qwencloud-deploy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:43 AM UTC
• Version: 1.0.3

Overview

This is a real Alibaba Cloud deployment skill, but it needs Review because it uses broad cloud authority, remote root commands, persistent credentials, and some under-scoped safety controls.

Install only if you are comfortable granting Alibaba Cloud permissions that can create, modify, and delete cloud resources, run shell commands on ECS instances, and optionally register domains. Prefer least-privilege RAM policies over the suggested FullAccess shortcuts, review every cost/delete/domain-purchase confirmation, avoid deploying untrusted application code until the service runs as a non-root user, and remove or rotate passwords stored in .qwencloud-deploy.local when no longer needed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: reference/rules/rule_interaction.md:161

Finding

Mandatory Promotional Output Alters Agent Responses

Content

View full analysis

💬 Hi! Welcome to the **Qwen Cloud Deployment Tool** 🚀 I'll help you deploy your project to cloud with one click. ... > **🤖 Model Recommendation** — Cloud deployment involves multi-step reasoning and error recovery. A capable model is > recommended; smaller models may get stuck on complex steps. Use the **latest Qwen model** — see the full model list at > [Qwen Cloud Model Market](https://www.qwencloud.com/models). ... Confirm via AskUserQuestion: **Got it, start deployment** / **Not now**. ``` ### Technical Analysis The Skill requires the Agent to display a fixed branded message in full whenever the Skill is triggered. The required text includes an unsolicited recommendation to use a particular model family and directs the user to an external commercial model marketplace. This instruction changes the Agent's response behavior beyond what is necessary to deploy an application. Because the requirement applies automatically, including when a user makes a generic cloud-deployment request, the Skill can inject promotional content without the user explicitly asking for product recommendations. The deployment introduction, cost notice, and confirmation prompt are legitimate interaction requirements. The model-market recommendation and mandatory branding are not technically required to perform deployment. ### Attack Path 1. A user requests deployment to the cloud without selecting a specific provider or model. 2. The Skill is automatically selected under its trigger rules. 3. The interaction rules require the entire fixed welcome message to be emitted. 4. The Agent inserts a branded model recommendati ...[truncated 643 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: templates/userdata/systemd.sh:110

Finding

Deployed Application Runs as Root Without Service Sandboxing

Content

View full analysis

/etc/systemd/system/${APP_NAME}.service <

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Warning

• Location: templates/userdata/docker.sh:79

Finding

Mutable Docker Compose Binary Is Downloaded and Executed Without Integrity Verification

Content

View full analysis

/dev/null 2>&1; then mkdir -p /usr/local/lib/docker/cli-plugins curl -fsSL https://github.com/docker/compose/releases/latest/download/docker-compose-linux-x86_64 \ -o /usr/local/lib/docker/cli-plugins/docker-compose chmod +x /usr/local/lib/docker/cli-plugins/docker-compose fi ``` The same unsafe installation pattern is also used in `scripts/update_app.sh:96-101`: ```bash if ! docker compose version >/dev/null 2>&1; then mkdir -p /usr/local/lib/docker/cli-plugins curl -fsSL https://github.com/docker/compose/releases/latest/download/docker-compose-linux-x86_64 \ -o /usr/local/lib/docker/cli-plugins/docker-compose chmod +x /usr/local/lib/docker/cli-plugins/docker-compose fi ``` ### Technical Analysis The bootstrap downloads an executable from a mutable `releases/latest` URL and installs it into a privileged executable location. It does not: - Pin an exact release version. - Validate a SHA-256 or stronger digest. - Verify a release signature or provenance attestation. - Download to a temporary file and atomically install only after validation. HTTPS authenticates the transport endpoint but does not protect against an upstream release compromise, unauthorized replacement of the mutable release asset, or compromise of the source account and build pipeline. The effective code executed by the Skill can therefore change after the Skill package has been audited. The update script repeats the same behavior through Alibaba Cloud Assistant, where the generated script normally executes with administrative privileges on ECS. ### Attack Path 1. An attacker compromises the upstream release account, release asset, or build pipeline associated with the mutabl ...[truncated 1147 chars]

