Alibaba Cloud Network DNS Cli

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:04 PM UTC
• Version: 1.0.2

Overview

The skill is purpose-aligned for Alibaba Cloud DNS work, but it asks users to install an unverified latest CLI and configure powerful cloud credentials in a way that can expose secrets.

Review before installing. Use a verified, pinned aliyun-cli release where possible, avoid entering access-key secrets directly in command-line arguments, prefer least-privilege and short-lived credentials, and confirm DNS target, record type, TTL, propagation impact, and rollback steps before any add or update operation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21
• Finding: Unpinned Alibaba Cloud CLI Download Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 21-25 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash curl -fsSL https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz -o /tmp/aliyun-cli.tgz mkdir -p ~/.local/bin tar -xzf /tmp/aliyun-cli.tgz -C /tmp mv /tmp/aliyun ~/.local/bin/aliyun chmod +x ~/.local/bin/aliyun ``` ### Technical Analysis The installation procedure downloads a mutable `latest` archive and installs the executable without verifying its version, cryptographic checksum, or digital signature. HTTPS protects transport under normal conditions, but it does not establish that the downloaded artifact is the exact version reviewed or expected by the user. If the distribution server, publishing process, DNS resolution, TLS trust chain, or upstream release artifact is compromised, the downloaded archive could contain an attacker-controlled executable. The binary is then moved into `~/.local/bin`, marked executable, and subsequently invoked for authenticated Alibaba Cloud operations. The referenced domain is consistent with the stated Alibaba Cloud source, and the project contains no evidence that it currently serves a malicious artifact. The vulnerability is the absence of artifact pinning and integrity verification. ### Attack Path 1. An attacker compromises the upstream artifact, publishing infrastructure, or another relevant part of the software supply chain. 2. The mutable `aliyun-cli-linux-latest-amd64.tgz` resource is replaced with a modified archive. 3. A user follows the documented installation procedure. 4. The altered binary is extracted and installed as `~/.local/bin/aliyun` without checksum or signature validation. 5. The user invokes the binary to configure credentials or manage DNS records. 6. The malicious executable runs with the user's local privileges and can access credentials and resources available to that user. ### Impact Assessment Succ ...[truncated 519 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the Alibaba Cloud CLI to a specific, reviewed release instead of using a mutable `latest` URL. 2. Obtain the vendor-published SHA-256 checksum through an independently authenticated channel. 3. Verify the archive before extraction and terminate installation if validation fails: ```bash printf '%s %s\n' '<EXPECTED_SHA256>' /tmp/aliyun-cli.tgz | sha256sum --check - ``` 4. Prefer vendor-supported digital-signature verification when signatures are available. 5. Download into a private temporary directory created with `mktemp -d`, and remove it after installation. 6. Record the installed version and verified digest in validation evidence so installations are reproducible. 7. Avoid silently replacing an existing CLI binary; require explicit confirmation or validate the existing installation first. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31
• Finding: Alibaba Cloud Access-Key Secret Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31-36 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```bash ~/.local/bin/aliyun configure set \ --profile default \ --access-key-id <AK> \ --access-key-secret <SK> \ --region cn-hangzhou ``` ### Technical Analysis The primary credential configuration example instructs users to place an Alibaba Cloud access-key ID and secret directly in command-line arguments. After substituting real values, the secret may be exposed through shell history, process inspection utilities, terminal recording, debugging output, automation logs, or command auditing systems. Although the document later recommends environment variables, that recommendation does not eliminate the risk created by the earlier command-line example. Environment variables can also be exposed through process environments or logging if handled incorrectly, so a masked interactive prompt, protected credential provider, or secret manager is preferable. ### Attack Path 1. A user replaces `<AK>` and `<SK>` with active Alibaba Cloud credentials. 2. The user executes the documented command in an interactive shell or automated environment. 3. The command, including the secret, is retained in shell history, captured in logs, or temporarily exposed to process-inspection mechanisms. 4. A local user, administrator, support operator, monitoring system, or log reader obtains the secret. 5. The exposed credential is used to authenticate to Alibaba Cloud APIs. 6. The attacker performs actions permitted by the associated identity, potentially including DNS record discovery or modification. ### Impact Assessment The obtainable cloud privileges are limited by the policies attached to the exposed access key. With DNS-management permissions, an attacker could enumerate records, add or alter DNS entries, redirect application traffic, facilitate phishing, disrupt services, or interfere ...[truncated 258 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove examples that pass secrets as command-line arguments. 2. Use a vendor-supported interactive configuration flow that reads secrets through a masked prompt and does not retain them in shell history. 3. Prefer short-lived credentials obtained through role assumption or workload identity over long-lived access keys. 4. Where environment variables are unavoidable, inject them through a secret manager, scope them to the shortest possible lifetime, and prevent command tracing or environment logging. 5. Store credential files with restrictive permissions, such as mode `0600`, and document their location and protection requirements. 6. Ensure CI/CD systems mask secrets and do not echo commands containing credentials. 7. Rotate any credential that may already have been entered through the documented command or retained in logs. 8. Apply least-privilege policies restricting credentials to the required Alibaba Cloud DNS actions and resources. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
curl -fsSL https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz -o /tmp/aliyun-cli.tgz
mkdir -p ~/.local/bin
 tar -xzf /tmp/aliyun-cli.tgz -C /tmp
mv /tmp/aliyun ~/.local/bin/aliyun
chmod +x ~/.local/bin/aliyun

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill includes DNS record creation guidance but does not explicitly warn that modifying DNS can redirect traffic, break service resolution, or cause outages during propagation. Because DNS is a control plane for service routing, operators may underestimate the blast radius of even a single record change, especially when following concise CLI examples.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The heading "官方文档来源（用于后续更新）" is Chinese-language text, and the file provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.