Aliyun Sls Openclaw Integration

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:46 AM UTC
• Version: 1.0.0

Overview

This skill appears to set up a real Alibaba Cloud logging integration, but it can install system software and upload OpenClaw session transcripts from every local user's home directory.

Review carefully before installing. Use only on a host where all affected users have approved OpenClaw session transcript collection, preferably a dedicated single-user or test machine. Pin and verify the LoongCollector installer, restrict the collector path to the intended user, avoid long-lived AK/SK in shared shells, and set least-privilege SLS permissions, short retention, and a documented uninstall/cleanup procedure.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:127
• Finding: Mutable Remote Installer Is Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 127–129 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash wget "https://aliyun-observability-release-${REGION_ID}.oss-${REGION_ID}.aliyuncs.com/loongcollector/linux64/latest/loongcollector.sh" -O loongcollector.sh chmod +x loongcollector.sh ./loongcollector.sh install "${REGION_ID}" ``` ### Technical Analysis The skill downloads an executable shell script from a mutable `latest` URL and immediately runs it. It does not pin a specific collector version or verify a cryptographic checksum or digital signature before execution. Although HTTPS provides transport protection, it does not establish that the downloaded object is the exact artifact reviewed by the skill author. The effective code can change after the skill package has been audited if the remote object is replaced, the release infrastructure is compromised, or the upstream publisher serves a malicious update. This is a direct remote payload execution channel: the behavior ultimately executed on the host is determined by an external mutable resource rather than by the audited contents of the skill. ### Attack Path 1. An attacker compromises the Alibaba Cloud release bucket, release account, publication pipeline, or another component capable of modifying the `latest/loongcollector.sh` object. 2. The attacker replaces the remote installer with a modified shell script. 3. A user invokes the skill on a host where LoongCollector is not already running. 4. The skill downloads the attacker-controlled object as `loongcollector.sh`. 5. The skill marks the file executable and runs it without validating its version, checksum, or signature. 6. The payload executes with the privileges of the invoking process. If the installer invokes `sudo`, or the skill itself is run as root, the payload may obtain root-level control. ### Impact Assessment Successful exploitation permits arbitr ...[truncated 618 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the mutable `latest` path with a pinned, explicitly approved LoongCollector version. 2. Obtain the expected SHA-256 digest from a separately authenticated vendor channel and verify it before execution: ```bash EXPECTED_SHA256="<vendor-published-digest>" printf '%s %s\n' "$EXPECTED_SHA256" loongcollector.sh | sha256sum --check - ``` 3. Prefer vendor-signed packages and verify the package signature against a pinned vendor public key. 4. Download into a securely created temporary directory using `mktemp -d`, and remove the artifact after installation. 5. Use strict download options such as `--https-only`, appropriate timeouts, and failure-on-error behavior. 6. Abort installation on any checksum, signature, ownership, or permission mismatch. 7. Review the pinned installer before approving a version update rather than automatically following the newest upstream payload. 8. Run installation with the minimum privileges possible and isolate any explicitly required privileged operations. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/collector-config.json:1
• Finding: Collector Configuration Exports Session Transcripts from Every Matching User Home Directory<![CDATA[ ## Vulnerability Details **File Location**: `references/collector-config.json`, line 1 **Vulnerability Type**: Excessive cross-user file access and sensitive-data collection **Risk Level**: High ### Vulnerable Code ```json { "configName": "${configName}", "logSample": "", "inputs": [ { "AllowingIncludedByMultiConfigs": true, "Type": "input_file", "FilePaths": [ "/home/*/.openclaw/agents/main/sessions/*jsonl" ], "EnableContainerDiscovery": false, "MaxDirSearchDepth": 0, "FileEncoding": "utf8" } ], "flushers": [ { "Type": "flusher_sls", "Endpoint": "${region_id}-intranet.log.aliyuncs.com", "Logstore": "${logstoreName}", "Region": "${region_id}", "TelemetryType": "logs" } ], "global": { "TopicType": "filepath", "TopicFormat": "/home/.*?/\\.openclaw/agents/main/sessions/(.*?).jsonl" }, "processors": [ { "Type": "processor_parse_json_native", "SourceKey": "content" }, { "Type": "processor_parse_timestamp_native", "SourceKey": "timestamp", "SourceTimezone": "GMT+00:00", "SourceFormat": "%Y-%m-%dT%H:%M:%S" } ] } ``` ### Technical Analysis The `FilePaths` pattern contains `/home/*/`, causing the collector to process session files belonging to every matching local user rather than only the user who requested the integration. A system collector commonly runs with privileges that allow it to bypass ordinary per-user file boundaries. The collected files are complete OpenClaw session JSONL records and are sent to Alibaba Cloud SLS. No processor in the configuration filters sensitive event types or redacts credentials, personal information, tool arguments, prompts, responses, or file contents before transmission. The associated index definition in `references/index.json` further confirms that fields including `message.content`, `role`, `api`, `provider`, `model`, and usage information ar ...[truncated 1614 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit informed consent before enabling session transcript collection and clearly disclose which content will be uploaded. 2. Replace `/home/*/` with a validated, explicitly selected user home directory. 3. Do not derive the target path from untrusted input without canonicalization and allow-list validation. 4. Run the collector under a dedicated least-privileged account that can read only the approved session directory. 5. Add processors that remove or redact credentials, tokens, authorization headers, personal information, tool arguments, and sensitive message content before transmission. 6. Prefer collecting aggregate operational metrics rather than complete prompts and responses. 7. Separate data by user or tenant where multi-user collection is genuinely required, and obtain authorization from every affected user. 8. Restrict SLS query, export, and administration permissions using least-privilege RAM policies. 9. Enable audit logging for access to the Logstore and alert on bulk queries or exports. 10. Apply an appropriately short retention period, encryption controls, and documented deletion procedures for session data. 11. Provide a dry-run mode that displays the exact local paths and fields that will be collected before the configuration is applied. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (24)

