T08 · Insecure Dependencies
Warning
- Location
SKILL.md:20- Finding
Unpinned npm Package Installation and Automatic Execution
- Content
View full analysis
- Remediation
View remediation
npx --no-install s -v npx --no-install s deploy ``` ]]>
Security audit
Alibaba Cloud Compute FC Serverless Devs
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Alibaba Cloud Function Compute guide, but it asks users to handle cloud credentials and run deploy/remove tooling with unnecessary elevated local privileges and weak safety guidance.
Review this skill carefully before installing. Prefer a pinned, user-scoped Serverless Devs install, do not run the CLI with sudo, avoid putting Alibaba Cloud secrets directly in commands or exported JSON where they may be logged, and use least-privilege or short-lived credentials. Treat deploy and remove as explicit mutating/destructive cloud actions and verify region, account, and target resources first.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:41- Finding
Alibaba Cloud Secrets Exposed Through Command Arguments and Environment Variables
- Content
View full analysis
--AccessKeySecret -f ``` ```bash s config add -a default -kl AccessKeyID,AccessKeySecret -il ${ALIBABA_CLOUD_ACCESS_KEY_ID},${ALIBABA_CLOUD_ACCESS_KEY_SECRET} -f ``` ```bash export default_serverless_devs_key='{\"AccountID\":\"\",\"AccessKeyID\":\"\",\"AccessKeySecret\":\"\"}' ``` ### Technical Analysis The first command places the Alibaba Cloud access-key secret directly in command-line arguments. Depending on the operating system, shell, and logging configuration, command arguments may be retained in shell history, terminal transcripts, process accounting, audit logs, CI logs, or diagnostic output. They may also be temporarily observable through process inspection by other sufficiently privileged local users. The second command expands secret-bearing environment variables into command arguments before execution. Although the source values originate in environment variables, shell expansion causes their plaintext values to become part of the resulting process argument list. The exported JSON credential object keeps a long-lived access-key secret in the shell environment. Exported variables are inherited by descendant processes, broadening the number of programs that can access the credential and increasing the risk of leakage through crash reports, debugging tools, environment dumps, build logs, or compromised child processes. ### Attack Path 1. A user replaces the placeholders with active Alibaba Cloud credentials or defines the referenced environment variables. 2. The user executes one of the documented credential-configuration commands. 3. The shell expands the secret into the process argument list, records the command in history, or exports the credential to descendant processes. 4. ...[truncated 1010 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (13)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
The skill recommends
sudo npm install @serverless-devs/s -g, which runs package installation with elevated privileges. If the package or a dependency is malicious or compromised, it gains root-level code execution on the host, substantially increasing impact versus a user-scoped install.- Content
Global install (requires sudo):
bash sudo npm install @serverless-devs/s -g sudo s -v
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash sudo npm install @serverless-devs/s -g sudo s -vNo-sudo alternative (recommended in restricted environments):
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash sudo npm install @serverless-devs/s -g sudo s -vNo-sudo alternative (recommended in restricted environments):
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The skill instructs users to execute
npx -y @serverless-devs/swithout pinning a specific version, which causes retrieval and execution of whatever package version is current at runtime. In a security-sensitive CLI/setup skill, this creates supply-chain risk because a compromised or breaking upstream release could be executed immediately on the user's machine.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill instructs users to run
sudo s config add, which processes cloud credentials under elevated privileges. This can store configuration files as root, expand blast radius if the CLI is compromised, and normalize unnecessary privileged handling of sensitive cloud access material.- Content
Configure Credentials (guided)
bash sudo s config addChoose
Alibaba Cloud (alibaba), provideAccountID,AccessKeyID,AccessKeySecret, and set alias.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill shows command-line patterns that place
AccessKeyIDandAccessKeySecretdirectly in shell commands and environment variables, but it does not warn about shell history, process-list exposure, terminal logging, or accidental persistence in profiles. Because these are cloud credentials, disclosure could let an attacker access and modify Alibaba Cloud resources.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
Using
sudo s init start-fc3-pythoncreates project files through a privileged process, which can leave root-owned artifacts in the workspace and unnecessarily expose users to elevated-code-execution risk. Initialization also fetches/templates content, so the use of root broadens consequences of any compromised dependency or template source.- Content
Initialize Example (Python)
bash sudo s init start-fc3-python cd start-fc3-python
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documented
s removecommand deletes deployed resources, but the section does not clearly warn that it is destructive. In an operational cloud skill, omission of a deletion warning can lead to accidental teardown, downtime, and loss of associated configuration or billing surprises.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The deployment command
sudo s deployperforms a mutating cloud action from a root-privileged local process. This unnecessarily combines elevated local execution with remote infrastructure changes, increasing host-compromise risk if the CLI or dependencies are malicious and making mistakes more damaging.- Content
Deploy, Invoke, and Remove
bash sudo s deploy sudo s invoke -e "test" sudo s remove
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 85% confidence
- Finding
Running
sudo s invoke -e "test"executes the CLI with root privileges for a task that does not require host elevation. Although invocation is less destructive than deployment or removal, unnecessary root execution still raises the impact of any CLI compromise and can mishandle local files or logs as root.- Content
bash sudo s deploy sudo s invoke -e "test" sudo s remove
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The skill documents
sudo s remove, combining destructive cloud resource deletion with root execution on the local machine. This magnifies both the chance and severity of operator error and any compromise of the CLI, since the command can both delete infrastructure and run with full local privileges.- Content
bash sudo s deploy sudo s invoke -e "test" sudo s removeCustom Domain Binding (Avoid Default Domain Forced Download)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The deployment example pipes confirmation into
npx -y @serverless-devs/s deploywithout a pinned version, combining unattended execution with an unversioned remote package fetch. That increases the danger because users may non-interactively run arbitrary newly published code during a mutating cloud deployment action.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document instructs users to run
s config addand enter Alibaba Cloud AccountID/AK/SK but provides no warning that these are sensitive long-lived credentials or guidance on secure handling. In a CLI setup guide, this omission can lead users to expose secrets through shell history, screenshots, shared terminals, notes, or use of overly privileged keys, increasing the chance of account compromise.- Content
Static analysis
No suspicious patterns detected.