qwencloud-operate

• Outcome: Review
• Latest audit: Sep 15, 2026 · 9:50 AM UTC
• Version: 1.0.3

Overview

This skill is meant for cloud app recovery, but it asks for broad Alibaba Cloud authority and uses remote shell commands in ways that need careful review before installation.

Review before installing. Use a dedicated, short-lived, least-privilege Alibaba Cloud role scoped to the intended region/resources, avoid the wildcard RAM policy as written, pin and verify the Aliyun CLI, inspect .qwencloud-deploy before use, and require explicit approval before any log retrieval or cloud mutation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: references/diagnose.md:31
• Finding: Command Injection Through Unvalidated Deployment State Values<![CDATA[ ## Vulnerability Details **File Location**: `references/workflow.md:8-19`, `references/diagnose.md:31-39`, `references/recover_app.md:1-24` **Vulnerability Type**: Shell command injection through state-derived values **Risk Level**: Critical ### Vulnerable Code The workflow reads `service_name`, `app_port`, and resource identifiers from the project-controlled deployment state: ```text 2. Parse and extract: `region_id`, `stack_id`, `topology`, `app_type`, `nginx_mode`, `app_port`, `outputs.public_ip`, `outputs.ecs_instance_ids[]`, `outputs.security_group_id`, `outputs.eip_allocation_id`, and RDS fields (`outputs.db_instance_id` / `db_connection_address` / `db_port` / `db_account`, `db_engine`). Also `service_name` (service name, used for service/log checks; falls back to `qwencloud-app` when missing). ``` Those values are interpolated directly into a privileged diagnostic shell script: ```bash aliyun ecs RunCommand --RegionId <region> --Type RunShellScript --InstanceId.1 <ecs-id> \ --ContentEncoding Base64 \ --CommandContent "$(printf '%s' 'systemctl is-active <service_name>; systemctl is-active nginx; ss -ltnp | grep -E ":80|:<app_port>"; nginx -t 2>&1 | tail -n 3; df -h /; uptime; top -bn1 | head -n 12; free -m; journalctl -u <service_name> --since "30 min ago" --no-pager | tail -n 80' | base64)" aliyun ecs DescribeInvocations --RegionId <region> --InvokeId <invoke-id> --IncludeOutput true ``` The recovery procedure uses the same unsafe construction: ```bash aliyun ecs RunCommand --RegionId <region> --Type RunShellScript --InstanceId.1 <ecs-id> \ --ContentEncoding Base64 \ --CommandContent "$(printf '%s' 'systemctl restart <service_name> && sleep 3 && systemctl is-active <service_name>' | base64)" aliyun ecs DescribeInvocations --RegionId <region> --InvokeId <invoke-id> --IncludeOutput true ``` ### Technical Analysis The Skill does not require strict syntactic validation of `service_name`, `app_port`, `region`, or ECS iden ...[truncated 1926 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every value read from `.qwencloud-deploy` as untrusted input. 2. Validate `service_name` against a strict systemd-unit allowlist, such as a conservative character set with an expected `.service` suffix or a fixed set of deployment-generated names. 3. Require `app_port` to parse as an integer and remain within `1` through `65535`. 4. Validate regions, instance IDs, security-group IDs, disk IDs, and EIP IDs against documented Alibaba Cloud formats. 5. Reject values containing whitespace, shell metacharacters, control characters, command substitutions, or unexpected path separators. 6. Avoid interpolating data into a shell program. Pass validated values as positional parameters to a fixed script and quote every use, or deploy a fixed audited diagnostic script whose inputs are passed through a non-shell mechanism. 7. Separate diagnostic permission from recovery permission. A nominally read-only diagnosis should not possess general-purpose `ecs:RunCommand` capability where avoidable. 8. Verify that the selected instance belongs to the stack identified by the deployment state before executing any command. 9. Add negative tests using values containing semicolons, newlines, backticks, `$()`, redirections, quotes, and option-like prefixes. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/ram_policies.md:31
• Finding: Account-Wide Wildcard Permissions for High-Impact Cloud Operations<![CDATA[ ## Vulnerability Details **File Location**: `references/ram_policies.md:31-62` **Vulnerability Type**: Excessive cloud permissions and insufficient resource scoping **Risk Level**: High ### Vulnerable Code ```json { "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "ecs:DescribeInstances", "ecs:DescribeInvocations", "ecs:DescribeSecurityGroupAttribute", "ecs:DescribeDisks", "vpc:DescribeEipAddresses", "rds:DescribeDBInstances", "rds:DescribeDBInstancePerformance", "rds:DescribeSlowLogRecords", "ecs:StartInstance", "ecs:RebootInstance", "ecs:AuthorizeSecurityGroup", "ecs:ResizeDisk", "vpc:AssociateEipAddress", "ecs:RunCommand", "alidns:AddDomain", "alidns:DescribeDomainRecords", "alidns:AddDomainRecord", "alidns:UpdateDomainRecord", "alidns:DeleteDomainRecord" ], "Resource": "*" } ] } ``` ### Technical Analysis The policy combines diagnostic reads with high-impact write operations and grants all of them against `"Resource": "*"`. The affected capabilities include arbitrary Cloud Assistant command execution, instance reboot, disk resizing, public firewall modification, EIP reassociation, and DNS-record modification. The Skill's declared functionality targets one application identified by a local `.qwencloud-deploy` file. Account-wide authorization therefore exceeds the minimum privilege needed for that declared scope. Confirmation prompts are interaction controls, not IAM security boundaries, and do not protect against state-file manipulation, command injection, implementation mistakes, or credential compromise. ### Attack Path 1. A user attaches the documented policy to the credentials used by the Skill. 