Chaining Abuse

High

• Category: Tool Misuse

Content

USER_DEFINED_ID="${EXISTING_USER_DEFINED_ID}"
else
  USER_DEFINED_ID="${USER_DEFINED_ID_PREFIX}${RAND8}"
  echo "${USER_DEFINED_ID}" | sudo tee -a /etc/ilogtail/user_defined_id >/dev/null
fi
if ! sudo grep -Fxq "${USER_DEFINED_ID}" /etc/ilogtail/user_defined_id 2>/dev/null; then
  echo "Failed to persist USER_DEFINED_ID to /etc/ilogtail/user_defined_id" >&2

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
if ! command -v aliyun >/dev/null 2>&1; then
  if command -v apt-get >/dev/null 2>&1; then
    sudo apt-get update && sudo apt-get install -y aliyun-cli
  elif command -v dnf >/dev/null 2>&1; then
    sudo dnf install -y aliyun-cli
  elif command -v yum >/dev/null 2>&1; then

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill performs privileged package installation, service management, and writes under /etc, but its user-facing description does not explicitly warn that it will modify the host system. That omission increases the chance of uninformed execution of impactful changes on a production Linux host.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 1) Install aliyun CLI if missing (Linux)
if ! command -v aliyun >/dev/null 2>&1; then
  if command -v apt-get >/dev/null 2>&1; then
    sudo apt-get update
    sudo apt-get install -y aliyun-cli
  elif command -v dnf >/dev/null 2>&1; then
    sudo dnf install -y aliyun-cli

• Confidence: 94% confidence
• Finding: This command elevates privileges to update package metadata on the local host. In context, the action is operationally relevant, but it is still security-sensitive because it changes system state and should not be performed without explicit informed consent.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if ! command -v aliyun >/dev/null 2>&1; then
  if command -v apt-get >/dev/null 2>&1; then
    sudo apt-get update
    sudo apt-get install -y aliyun-cli
  elif command -v dnf >/dev/null 2>&1; then
    sudo dnf install -y aliyun-cli
  elif command -v yum >/dev/null 2>&1; then

• Confidence: 95% confidence
• Finding: Installing aliyun-cli with sudo modifies the system package set and may pull additional packages from configured repositories. This is potentially dangerous if run on sensitive hosts or without clear user approval.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo apt-get update
    sudo apt-get install -y aliyun-cli
  elif command -v dnf >/dev/null 2>&1; then
    sudo dnf install -y aliyun-cli
  elif command -v yum >/dev/null 2>&1; then
    sudo yum install -y aliyun-cli
  elif command -v zypper >/dev/null 2>&1; then

• Confidence: 95% confidence
• Finding: This uses root privileges to install software via dnf, altering host state. While expected for setup automation, it still represents privileged execution that could affect system integrity or availability if run in the wrong environment.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

elif command -v dnf >/dev/null 2>&1; then
    sudo dnf install -y aliyun-cli
  elif command -v yum >/dev/null 2>&1; then
    sudo yum install -y aliyun-cli
  elif command -v zypper >/dev/null 2>&1; then
    sudo zypper -n install aliyun-cli
  else

