Alibaba Cloud Platform Aliyun Cli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

The skill is not visibly malicious, but it needs review because it can automatically install and run an unverified cloud CLI binary before performing Alibaba Cloud operations.

Install only if you are comfortable with a skill that can install or replace the local aliyun executable and operate on Alibaba Cloud resources using your credentials. Prefer manually installing a verified Alibaba Cloud CLI yourself, avoid putting access-key secrets in command arguments or prompts, use least-privilege or short-lived credentials, and review saved output logs for sensitive data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/ensure_aliyun_cli.py:60
• Finding: Unverified Remote Executable Download and Execution## Vulnerability Details **File Location**: `scripts/ensure_aliyun_cli.py`, lines 17 and 60-77; execution occurs through lines 37-42 and 132-136 **Vulnerability Type**: Remote payload retrieval and execution without cryptographic integrity verification **Risk Level**: High ### Vulnerable Code ```python DOWNLOAD_URL = "https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz" ``` ```python def run_version(binary: Path) -> tuple[tuple[int, ...], str]: try: out = subprocess.check_output( [str(binary), "version"], text=True, stderr=subprocess.STDOUT ) except Exception: return tuple(), "" return parse_version(out), out.strip() ``` ```python def install_latest(target: Path) -> None: target.parent.mkdir(parents=True, exist_ok=True) with tempfile.TemporaryDirectory(prefix="aliyun-cli-update-") as td: td_path = Path(td) tgz_path = td_path / "aliyun-cli.tgz" with urllib.request.urlopen(DOWNLOAD_URL, timeout=30) as resp: # nosec B310 tgz_path.write_bytes(resp.read()) with tarfile.open(tgz_path, "r:gz") as tf: member = None for m in tf.getmembers(): if Path(m.name).name == "aliyun": member = m break if member is None: raise RuntimeError("aliyun binary not found in archive") tf.extract(member, path=td_path) extracted = td_path / member.name if not extracted.exists(): raise RuntimeError("extracted aliyun binary missing") shutil.copy2(extracted, target) mode = target.stat().st_mode target.chmod(mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH) ``` ```python if should_update: print("[aliyun-cli] updating from official latest package...") install_latest(target) ...[truncated 2789 chars]
• Remediation: ## Remediation Suggestions 1. Replace the mutable `latest` URL with a pinned, explicitly selected CLI version. 2. Store a trusted SHA-256 digest in the reviewed Skill or obtain it from a separately authenticated, signed release manifest. 3. Verify the archive before opening or extracting it, and abort on any mismatch. 4. Verify an official vendor signature where Alibaba Cloud provides one, using a pinned trusted public key. 5. Restrict redirects and validate the final URL scheme and hostname against an explicit allowlist. 6. Download with a strict maximum size to prevent resource exhaustion. 7. Install atomically: verify and inspect the artifact, write it to a temporary file in the destination filesystem, set restrictive permissions, and use an atomic rename. 8. Do not update automatically during normal cloud operations. Separate installation and upgrading into an explicit, user-approved action. 9. Report the exact downloaded version and digest in the audit evidence. 10. If integrity metadata is unavailable, direct the user to install the CLI through a trusted operating-system package mechanism rather than executing an unverified download.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ensure_aliyun_cli.py:65
• Finding: Unsafe Tar Archive Member Extraction## Vulnerability Details **File Location**: `scripts/ensure_aliyun_cli.py`, lines 65-74 **Vulnerability Type**: Archive path traversal and unsafe link extraction **Risk Level**: Medium ### Vulnerable Code ```python with tarfile.open(tgz_path, "r:gz") as tf: member = None for m in tf.getmembers(): if Path(m.name).name == "aliyun": member = m break if member is None: raise RuntimeError("aliyun binary not found in archive") tf.extract(member, path=td_path) extracted = td_path / member.name if not extracted.exists(): raise RuntimeError("extracted aliyun binary missing") shutil.copy2(extracted, target) ``` ### Technical Analysis The code accepts any archive member whose basename is `aliyun`, regardless of its full path or type. A name such as `../../user-controlled-path/aliyun` can pass the basename check. The code does not reject absolute paths, parent-directory components, symbolic links, hard links, devices, or other non-regular archive members. Calling `TarFile.extract()` without validating that the resolved destination remains inside `td_path` can permit path traversal or link-based writes outside the temporary directory. The subsequent path construction also uses the untrusted member name directly. Exploitation requires control over the downloaded archive. That condition overlaps with the remote supply-chain finding, but unsafe extraction provides an additional filesystem-write primitive and can cause damage before the extracted CLI is intentionally executed. ### Attack Path 1. An attacker gains control of, or successfully substitutes, the downloaded archive. 2. The archive contains a member with basename `aliyun` but a malicious full path, such as a path containing `..`, or contains a link-type member targeting a location outside the temporary directory. 3. The basename-only condition selects the malicious member. 4. `tf.e ...[truncated 1008 chars]
• Remediation: ## Remediation Suggestions 1. Require the exact expected member name instead of matching only its basename. 2. Reject absolute paths and any member containing `..` path components. 3. Accept only regular files by checking `member.isreg()`. 4. Reject symbolic links, hard links, devices, FIFOs, and unexpected metadata entries. 5. Resolve the proposed extraction path and verify it is a descendant of the temporary extraction directory before writing. 6. On supported Python versions, use `TarFile.extract(..., filter="data")` as defense in depth, while retaining explicit path and type validation. 7. Prefer reading the validated regular member with `extractfile()` and writing its bytes to a newly created destination file rather than invoking general-purpose archive extraction. 8. Apply an archive size limit and verify that only the expected number of relevant files is present. 9. Perform cryptographic archive verification before parsing any member.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:82
• Finding: Alibaba Cloud Access Key Secret Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 82-88 **Vulnerability Type**: Sensitive credential exposure through process arguments and command logging **Risk Level**: Medium ### Vulnerable Code ```bash aliyun configure set \ --profile default \ --mode AK \ --access-key-id <AK> \ --access-key-secret <SK> \ --region cn-hangzhou ``` ### Technical Analysis The documentation instructs users to substitute a real Alibaba Cloud access-key secret directly into a command-line argument. Command-line secrets can be exposed through shell history, process inspection facilities, terminal capture, command auditing, Agent transcripts, debugging logs, and copied evidence files. Although `SKILL.md` later recommends environment variables, those variables can also be exposed to child processes and local process-inspection mechanisms, and the explicit command example remains likely to encourage users or an Agent to place a long-lived secret in recorded command text. No hardcoded real credential was found in the project. The risk arises when a user follows the documented example with an actual secret. ### Attack Path 1. A user or Agent replaces `<SK>` with a real Alibaba Cloud access-key secret. 2. The command is executed in a shell or through an Agent tool that records command arguments. 3. The secret remains available in shell history, execution transcripts, audit logs, terminal recordings, or process metadata while the command runs. 4. Another local user, log reader, support operator, or party with access to retained Agent output obtains the secret. 5. The attacker uses the access-key ID and secret to authenticate to Alibaba Cloud APIs. 6. The attacker performs operations allowed by the policies attached to that identity. ### Impact Assessment The cloud impact is determined by the permissions attached to the exposed access key. With properly restricted credentials, compromise ma ...[truncated 442 chars]
• Remediation: ## Remediation Suggestions 1. Remove examples that place access-key secrets directly in command-line arguments. 2. Prefer a secure interactive configuration flow in which secret input is not echoed and is not included in process arguments. 3. Where supported, use a protected credential file or standard credential provider with owner-only permissions. 4. Prefer short-lived STS credentials, RAM roles, instance roles, or workload identity over long-lived access keys. 5. Explicitly warn users not to paste secrets into Agent prompts, command transcripts, shell history, or evidence files. 6. Redact secrets from all saved request parameters, API evidence, errors, and logs. 7. Document shell-history protections only as defense in depth, not as a substitute for avoiding argv-based secrets. 8. Require least-privilege RAM policies and establish a credential rotation and revocation procedure for suspected disclosure.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a cloud-management helper, but its documented flow includes downloading and installing or replacing a local CLI binary and maintaining local update state. That mismatch can cause users or orchestration systems to grant execution trust for cloud operations while unintentionally permitting software installation and local system modification, which materially expands the attack surface.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes shell commands, writes files, relies on environment variables, and performs network-facing installation steps, yet it declares no explicit tool scope or permission boundaries. This makes the skill harder to safely sandbox and increases the risk of unintended shell, filesystem, or network use when auto-invoked.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The description says to use the skill whenever users need command-line operations on Alibaba Cloud resources, credential setup, region selection, or API discovery. This is a very wide activation scope and does not provide explicit exclusions or negative examples, which can cause the skill to be invoked for many loosely related cloud requests.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Validation

```bash
mkdir -p output/aliyun-cli-manage
python skills/platform/cli/aliyun-cli-manage/scripts/ensure_aliyun_cli.py --help > output/aliyun-cli-manage/validate-help.txt
```

