T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:25- Finding
Broad Access to Long-Lived Alibaba Cloud Credentials
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 25-29
Vulnerability Type: Excessive access to a user-level credential store
Risk Level: MediumVulnerable Code Snippet:
markdown ## AccessKey Priority (Required) 1) Environment variables (preferred):`ALICLOUD_ACCESS_KEY_ID` / `ALICLOUD_ACCESS_KEY_SECRET` / `ALICLOUD_REGION_ID` Region policy: `ALICLOUD_REGION_ID` is optional default; if unset choose the most reasonable region and ask when unclear. 2) Standard credentials file:`~/.alibabacloud/credentials`Technical Analysis
The Skill explicitly directs the Agent to use
~/.alibabacloud/credentialsas a credential source. This user-level file may contain long-lived AccessKey secrets and multiple profiles with permissions extending beyond the requested RDS Supabase task.Authentication to Alibaba Cloud is necessary for the declared functionality, and the Skill appropriately prefers environment variables and recommends least-privilege RAM credentials. However, instructing an Agent to access the credential file directly expands the sensitive-data boundary. If the file is read as ordinary text rather than through an official SDK credential provider, its complete contents could enter the Agent context, command output, logs, or generated evidence.
No instruction to exfiltrate, print, or persist credentials was found, and the documented external destinations are official Alibaba Cloud domains. The risk is therefore excessive credential exposure and potential misuse rather than confirmed credential theft.
Attack Path
- A user invokes the Skill for an Alibaba Cloud RDS Supabase operation.
- Preferred environment variables are unavailable.
- Following the required credential priority, the Agent accesses
~/.alibabacloud/credentials. - Direct file inspection exposes one or more long-lived AccessKey pairs to the Agent execution context.
- Malicious instructions, accidental logging, ...[truncated 1003 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove instructions that encourage direct reading or printing of
~/.alibabacloud/credentials. - Require the official Alibaba Cloud SDK credential-provider chain so secrets are resolved without being placed in prompts, command output, evidence files, or logs.
- Prefer short-lived STS credentials or an assumed RAM role over long-lived AccessKeys.
- Scope RAM permissions to the required RDS AI operations, resource identifiers, and regions. Separate read-only and mutating roles where practical.
- Require explicit user confirmation before destructive or security-sensitive operations, including deletion, password resets, public endpoint changes, IP allowlist changes, and SSL disablement.
- Explicitly prohibit saving AccessKey secrets, database passwords, dashboard passwords, storage secrets, private keys, or unredacted sensitive API responses under
output/aliyun-rds-supabase/. - Redact secret-bearing fields from logs and evidence, including
AccessKeySecret, password fields, storage credentials, certificate private keys, authorization headers, signatures, and session tokens. - If file-based profiles must remain supported, accept only a user-selected profile through the SDK provider and enforce restrictive filesystem permissions without reading the entire file into the Agent context.
- Remove instructions that encourage direct reading or printing of