• Confidence: 95% confidence
• Finding: Using sudo yum install performs privileged package installation on the host. The risk is contextual rather than overtly malicious, but the action remains sensitive because it changes trusted system software.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

elif command -v yum >/dev/null 2>&1; then
    sudo yum install -y aliyun-cli
  elif command -v zypper >/dev/null 2>&1; then
    sudo zypper -n install aliyun-cli
  else
    echo "aliyun CLI not found. Install aliyun-cli manually for your Linux distribution." >&2
    exit 1

• Confidence: 95% confidence
• Finding: This line installs aliyun-cli with root privileges via zypper, modifying the base system. In an automation skill, that is operationally legitimate but still a privileged action with meaningful host impact.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

export ALIBABA_CLOUD_ACCESS_KEY_SECRET

is_loong_running() {
  if sudo /etc/init.d/loongcollectord status 2>/dev/null | grep -qi "running"; then
    return 0
  fi
  if sudo /etc/init.d/ilogtaild status 2>/dev/null | grep -qi "running"; then

• Confidence: 92% confidence
• Finding: Querying service status via sudo requires elevated privileges and implicitly normalizes root execution within the skill. Although lower risk than installation, it still broadens the scope of privileged operations on the host.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if sudo /etc/init.d/loongcollectord status 2>/dev/null | grep -qi "running"; then
    return 0
  fi
  if sudo /etc/init.d/ilogtaild status 2>/dev/null | grep -qi "running"; then
    return 0
  fi
  return 1

• Confidence: 92% confidence
• Finding: This checks ilogtaild status with sudo, again extending privileged execution into monitoring logic. The risk is mainly from unnecessary privilege expansion and habituating users to approve broad sudo usage.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Post-install verification: one of loongcollectord/ilogtaild must be running.
if ! is_loong_running; then
  sudo /etc/init.d/loongcollectord start >/dev/null 2>&1 || true
  sudo /etc/init.d/ilogtaild start >/dev/null 2>&1 || true
fi
if ! is_loong_running; then

• Confidence: 96% confidence
• Finding: Starting loongcollectord with sudo changes runtime state on the host and activates a newly installed collector process. This has higher impact than status checks because it launches software that can collect and transmit telemetry.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Post-install verification: one of loongcollectord/ilogtaild must be running.
if ! is_loong_running; then
  sudo /etc/init.d/loongcollectord start >/dev/null 2>&1 || true
  sudo /etc/init.d/ilogtaild start >/dev/null 2>&1 || true
fi
if ! is_loong_running; then
  echo "LoongCollector installation check failed: neither loongcollectord nor ilogtaild is running." >&2

• Confidence: 96% confidence
• Finding: Starting ilogtaild with root privileges activates a telemetry agent on the host. In this skill's context, that is intended behavior, but it can affect confidentiality and availability if enabled unintentionally.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi

# 3) Local user-defined identifier + create machine group
sudo mkdir -p /etc/ilogtail
sudo mkdir -p /etc/ilogtail/users
if [ ! -f /etc/ilogtail/user_defined_id ]; then
  sudo touch /etc/ilogtail/user_defined_id

• Confidence: 95% confidence
• Finding: Creating /etc/ilogtail with sudo modifies protected system configuration paths. This is a real host change and should be treated as sensitive, especially on production machines.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 3) Local user-defined identifier + create machine group
sudo mkdir -p /etc/ilogtail
sudo mkdir -p /etc/ilogtail/users
if [ ! -f /etc/ilogtail/user_defined_id ]; then
  sudo touch /etc/ilogtail/user_defined_id
fi

• Confidence: 95% confidence
• Finding: Creating /etc/ilogtail/users with root privileges alters system-managed configuration directories. The action is relevant to the integration but still constitutes privileged modification of the host.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo mkdir -p /etc/ilogtail
sudo mkdir -p /etc/ilogtail/users
if [ ! -f /etc/ilogtail/user_defined_id ]; then
  sudo touch /etc/ilogtail/user_defined_id
fi
RAND8="$(LC_ALL=C tr -dc 'a-z0-9' </dev/urandom | head -c 8)"
USER_DEFINED_ID_PREFIX="${PROJECT}_openclaw_sls_collector_"

• Confidence: 95% confidence
• Finding: Touching /etc/ilogtail/user_defined_id with sudo creates a persistent system file used for collector identity. This can have operational side effects and should not be silently performed.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi
RAND8="$(LC_ALL=C tr -dc 'a-z0-9' </dev/urandom | head -c 8)"
USER_DEFINED_ID_PREFIX="${PROJECT}_openclaw_sls_collector_"
EXISTING_USER_DEFINED_ID="$(sudo awk -v p="${USER_DEFINED_ID_PREFIX}" 'index($0,p)==1 {print; exit}' /etc/ilogtail/user_defined_id 2>/dev/null || true)"
if [ -n "${EXISTING_USER_DEFINED_ID}" ]; then
  USER_DEFINED_ID="${EXISTING_USER_DEFINED_ID}"
else

