, this omission can lead users to expose secrets through shell history, screenshots, shared terminals, notes, or use of overly privileged keys, increasing the chance of account compromise.

Static analysis

No suspicious patterns detected.