2. An attacker modifies deployment state, exploits command construction, or obtains those credentials. 3. The attacker supplies identifiers for ...[truncated 671 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Split permissions into separate diagnostic and recovery roles. Use the diagnostic role by default and assume the recovery role only after confirmation. 2. Scope resource-capable API actions to the exact deployment resources and supported region whenever Alibaba Cloud RAM supports resource-level authorization. 3. Restrict DNS permissions to the intended hosted zone and, where supported, to `_acme-challenge` records. 4. Add RAM conditions for region, resource tags, stack identifiers, and request context. 5. Require all managed resources to carry a deployment-specific tag, and verify that tag before each write. 6. Use short-lived STS credentials rather than long-lived access keys. 7. Isolate `ecs:RunCommand` into a narrowly controlled role. Apply Cloud Assistant command controls or approval policies where available. 8. Do not grant resize, DNS, firewall, EIP, reboot, and shell-execution privileges permanently when they are only needed for occasional recovery paths. 9. Document product actions that cannot be resource-scoped and place them in separately assumed, time-limited roles with monitoring and alerts. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/cli_installation_guide.md:5
• Finding: Unpinned and Unverified Privileged Aliyun CLI Installation<![CDATA[ ## Vulnerability Details **File Location**: `references/cli_installation_guide.md:5-14` **Vulnerability Type**: Unsafe dependency retrieval and installation **Risk Level**: Medium ### Vulnerable Code ```bash # macOS brew install aliyun-cli && brew upgrade aliyun-cli # Linux wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz tar -xzf aliyun-cli-linux-latest-amd64.tgz && sudo mv aliyun /usr/local/bin/ aliyun version # verify 3.x ``` ### Technical Analysis The Linux instructions retrieve a mutable `latest` archive and install its executable into `/usr/local/bin` with elevated privileges. No exact version, cryptographic checksum, or publisher signature is verified. HTTPS protects transport under ordinary conditions but does not provide artifact-level integrity against a compromised CDN, origin, DNS path, certificate authority, or upstream release process. Checking only that the program reports a 3.x version does not establish authenticity. The installed CLI subsequently operates with configured Alibaba Cloud credentials and the broad cloud privileges required by the Skill, increasing the consequence of a supply-chain compromise. ### Attack Path 1. The user follows the Linux installation instructions. 2. The mutable download endpoint, CDN, release pipeline, or network trust chain serves a modified archive. 3. The archive is extracted without integrity validation. 4. The modified executable is installed into `/usr/local/bin`. 5. Later Skill operations invoke the malicious CLI. 6. The executable can access local CLI configuration, manipulate API requests or responses, and misuse cloud permissions. ### Impact Assessment A compromised CLI could steal configured credentials, falsify diagnostic results, alter recovery requests, execute local code, or perform unauthorized cloud operations. Installation into a system-wide executable directory also allows the affected binary to impact users and processes outside the immediate Skill invo ...[truncated 13 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin an exact Aliyun CLI release rather than downloading `latest`. 2. Obtain the archive from an explicitly documented official release channel. 3. Publish or reference an expected SHA-256 or stronger digest and verify it before extraction. 4. Prefer verification using a vendor-provided cryptographic signature with a pinned trusted public key. 5. Abort installation if the checksum, signature, archive layout, or expected binary name differs. 6. Extract into a newly created non-shared directory and inspect the archive file list before moving any executable. 7. Avoid privileged installation where possible; install into a user-controlled executable directory with appropriately restricted permissions. 8. Record the approved version and integrity value in the Skill so installations are reproducible and auditable. ]]>