• Confidence: 86% confidence
• Finding: The skill explicitly creates and persists output artifacts, including version checks, API outputs, and error logs, under a stable directory. In a cloud CLI context, persisted logs and request evidence can capture sensitive operational metadata and potentially secrets or identifiers, especially around credential setup or API failures.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_version(binary: Path) -> tuple[tuple[int, ...], str]:
    try:
        out = subprocess.check_output([str(binary), "version"], text=True, stderr=subprocess.STDOUT)
    except Exception:
        return tuple(), ""
    return parse_version(out), out.strip()

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This skill includes self-installing and self-updating behavior that is broader than the stated purpose of managing Alibaba Cloud resources via CLI. In this context, automatic download, extraction, replacement, and execution of a remote binary increases attack surface and may surprise users or downstream agents, especially because the update source is not pinned to a version or verified cryptographically.

Tainted flow: 'target' from os.getenv (line 115, credential/environment) → shutil.copy2 (file write)

Medium

• Category: Data Flow

Content

extracted = td_path / member.name
            if not extracted.exists():
                raise RuntimeError("extracted aliyun binary missing")
            shutil.copy2(extracted, target)
    mode = target.stat().st_mode
    target.chmod(mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)

• Confidence: 93% confidence
• Finding: The script allows the destination binary path to be influenced by CLI arguments and environment variables, then writes a downloaded executable to that path and later executes it. In combination with the lack of integrity verification on the downloaded archive, this creates a dangerous arbitrary file overwrite / untrusted binary installation path that could replace user-selected executables or persist a malicious binary in a sensitive location.

Static analysis

No suspicious patterns detected.