Alibaba Cloud Platform Aliyun Cli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

The skill is not visibly malicious, but it needs review because it can automatically install and run an unverified cloud CLI binary before performing Alibaba Cloud operations.

Install only if you are comfortable with a skill that can install or replace the local aliyun executable and operate on Alibaba Cloud resources using your credentials. Prefer manually installing a verified Alibaba Cloud CLI yourself, avoid putting access-key secrets in command arguments or prompts, use least-privilege or short-lived credentials, and review saved output logs for sensitive data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/ensure_aliyun_cli.py:60

Finding

Unverified Remote Executable Download and Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/ensure_aliyun_cli.py, lines 17 and 60-77; execution occurs through lines 37-42 and 132-136
Vulnerability Type: Remote payload retrieval and execution without cryptographic integrity verification
Risk Level: High

Vulnerable Code

python

DOWNLOAD_URL = "https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz"

python

def run_version(binary: Path) -> tuple[tuple[int, ...], str]:
    try:
        out = subprocess.check_output(
            [str(binary), "version"],
            text=True,
            stderr=subprocess.STDOUT
        )
    except Exception:
        return tuple(), ""
    return parse_version(out), out.strip()

python

def install_latest(target: Path) -> None:
    target.parent.mkdir(parents=True, exist_ok=True)
    with tempfile.TemporaryDirectory(prefix="aliyun-cli-update-") as td:
        td_path = Path(td)
        tgz_path = td_path / "aliyun-cli.tgz"
        with urllib.request.urlopen(DOWNLOAD_URL, timeout=30) as resp:  # nosec B310
            tgz_path.write_bytes(resp.read())
        with tarfile.open(tgz_path, "r:gz") as tf:
            member = None
            for m in tf.getmembers():
                if Path(m.name).name == "aliyun":
                    member = m
                    break
            if member is None:
                raise RuntimeError("aliyun binary not found in archive")
            tf.extract(member, path=td_path)
            extracted = td_path / member.name
            if not extracted.exists():
                raise RuntimeError("extracted aliyun binary missing")
            shutil.copy2(extracted, target)
    mode = target.stat().st_mode
    target.chmod(mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)

python

if should_update:
    print("[aliyun-cli] updating from official latest package...")
    install_latest(target)

...[truncated 2789 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest URL with a pinned, explicitly selected CLI version.
2. Store a trusted SHA-256 digest in the reviewed Skill or obtain it from a separately authenticated, signed release manifest.
3. Verify the archive before opening or extracting it, and abort on any mismatch.
4. Verify an official vendor signature where Alibaba Cloud provides one, using a pinned trusted public key.
5. Restrict redirects and validate the final URL scheme and hostname against an explicit allowlist.
6. Download with a strict maximum size to prevent resource exhaustion.
7. Install atomically: verify and inspect the artifact, write it to a temporary file in the destination filesystem, set restrictive permissions, and use an atomic rename.
8. Do not update automatically during normal cloud operations. Separate installation and upgrading into an explicit, user-approved action.
9. Report the exact downloaded version and digest in the audit evidence.
10. If integrity metadata is unavailable, direct the user to install the CLI through a trusted operating-system package mechanism rather than executing an unverified download.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ensure_aliyun_cli.py:65

Finding

Unsafe Tar Archive Member Extraction

Content

View full analysis

Vulnerability Details

File Location: scripts/ensure_aliyun_cli.py, lines 65-74
Vulnerability Type: Archive path traversal and unsafe link extraction
Risk Level: Medium

Vulnerable Code

python

with tarfile.open(tgz_path, "r:gz") as tf:
    member = None
    for m in tf.getmembers():
        if Path(m.name).name == "aliyun":
            member = m
            break
    if member is None:
        raise RuntimeError("aliyun binary not found in archive")
    tf.extract(member, path=td_path)
    extracted = td_path / member.name
    if not extracted.exists():
        raise RuntimeError("extracted aliyun binary missing")
    shutil.copy2(extracted, target)

Technical Analysis

The code accepts any archive member whose basename is aliyun, regardless of its full path or type. A name such as ../../user-controlled-path/aliyun can pass the basename check. The code does not reject absolute paths, parent-directory components, symbolic links, hard links, devices, or other non-regular archive members.

Calling TarFile.extract() without validating that the resolved destination remains inside td_path can permit path traversal or link-based writes outside the temporary directory. The subsequent path construction also uses the untrusted member name directly.

Exploitation requires control over the downloaded archive. That condition overlaps with the remote supply-chain finding, but unsafe extraction provides an additional filesystem-write primitive and can cause damage before the extracted CLI is intentionally executed.