• Confidence: 91% confidence
• Finding: Reading a protected config file with sudo is less risky than writing, but it still extends privileged access into the skill's logic. Broad use of elevated reads can expose sensitive system information patterns and normalizes unnecessary root usage.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

USER_DEFINED_ID="${EXISTING_USER_DEFINED_ID}"
else
  USER_DEFINED_ID="${USER_DEFINED_ID_PREFIX}${RAND8}"
  echo "${USER_DEFINED_ID}" | sudo tee -a /etc/ilogtail/user_defined_id >/dev/null
fi
if ! sudo grep -Fxq "${USER_DEFINED_ID}" /etc/ilogtail/user_defined_id 2>/dev/null; then
  echo "Failed to persist USER_DEFINED_ID to /etc/ilogtail/user_defined_id" >&2

• Confidence: 97% confidence
• Finding: This writes data into a root-owned file via a shell pipeline to sudo tee, causing persistent system configuration changes. In addition to the write itself, pipeline-based elevation is more error-prone and can complicate review of exactly what privileged data path is being used.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

USER_DEFINED_ID="${USER_DEFINED_ID_PREFIX}${RAND8}"
  echo "${USER_DEFINED_ID}" | sudo tee -a /etc/ilogtail/user_defined_id >/dev/null
fi
if ! sudo grep -Fxq "${USER_DEFINED_ID}" /etc/ilogtail/user_defined_id 2>/dev/null; then
  echo "Failed to persist USER_DEFINED_ID to /etc/ilogtail/user_defined_id" >&2
  exit 1
fi

• Confidence: 92% confidence
• Finding: This line performs a privileged read/verification of the config file. The risk is moderate-to-low by itself, but it contributes to a pattern of broad sudo use throughout the skill.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

exit 1
fi
if [ ! -f "/etc/ilogtail/users/${ALIYUN_UID}" ]; then
  sudo touch "/etc/ilogtail/users/${ALIYUN_UID}"
fi
if [ ! -f "/etc/ilogtail/users/${ALIYUN_UID}" ]; then
  echo "Failed to create UID marker file: /etc/ilogtail/users/${ALIYUN_UID}" >&2

• Confidence: 95% confidence
• Finding: Creating a marker file under /etc/ilogtail/users with sudo persists host-specific identity state. In the context of onboarding a telemetry collector, this is expected but still a sensitive privileged write with operational implications.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document instructs users to place long-lived Alibaba Cloud access key credentials directly into shell environment variables without any warning about secret handling, shell history exposure, process/environment leakage, or safer alternatives. In an operational troubleshooting skill, this increases the chance that users will paste production credentials into insecure contexts or leave them resident in shared shells and logs.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
if ! command -v aliyun >/dev/null 2>&1; then
  if command -v apt-get >/dev/null 2>&1; then
    sudo apt-get update && sudo apt-get install -y aliyun-cli
  elif command -v dnf >/dev/null 2>&1; then
    sudo dnf install -y aliyun-cli
  elif command -v yum >/dev/null 2>&1; then

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if command -v apt-get >/dev/null 2>&1; then
    sudo apt-get update && sudo apt-get install -y aliyun-cli
  elif command -v dnf >/dev/null 2>&1; then
    sudo dnf install -y aliyun-cli
  elif command -v yum >/dev/null 2>&1; then
    sudo yum install -y aliyun-cli
  elif command -v zypper >/dev/null 2>&1; then

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if command -v apt-get >/dev/null 2>&1; then
    sudo apt-get update && sudo apt-get install -y aliyun-cli
  elif command -v dnf >/dev/null 2>&1; then
    sudo dnf install -y aliyun-cli
  elif command -v yum >/dev/null 2>&1; then
    sudo yum install -y aliyun-cli
  elif command -v zypper >/dev/null 2>&1; then

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if command -v apt-get >/dev/null 2>&1; then
    sudo apt-get update && sudo apt-get install -y aliyun-cli
  elif command -v dnf >/dev/null 2>&1; then
    sudo dnf install -y aliyun-cli
  elif command -v yum >/dev/null 2>&1; then
    sudo yum install -y aliyun-cli
  elif command -v zypper >/dev/null 2>&1; then

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: SKILL.md:155