ClawHub
Back to skill

Security audit

qwencloud-operate

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant for cloud app recovery, but it asks for broad Alibaba Cloud authority and uses remote shell commands in ways that need careful review before installation.

Review before installing. Use a dedicated, short-lived, least-privilege Alibaba Cloud role scoped to the intended region/resources, avoid the wildcard RAM policy as written, pin and verify the Aliyun CLI, inspect .qwencloud-deploy before use, and require explicit approval before any log retrieval or cloud mutation.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
references/diagnose.md:31
Finding

Command Injection Through Unvalidated Deployment State Values

Content
View full analysis
--Type RunShellScript --InstanceId.1 \ --ContentEncoding Base64 \ --CommandContent "$(printf '%s' 'systemctl is-active ; systemctl is-active nginx; ss -ltnp | grep -E ":80|:"; nginx -t 2>&1 | tail -n 3; df -h /; uptime; top -bn1 | head -n 12; free -m; journalctl -u --since "30 min ago" --no-pager | tail -n 80' | base64)" aliyun ecs DescribeInvocations --RegionId --InvokeId --IncludeOutput true ``` The recovery procedure uses the same unsafe construction: ```bash aliyun ecs RunCommand --RegionId --Type RunShellScript --InstanceId.1 \ --ContentEncoding Base64 \ --CommandContent "$(printf '%s' 'systemctl restart && sleep 3 && systemctl is-active ' | base64)" aliyun ecs DescribeInvocations --RegionId --InvokeId --IncludeOutput true ``` ### Technical Analysis The Skill does not require strict syntactic validation of `service_name`, `app_port`, `region`, or ECS iden ...[truncated 1926 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/ram_policies.md:31
Finding

Account-Wide Wildcard Permissions for High-Impact Cloud Operations

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/cli_installation_guide.md:5
Finding

Unpinned and Unverified Privileged Aliyun CLI Installation

Content
View full analysis
Remediation
View remediation

other

Warning
Location
references/diagnose.md:31
Finding

Sensitive Application Logs Transmitted Through Cloud Assistant Before Redaction

Content
View full analysis
--Type RunShellScript --InstanceId.1 \ --ContentEncoding Base64 \ --CommandContent "$(printf '%s' 'systemctl is-active ; systemctl is-active nginx; ss -ltnp | grep -E ":80|:"; nginx -t 2>&1 | tail -n 3; df -h /; uptime; top -bn1 | head -n 12; free -m; journalctl -u --since "30 min ago" --no-pager | tail -n 80' | base64)" aliyun ecs DescribeInvocations --RegionId --InvokeId --IncludeOutput true ``` The output rule only applies redaction when evidence is reported: ```text Report: **fault layer · likely cause · evidence · recommended action · impact**. Redact secrets in all evidence. Do not execute any recovery yet. ``` ### Technical Analysis The diagnostic payload collects up to 80 recent application-journal lines and returns them using Cloud Assistant invocation output. Application logs commonly contain session tokens, authorization headers, database connection strings, personal data, request payloads, internal addresses, stack traces, or accidentally logged credentials. The instruction to redact secrets applies after the raw output has already been generated on the ECS host, transferred through Alibaba Cloud's Cloud Assistant control plane, stored as invocation output, and delivered to the Agent. It therefore does not prevent sensitive data from crossing the network or entering cloud-side invocation records and the Agent context. Collecting broad raw logs by default is not the minimum data access necessary for all availability diagnoses. ### Attack Path 1. An application writes a credential, token, connection string, personal record, or sensitive request value to its systemd jour ...[truncated 961 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/cli_installation_guide.md (reported line 12)May include surrounding context.

brew install aliyun-cli && brew upgrade aliyun-cli

Linux

wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz tar -xzf aliyun-cli-linux-latest-amd64.tgz && sudo mv aliyun /usr/local/bin/

aliyun version # verify 3.x

text

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The RAM policy grants materially broader write capabilities than the skill description promises, including security group modification, disk resizing, EIP rebinding, instance reboot, and DNS record management. If the skill, prompt, or surrounding agent logic is abused, these permissions enable infrastructure reconfiguration, service disruption, network exposure, and DNS/certificate manipulation well beyond the stated one-at-a-time recovery actions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/recover_disk.md (reported line 34)May include surrounding context.

bash
aliyun ecs RunCommand --RegionId <region> --Type RunShellScript --InstanceId.1 <ecs-id> \
  --ContentEncoding Base64 \
  --CommandContent "$(printf '%s' 'journalctl --vacuum-size=200M; truncate -s 0 /var/log/nginx/*.log 2>/dev/null; rm -rf /tmp/qwencloud-* /root/.cache/pip /usr/local/share/.cache/yarn 2>/dev/null; df -h /' | base64)"

Idempotent. Never rm under the app directory or any data path. Then verify and record the audit

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/recover_disk.md (reported line 34)May include surrounding context.

bash
aliyun ecs RunCommand --RegionId <region> --Type RunShellScript --InstanceId.1 <ecs-id> \
  --ContentEncoding Base64 \
  --CommandContent "$(printf '%s' 'journalctl --vacuum-size=200M; truncate -s 0 /var/log/nginx/*.log 2>/dev/null; rm -rf /tmp/qwencloud-* /root/.cache/pip /usr/local/share/.cache/yarn 2>/dev/null; df -h /' | base64)"