Remediation

View remediation

" tmp=$(mktemp) curl --fail --location --proto '=https' \ "https://github.com/docker/compose/releases/download/${COMPOSE_VERSION}/docker-compose-linux-x86_64" \ -o "$tmp" printf '%s %s\n' "$EXPECTED_SHA256" "$tmp" | sha256sum --check - install -m 0755 "$tmp" /usr/local/lib/docker/cli-plugins/docker-compose rm -f "$tmp" ``` 4. Verify an official cryptographic signature or provenance attestation where available. 5. Fail closed if verification fails; never execute or retain the unverified binary. 6. Apply the same fix to both `templates/userdata/docker.sh` and `scripts/update_app.sh`. 7. Consider packaging the reviewed dependency in a trusted image or artifact controlled by the deployment process. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/record_state.py:88

Finding

ECS and RDS Passwords Are Persisted in Plaintext

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (115)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a full cloud deployment skill for Alibaba Cloud International. The supplied code does not deploy anything, interact with any cloud platform, access a Git repository, provision infrastructure, or expose a service online. Its sole purpose is to append an event entry to a local app_timeline.jsonl file and set file permissions. While deployment-state recording is mentioned in the description, this code implements only that narrow logging support function, not the primary advertised behavior. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is centered on creating or updating online services on Alibaba Cloud International. The supplied code chunk does the opposite: it is a teardown script (delete_stack.sh) for full stack destruction. It reads a saved state file, confirms with the user, calls aliyun ros DeleteStack, waits for deletion, attempts to remove an OSS staging bucket, removes DNS A records, and deletes local state files. This is not a supporting implementation detail of deployment; it is a separate, irreversible cleanup capability with a materially different primary purpose. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad app-deployment skill whose main function is deploying projects to Alibaba Cloud International and managing the resulting online service. This code chunk does not perform deployment at all. Instead, it exclusively handles domain lifecycle and DNS operations via Alibaba Cloud domain and AliDNS APIs, plus DNS verification workflows relevant to HTTPS/ACME. Optional domain and HTTPS setup is mentioned in the description, so some DNS/TXT support is aligned as a sub-feature. However, the chunk lacks the primary promised behaviors: provisioning infrastructure, deploying application code, exposing a service with a public IP, confirming deployment state, running health checks, or updating an existing deployment. Because the actual code's primary purpose is materially narrower and different from the declared one, this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description promises an end-to-end Alibaba Cloud International deployment skill that provisions cloud resources and publishes a project or Git repo online with several orchestration and lifecycle features. The supplied code chunk is only a host-level bootstrap script for starting an already-prepared Docker artifact on a machine. It installs Docker, fetches a tarball, runs it, and optionally uses docker compose and a db.env file. That is a supporting deployment component, but by itself it does not implement the core declared capabilities such as Alibaba Cloud provisioning, ROS orchestration, pricing confirmation, online exposure setup, domain/HTTPS configuration, health checks, or deployment tracking. Therefore the code chunk's actual behavior is materially narrower than the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broad end-to-end Alibaba Cloud deployment skill that can deploy or update projects/repos, provision resources, confirm pricing, record deployment state, run health checks, and optionally configure domain/HTTPS. The supplied code chunk is much narrower: it is only a userdata/bootstrap script for serving static files with Nginx on an ECS instance. While the script does include a simple health endpoint and is plausibly a supporting component of a larger deployment system, this code by itself does not implement most of the declared capabilities and has a materially different primary purpose. Therefore the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description is for a full one-click Alibaba Cloud deployment skill that provisions infrastructure, deploys applications or repositories, confirms pricing, tracks deployment state, supports updates, and optionally configures domain/HTTPS. The supplied code chunk is much narrower: it is only a user-data bootstrap script configuring Nginx on a machine. It installs Nginx, downloads an already-built static tarball from a signed URL, configures static hosting with /api/ reverse proxying to localhost, and exposes a simple health endpoint. While this could be a supporting component within a larger deployment system, the chunk itself does not implement most of the declared capabilities, and its primary purpose is instance-local web server setup rather than one-click cloud deployment. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied code is only a host-level bootstrap/install script for running an already-packaged application on a Linux instance. It does support a narrow subset of the declared goal—starting a deployed app under systemd after downloading an artifact—but it does not implement most of the prominent capabilities described, such as provisioning Alibaba Cloud resources, orchestrating ROS, confirming pricing, configuring public exposure, setting up domains/HTTPS, recording deployment state, or performing health checks. This is a material description-behavior mismatch because the declared purpose presents an end-to-end one-click cloud deployment tool, while the code chunk only handles post-provisioning application setup on a machine.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