Attack Path

1. An attacker gains control of, or successfully substitutes, the downloaded archive.
2. The archive contains a member with basename aliyun but a malicious full path, such as a path containing .., or contains a link-type member targeting a location outside the temporary directory.
3. The basename-only condition selects the malicious member.
4. `tf.e ...[truncated 1008 chars]

Remediation

View remediation

Remediation Suggestions

1. Require the exact expected member name instead of matching only its basename.
2. Reject absolute paths and any member containing .. path components.
3. Accept only regular files by checking member.isreg().
4. Reject symbolic links, hard links, devices, FIFOs, and unexpected metadata entries.
5. Resolve the proposed extraction path and verify it is a descendant of the temporary extraction directory before writing.
6. On supported Python versions, use TarFile.extract(..., filter="data") as defense in depth, while retaining explicit path and type validation.
7. Prefer reading the validated regular member with extractfile() and writing its bytes to a newly created destination file rather than invoking general-purpose archive extraction.
8. Apply an archive size limit and verify that only the expected number of relevant files is present.
9. Perform cryptographic archive verification before parsing any member.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:82

Finding

Alibaba Cloud Access Key Secret Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82-88
Vulnerability Type: Sensitive credential exposure through process arguments and command logging
Risk Level: Medium

Vulnerable Code

bash

aliyun configure set \
  --profile default \
  --mode AK \
  --access-key-id <AK> \
  --access-key-secret <SK> \
  --region cn-hangzhou

Technical Analysis

The documentation instructs users to substitute a real Alibaba Cloud access-key secret directly into a command-line argument. Command-line secrets can be exposed through shell history, process inspection facilities, terminal capture, command auditing, Agent transcripts, debugging logs, and copied evidence files.

Although SKILL.md later recommends environment variables, those variables can also be exposed to child processes and local process-inspection mechanisms, and the explicit command example remains likely to encourage users or an Agent to place a long-lived secret in recorded command text.

No hardcoded real credential was found in the project. The risk arises when a user follows the documented example with an actual secret.

Attack Path

1. A user or Agent replaces <SK> with a real Alibaba Cloud access-key secret.
2. The command is executed in a shell or through an Agent tool that records command arguments.
3. The secret remains available in shell history, execution transcripts, audit logs, terminal recordings, or process metadata while the command runs.
4. Another local user, log reader, support operator, or party with access to retained Agent output obtains the secret.
5. The attacker uses the access-key ID and secret to authenticate to Alibaba Cloud APIs.
6. The attacker performs operations allowed by the policies attached to that identity.

Impact Assessment

The cloud impact is determined by the permissions attached to the exposed access key. With properly restricted credentials, compromise ma ...[truncated 442 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove examples that place access-key secrets directly in command-line arguments.
2. Prefer a secure interactive configuration flow in which secret input is not echoed and is not included in process arguments.
3. Where supported, use a protected credential file or standard credential provider with owner-only permissions.
4. Prefer short-lived STS credentials, RAM roles, instance roles, or workload identity over long-lived access keys.
5. Explicitly warn users not to paste secrets into Agent prompts, command transcripts, shell history, or evidence files.
6. Redact secrets from all saved request parameters, API evidence, errors, and logs.
7. Document shell-history protections only as defense in depth, not as a substitute for avoiding argv-based secrets.
8. Require least-privilege RAM policies and establish a credential rotation and revocation procedure for suspected disclosure.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as a cloud-management helper, but its documented flow includes downloading and installing or replacing a local CLI binary and maintaining local update state. That mismatch can cause users or orchestration systems to grant execution trust for cloud operations while unintentionally permitting software installation and local system modification, which materially expands the attack surface.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes shell commands, writes files, relies on environment variables, and performs network-facing installation steps, yet it declares no explicit tool scope or permission boundaries. This makes the skill harder to safely sandbox and increases the risk of unintended shell, filesystem, or network use when auto-invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description says to use the skill whenever users need command-line operations on Alibaba Cloud resources, credential setup, region selection, or API discovery. This is a very wide activation scope and does not provide explicit exclusions or negative examples, which can cause the skill to be invoked for many loosely related cloud requests.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill explicitly creates and persists output artifacts, including version checks, API outputs, and error logs, under a stable directory. In a cloud CLI context, persisted logs and request evidence can capture sensitive operational metadata and potentially secrets or identifiers, especially around credential setup or API failures.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Validation

bash

mkdir -p output/aliyun-cli-manage
python skills/platform/cli/aliyun-cli-manage/scripts/ensure_aliyun_cli.py --help > output/aliyun-cli-manage/validate-help.txt

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ensure_aliyun_cli.py (reported line 40)May include surrounding context.

python

def run_version(binary: Path) -> tuple[tuple[int, ...], str]:
    try:
        out = subprocess.check_output([str(binary), "version"], text=True, stderr=subprocess.STDOUT)
    except Exception:
        return tuple(), ""
    return parse_version(out), out.strip()

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This skill includes self-installing and self-updating behavior that is broader than the stated purpose of managing Alibaba Cloud resources via CLI. In this context, automatic download, extraction, replacement, and execution of a remote binary increases attack surface and may surprise users or downstream agents, especially because the update source is not pinned to a version or verified cryptographically.

Content

No source excerpt is available for this finding.

Tainted flow: 'target' from os.getenv (line 115, credential/environment) → shutil.copy2 (file write)

Medium

• Category: Data Flow
• Confidence: 93% confidence

Finding

The script allows the destination binary path to be influenced by CLI arguments and environment variables, then writes a downloaded executable to that path and later executes it. In combination with the lack of integrity verification on the downloaded archive, this creates a dangerous arbitrary file overwrite / untrusted binary installation path that could replace user-selected executables or persist a malicious binary in a sensitive location.

Content

Scanner excerpt · scripts/ensure_aliyun_cli.py (reported line 79)May include surrounding context.

python

extracted = td_path / member.name
            if not extracted.exists():
                raise RuntimeError("extracted aliyun binary missing")
            shutil.copy2(extracted, target)
    mode = target.stat().st_mode
    target.chmod(mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)