Idempotent. Never rm under the app directory or any data path. Then verify and record the audit

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/recover_disk.md (reported line 34)May include surrounding context.

bash
aliyun ecs RunCommand --RegionId <region> --Type RunShellScript --InstanceId.1 <ecs-id> \
  --ContentEncoding Base64 \
  --CommandContent "$(printf '%s' 'journalctl --vacuum-size=200M; truncate -s 0 /var/log/nginx/*.log 2>/dev/null; rm -rf /tmp/qwencloud-* /root/.cache/pip /usr/local/share/.cache/yarn 2>/dev/null; df -h /' | base64)"

Idempotent. Never rm under the app directory or any data path. Then verify and record the audit

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/recover_disk.md (reported line 34)May include surrounding context.

bash
aliyun ecs RunCommand --RegionId <region> --Type RunShellScript --InstanceId.1 <ecs-id> \
  --ContentEncoding Base64 \
  --CommandContent "$(printf '%s' 'journalctl --vacuum-size=200M; truncate -s 0 /var/log/nginx/*.log 2>/dev/null; rm -rf /tmp/qwencloud-* /root/.cache/pip /usr/local/share/.cache/yarn 2>/dev/null; df -h /' | base64)"

Idempotent. Never rm under the app directory or any data path. Then verify and record the audit

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest summary narrows the stated recovery scope to a small set of actions, but the body later authorizes additional state-changing operations such as rebooting ECS, changing security-group ingress, rebinding EIPs, resizing disks, and certificate/DNS updates. That mismatch can mislead users or higher-level orchestration into granting trust or invoking the skill under incomplete assumptions, increasing the chance of unintended infrastructure changes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
# Qwen Cloud Operate

Fault diagnosis and confirmed recovery for an application deployed by `qwencloud-deploy` on
Alibaba Cloud International. Diagnosis is read-only and needs no confirmation; any action that
changes cloud or app state requires explicit confirmation.

## Interaction Flow

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
# Qwen Cloud Operate

Fault diagnosis and confirmed recovery for an application deployed by `qwencloud-deploy` on
Alibaba Cloud International. Diagnosis is read-only and needs no confirmation; any action that
changes cloud or app state requires explicit confirmation.

## Interaction Flow

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli_installation_guide.md (reported line 12)May include surrounding context.

brew install aliyun-cli && brew upgrade aliyun-cli

Linux

wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz tar -xzf aliyun-cli-linux-latest-amd64.tgz && sudo mv aliyun /usr/local/bin/

aliyun version # verify 3.x

text

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/diagnose.md (reported line 3)May include surrounding context.

md
# Minimal Diagnosis

Read-only. No confirmation required. Stop at the first clearly actionable fault layer, but gather
enough evidence to recommend one action.
Judge in short-circuit order; merge the read-only checks on one ECS into a single Cloud Assistant
script fetched in one round trip to cut round trips.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file states that write permissions are limited to confirmed recovery actions, but the actual permission set includes additional recovery behaviors not disclosed in the manifest. This mismatch is dangerous because operators and reviewers may trust the narrower description while the runtime identity can perform broader changes, undermining informed consent and review accuracy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The policy documentation enumerates several destructive or configuration-changing operations without embedding explicit impact warnings for each class of action. In this skill context, those writes affect live cloud infrastructure, so weak warning language increases the chance that a user or downstream agent authorizes disruptive changes without understanding risks such as downtime, exposure, or DNS breakage.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This recovery reference expands the skill from the manifest's declared recovery scope (start ECS, restart app service, reload Nginx) into certificate issuance, DNS challenge orchestration, and mutation of the local deployment state file. That mismatch is dangerous because an operator or agent may perform privileged infrastructure and state-changing actions the user did not reasonably expect from this skill, increasing the chance of unauthorized changes, broken renewals, or incorrect resource targeting.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file instructs the agent to reuse an HTTPS deployment flow involving certbot, DNS-01 auth hooks, TXT record creation, Nginx reconfiguration, and cleanup, which goes beyond minimal diagnosis and the narrow recovery operations described in the skill metadata. Introducing certificate issuance and DNS challenge management in an operational recovery skill increases the attack surface and can enable unintended domain-control actions or service disruption if executed against the wrong domain, zone, or host.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This recovery document authorizes a network perimeter change by adding public ingress rules to the security group, but the skill metadata says recovery actions should be limited to actions like starting ECS, restarting the app service, or reloading Nginx after confirmation. Expanding inbound exposure to 0.0.0.0/0 on 80/443 is a materially different capability that can alter the security posture of the deployment and exceeds the declared operational scope, increasing the chance of unintended exposure or abuse.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

This section frames behavior around code review and editing even though the skill is described as an infrastructure/runtime operator. While not proof of hidden code-editing behavior, this documentation emphasis is inconsistent with the stated narrow operational intent and suggests a conflicting conception of the skill's role.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The references section points users to Chinese-language CLI documentation and related account-management resources (/zh/cli/) without indicating that alternative language options are available. This creates a locale preference in the skill documentation that may conflict with a language-choice policy when not explicitly justified or made optional.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.