- `aliyun` CLI 3.x installed; when no valid credential, follow `reference/deploy/01_env_check.md`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

- `aliyun` CLI 3.x installed; when no valid credential, follow `reference/deploy/01_env_check.md`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

| 7 | Generate ROS template | `reference/deploy/07_generate_template.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

| 11 | Create stack | `reference/deploy/11_create_stack.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md

See `reference/cleanup/delete_stack.md`.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file is scoped as Alibaba Cloud International, but the workflow uses the aliyun CLI naming and links users to an aliyun.com OSS console for manual activation. This can misroute users into the China partition or an incompatible account/environment, causing deployments, credentials, and resources to be created in the wrong cloud partition with different legal, billing, and access properties.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference/deploy/11_create_stack.md (reported line 19)May include surrounding context.

APP_NAME="$APP_NAME" APP_DESC="$APP_DESC"
[TIMEOUT_MIN=40]
bash scripts/create_stack.sh "$REGION" "$TEMPLATE_URL" "$STACK_NAME" /tmp/qwencloud-params.json rm -f /tmp/qwencloud-params.json

text

> The ROS CLI receives passwords as command-line arguments, visible via `ps` while the process

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The documented hot-update flow performs an unconditional 'rm -rf /opt/qwencloud' before moving staging into place. In a cloud deployment skill that executes remotely via Cloud Assistant, this is dangerous because if the target path is wrong, unexpectedly empty, a symlink, or otherwise manipulated, it can destroy the live application or unintended filesystem content and cause service outage.

Content

Scanner excerpt · reference/hotfix/update_app.md (reported line 44)May include surrounding context.

md

2. **Phase 2: Atomic Swap** (downtime window)
   - `systemctl stop <service_name>`
   - `rm -rf /opt/qwencloud && mv staging → /opt/qwencloud`
   - Offline dependency install (using Phase 1 pre-downloaded cache)
   - `systemctl restart <service_name>`
   - Health check: service status + app logs (no HTTP probe), auto-rollback on failure

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The documented hot-update flow performs an unconditional 'rm -rf /opt/qwencloud' before moving staging into place. In a cloud deployment skill that executes remotely via Cloud Assistant, this is dangerous because if the target path is wrong, unexpectedly empty, a symlink, or otherwise manipulated, it can destroy the live application or unintended filesystem content and cause service outage.

Content

Scanner excerpt · reference/hotfix/update_app.md (reported line 44)May include surrounding context.

md

2. **Phase 2: Atomic Swap** (downtime window)
   - `systemctl stop <service_name>`
   - `rm -rf /opt/qwencloud && mv staging → /opt/qwencloud`
   - Offline dependency install (using Phase 1 pre-downloaded cache)
   - `systemctl restart <service_name>`
   - Health check: service status + app logs (no HTTP probe), auto-rollback on failure

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The static update step unconditionally deletes '/var/www/static' before replacing it with staging content. In the context of a one-click cloud deployment skill operating on public-facing services, this can cause immediate website loss and could remove unintended content if the path is misconfigured, symlinked, or altered on the remote host.

