Alibaba Cloud Storage OSS Ossutil

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:05 PM UTC
• Version: 1.0.3

Overview

The skill is a coherent Alibaba OSS CLI helper, but it includes under-warned destructive cloud-storage examples and unverified privileged installation steps that users should review carefully.

Review the install commands before running them. Prefer verifying ossutil from an official checksum or signature source, consider a user-local install path, and require explicit confirmation before any sync with `--delete` or API-level bucket management command. Use least-privilege RAM credentials limited to the exact buckets and actions needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/install.md:13

Finding

Unverified Binary Download and Privileged System-Wide Installation

Content

View full analysis

Remediation

View remediation

' 'ossutil.zip' | sha256sum --check - ``` 3. Prefer a vendor-signed package and verify its digital signature using a pinned, authenticated vendor public key. 4. Abort installation immediately if checksum or signature verification fails. 5. Extract the archive into a newly created temporary directory and validate its expected file names and structure before installation. 6. Perform all download and verification steps without elevated privileges. Use `sudo` only for the final installation of an already verified executable. 7. Consider installing into a user-scoped directory when system-wide installation is unnecessary. 8. Document how users can obtain checksums or signing keys through a channel independent of the binary download endpoint. 9. Keep the version pinned and review integrity metadata before updating the referenced release. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/install.md (reported line 11)May include surrounding context.

md

if command -v yum >/dev/null 2>&1; then
  sudo yum install -y unzip
else
  sudo apt-get update && sudo apt-get install -y unzip
fi
curl -fL -o ossutil.zip https://gosspublic.alicdn.com/ossutil/v2/2.2.1/ossutil-2.2.1-linux-amd64.zip
unzip ossutil.zip

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to run shell commands and write output artifacts, but it does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch weakens policy enforcement and increases the chance an agent can execute commands or write files beyond what reviewers and orchestrators expect. In a cloud-storage skill that handles credentials and data movement, undeclared shell/file capabilities are more sensitive because misuse could expose secrets or alter local/remote data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example ossutil sync ./local-dir oss://your-bucket/path/ --delete can remove remote objects that are not present locally, but the skill does not place an explicit warning adjacent to the example or require confirmation before mutating use. Users or agents following the example may treat it as routine synchronization and accidentally cause data loss in OSS buckets. Because this skill is specifically for cloud object storage operations, deletion semantics are especially dangerous in context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Linux install instructions download a binary from the network and then perform privileged package installation and placement into /usr/local/bin without any warning about trust, verification, or the effect of sudo operations. This is dangerous because users may run the sequence verbatim as root, granting a remotely retrieved executable persistent system-wide execution without validating integrity or understanding the scope of system changes.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

Using sudo for package installation is not inherently malicious, but in documentation it becomes a security concern when presented without caution because it normalizes elevated execution of commands copied from a guide. If the surrounding instructions or package source were compromised, the user would be granting root-level changes to the system.

Content

Scanner excerpt · references/install.md (reported line 9)May include surrounding context.

bash

if command -v yum >/dev/null 2>&1; then
  sudo yum install -y unzip
else
  sudo apt-get update && sudo apt-get install -y unzip
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The apt-get update/install step runs with sudo and is embedded in a copy-paste flow, which can lead users to execute privileged package management commands without reviewing them. While common for installation docs, it still increases risk by encouraging root execution and changing system package state.

Content

Scanner excerpt · references/install.md (reported line 11)May include surrounding context.

md

if command -v yum >/dev/null 2>&1; then
  sudo yum install -y unzip
else
  sudo apt-get update && sudo apt-get install -y unzip
fi
curl -fL -o ossutil.zip https://gosspublic.alicdn.com/ossutil/v2/2.2.1/ossutil-2.2.1-linux-amd64.zip
unzip ossutil.zip

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Changing permissions on a downloaded executable with sudo contributes to making a network-fetched binary runnable at elevated trust on the host. Without integrity verification or explicit warning, this step helps convert an untrusted download into a system-executable program.