Content

Scanner excerpt · reference/hotfix/update_app.md (reported line 68)May include surrounding context.

md

1. Download to `/var/www/static.staging`
2. Integrity check
3. `rm -rf /var/www/static && mv staging`
4. `nginx -t && systemctl reload nginx`

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The static update step unconditionally deletes '/var/www/static' before replacing it with staging content. In the context of a one-click cloud deployment skill operating on public-facing services, this can cause immediate website loss and could remove unintended content if the path is misconfigured, symlinked, or altered on the remote host.

Content

Scanner excerpt · reference/hotfix/update_app.md (reported line 68)May include surrounding context.

md

1. Download to `/var/www/static.staging`
2. Integrity check
3. `rm -rf /var/www/static && mv staging`
4. `nginx -t && systemctl reload nginx`

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference/hotfix/update_recipe.md (reported line 35)May include surrounding context.

curl -fsSL '<APP_URL>' -o "$STAGING_DIR/app.tar.gz" tar -tzf "$STAGING_DIR/app.tar.gz" >/dev/null tar -xzf "$STAGING_DIR/app.tar.gz" -C "$STAGING_DIR" rm -f "$STAGING_DIR/app.tar.gz"

text

#### Per-app_type Dependency Pre-install

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference/hotfix/update_recipe.md (reported line 162)May include surrounding context.

tar -xzf /tmp/static.tar.gz -C "$STATIC_STAGING" --strip-components=0 rm -f /tmp/static.tar.gz

rm -rf /var/www/static mv "$STATIC_STAGING" /var/www/static nginx -t && systemctl reload nginx

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference/https/https_setup.md (reported line 244)May include surrounding context.

md

# Kill stale certbot (from previous timeout) and clear lock + stale token
pkill -f certbot 2>/dev/null || true
rm -f $CB/config/.certbot.lock $CB/work/.certbot.lock $CB/logs/.certbot.lock
rm -f $CB/token.txt  # MUST delete old token so agent only reads THIS run's token

# Short-circuit if cert already valid (>7 days)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference/https/https_setup.md (reported line 245)May include surrounding context.

md

# Kill stale certbot (from previous timeout) and clear lock + stale token
pkill -f certbot 2>/dev/null || true
rm -f $CB/config/.certbot.lock $CB/work/.certbot.lock $CB/logs/.certbot.lock
rm -f $CB/token.txt  # MUST delete old token so agent only reads THIS run's token

# Short-circuit if cert already valid (>7 days)
if [ -f "$LIVE/fullchain.pem" ] && openssl x509 -checkend 604800 -noout -in "$LIVE/fullchain.pem" 2>/dev/null; then

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · reference/rules/rule_interaction.md (reported line 143)May include surrounding context.

md

## Error Fallback

When encountering an error, always answer three questions: **What happened** · **Resource/billing status** · **Next-step
options**.

- 🟢 Ignorable: one line, continue

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This script performs full infrastructure destruction via ROS DeleteStack and OSS bucket cleanup, yet the skill metadata presents the capability as deployment/update oriented. That mismatch creates a serious authorization and trust-boundary problem: an agent or user may select the skill for non-destructive publishing tasks while the repository also contains powerful teardown logic capable of deleting live cloud resources.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/delete_stack.sh (reported line 88)May include surrounding context.

sh

;;
  esac
  echo "[delete] Cleaning OSS bucket $BUCKET"
  if ! aliyun oss rm "oss://$BUCKET" -r -f >/dev/null 2>&1 \
     || ! aliyun oss rm "oss://$BUCKET" -b -f >/dev/null 2>&1; then
    echo "[delete] Warning: OSS bucket $BUCKET was not fully cleaned. The bucket has a 7-day auto-expiration lifecycle and won't incur ongoing charges;" >&2
    echo "         to delete immediately, clean up manually in OSS console." >&2

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.generated_source_template_injection

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: reference/hotfix/update_app.md:44

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: reference/hotfix/update_recipe.md:52

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: reference/https/https_setup.md:258