Content

Scanner excerpt · references/install.md (reported line 15)May include surrounding context.

fi curl -fL -o ossutil.zip https://gosspublic.alicdn.com/ossutil/v2/2.2.1/ossutil-2.2.1-linux-amd64.zip unzip ossutil.zip sudo chmod 755 ossutil-2.2.1-linux-amd64/ossutil sudo mv ossutil-2.2.1-linux-amd64/ossutil /usr/local/bin/ossutil ossutil version

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Changing permissions on a downloaded executable with sudo contributes to making a network-fetched binary runnable at elevated trust on the host. Without integrity verification or explicit warning, this step helps convert an untrusted download into a system-executable program.

Content

Scanner excerpt · references/install.md (reported line 15)May include surrounding context.

fi curl -fL -o ossutil.zip https://gosspublic.alicdn.com/ossutil/v2/2.2.1/ossutil-2.2.1-linux-amd64.zip unzip ossutil.zip sudo chmod 755 ossutil-2.2.1-linux-amd64/ossutil sudo mv ossutil-2.2.1-linux-amd64/ossutil /usr/local/bin/ossutil ossutil version

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Moving the downloaded ossutil binary into /usr/local/bin with sudo creates a persistent system-wide executable that may later be invoked by any user or scripts via PATH. If the downloaded artifact were tampered with, this step would institutionalize the compromise across the machine.

Content

Scanner excerpt · references/install.md (reported line 16)May include surrounding context.

curl -fL -o ossutil.zip https://gosspublic.alicdn.com/ossutil/v2/2.2.1/ossutil-2.2.1-linux-amd64.zip unzip ossutil.zip sudo chmod 755 ossutil-2.2.1-linux-amd64/ossutil sudo mv ossutil-2.2.1-linux-amd64/ossutil /usr/local/bin/ossutil ossutil version

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The macOS instructions likewise fetch a binary and use sudo to change permissions and move it into a system-wide executable path, but they do not warn the user about privileged system modification. This raises the risk of users blindly installing unverified code with administrator rights, making compromise or accidental misconfiguration more impactful.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The macOS sudo chmod step similarly upgrades a downloaded file toward executable deployment with administrator privileges. Even though this is a common install action, it is risky when paired with an unauthenticated trust workflow and no user warning.

Content

Scanner excerpt · references/install.md (reported line 25)May include surrounding context.

bash

curl -fL -o ossutil.zip https://gosspublic.alicdn.com/ossutil/v2/2.2.1/ossutil-2.2.1-darwin-amd64.zip
unzip ossutil.zip
sudo chmod 755 ossutil-2.2.1-darwin-amd64/ossutil
sudo mv ossutil-2.2.1-darwin-amd64/ossutil /usr/local/bin/ossutil
ossutil version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The macOS sudo chmod step similarly upgrades a downloaded file toward executable deployment with administrator privileges. Even though this is a common install action, it is risky when paired with an unauthenticated trust workflow and no user warning.

Content

Scanner excerpt · references/install.md (reported line 25)May include surrounding context.

bash

curl -fL -o ossutil.zip https://gosspublic.alicdn.com/ossutil/v2/2.2.1/ossutil-2.2.1-darwin-amd64.zip
unzip ossutil.zip
sudo chmod 755 ossutil-2.2.1-darwin-amd64/ossutil
sudo mv ossutil-2.2.1-darwin-amd64/ossutil /usr/local/bin/ossutil
ossutil version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Using sudo mv to place the binary into /usr/local/bin on macOS makes the downloaded executable system-wide and trusted through normal PATH resolution. If the archive source or transport were compromised, this would amplify the impact from a user-level download to a persistent host-level compromise.

Content

Scanner excerpt · references/install.md (reported line 26)May include surrounding context.

curl -fL -o ossutil.zip https://gosspublic.alicdn.com/ossutil/v2/2.2.1/ossutil-2.2.1-darwin-amd64.zip unzip ossutil.zip sudo chmod 755 ossutil-2.2.1-darwin-amd64/ossutil sudo mv ossutil-2.2.1-darwin-amd64/ossutil /usr/local/bin/ossutil ossutil version

text

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_ossutil.py (reported line 29)May include surrounding context.

python

binary = shutil.which("ossutil")
        lines.append(f"ossutil_path={binary or 'NOT_FOUND'}")
        if binary:
            proc = subprocess.run([binary, "--version"], capture_output=True, text=True, check=False)
            lines.append(f"ossutil_version_exit={proc.returncode}")
            lines.append(proc.stdout.strip() or proc.stderr.strip())

Static analysis

No suspicious patterns detected.