other

Warning

• Location: references/diagnose.md:31
• Finding: Sensitive Application Logs Transmitted Through Cloud Assistant Before Redaction<![CDATA[ ## Vulnerability Details **File Location**: `references/diagnose.md:31-39`, `references/diagnose.md:88` **Vulnerability Type**: Excessive collection and network transmission of potentially sensitive logs **Risk Level**: Medium ### Vulnerable Code ```bash aliyun ecs RunCommand --RegionId <region> --Type RunShellScript --InstanceId.1 <ecs-id> \ --ContentEncoding Base64 \ --CommandContent "$(printf '%s' 'systemctl is-active <service_name>; systemctl is-active nginx; ss -ltnp | grep -E ":80|:<app_port>"; nginx -t 2>&1 | tail -n 3; df -h /; uptime; top -bn1 | head -n 12; free -m; journalctl -u <service_name> --since "30 min ago" --no-pager | tail -n 80' | base64)" aliyun ecs DescribeInvocations --RegionId <region> --InvokeId <invoke-id> --IncludeOutput true ``` The output rule only applies redaction when evidence is reported: ```text Report: **fault layer · likely cause · evidence · recommended action · impact**. Redact secrets in all evidence. Do not execute any recovery yet. ``` ### Technical Analysis The diagnostic payload collects up to 80 recent application-journal lines and returns them using Cloud Assistant invocation output. Application logs commonly contain session tokens, authorization headers, database connection strings, personal data, request payloads, internal addresses, stack traces, or accidentally logged credentials. The instruction to redact secrets applies after the raw output has already been generated on the ECS host, transferred through Alibaba Cloud's Cloud Assistant control plane, stored as invocation output, and delivered to the Agent. It therefore does not prevent sensitive data from crossing the network or entering cloud-side invocation records and the Agent context. Collecting broad raw logs by default is not the minimum data access necessary for all availability diagnoses. ### Attack Path 1. An application writes a credential, token, connection string, personal record, or sensitive request value to its systemd jour ...[truncated 961 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not retrieve raw application logs during the default diagnostic pass. 2. Begin with service state, exit status, port state, resource metrics, and narrowly defined error counters. 3. If logs are necessary, require explicit user approval that explains the potential sensitivity and cloud-side retention. 4. Filter on the ECS host for a small allowlist of diagnostic patterns and return only the minimum matching fields. 5. Apply masking on the ECS host before output leaves the instance. Cover authorization headers, cookies, tokens, passwords, access keys, connection strings, email addresses, and other project-relevant sensitive formats. 6. Reduce the time window and maximum number of returned lines. 7. Avoid returning complete request payloads, environment dumps, command lines, or URLs containing query credentials. 8. Document and minimize Cloud Assistant invocation-output retention, and delete invocation artifacts where the platform supports it. 9. Treat retrieved output as sensitive and prohibit copying raw output into chat, timeline, or audit records. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Chaining Abuse

High

• Category: Tool Misuse

Content

brew install aliyun-cli && brew upgrade aliyun-cli
# Linux
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz
tar -xzf aliyun-cli-linux-latest-amd64.tgz && sudo mv aliyun /usr/local/bin/

aliyun version   # verify 3.x
```

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The RAM policy grants materially broader write capabilities than the skill description promises, including security group modification, disk resizing, EIP rebinding, instance reboot, and DNS record management. If the skill, prompt, or surrounding agent logic is abused, these permissions enable infrastructure reconfiguration, service disruption, network exposure, and DNS/certificate manipulation well beyond the stated one-at-a-time recovery actions.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
aliyun ecs RunCommand --RegionId <region> --Type RunShellScript --InstanceId.1 <ecs-id> \
  --ContentEncoding Base64 \
  --CommandContent "$(printf '%s' 'journalctl --vacuum-size=200M; truncate -s 0 /var/log/nginx/*.log 2>/dev/null; rm -rf /tmp/qwencloud-* /root/.cache/pip /usr/local/share/.cache/yarn 2>/dev/null; df -h /' | base64)"
```

Idempotent. Never `rm` under the app directory or any data path. Then verify and record the audit

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
aliyun ecs RunCommand --RegionId <region> --Type RunShellScript --InstanceId.1 <ecs-id> \
  --ContentEncoding Base64 \
  --CommandContent "$(printf '%s' 'journalctl --vacuum-size=200M; truncate -s 0 /var/log/nginx/*.log 2>/dev/null; rm -rf /tmp/qwencloud-* /root/.cache/pip /usr/local/share/.cache/yarn 2>/dev/null; df -h /' | base64)"
```

Idempotent. Never `rm` under the app directory or any data path. Then verify and record the audit

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
aliyun ecs RunCommand --RegionId <region> --Type RunShellScript --InstanceId.1 <ecs-id> \
  --ContentEncoding Base64 \
  --CommandContent "$(printf '%s' 'journalctl --vacuum-size=200M; truncate -s 0 /var/log/nginx/*.log 2>/dev/null; rm -rf /tmp/qwencloud-* /root/.cache/pip /usr/local/share/.cache/yarn 2>/dev/null; df -h /' | base64)"
```

Idempotent. Never `rm` under the app directory or any data path. Then verify and record the audit

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
aliyun ecs RunCommand --RegionId <region> --Type RunShellScript --InstanceId.1 <ecs-id> \
  --ContentEncoding Base64 \
  --CommandContent "$(printf '%s' 'journalctl --vacuum-size=200M; truncate -s 0 /var/log/nginx/*.log 2>/dev/null; rm -rf /tmp/qwencloud-* /root/.cache/pip /usr/local/share/.cache/yarn 2>/dev/null; df -h /' | base64)"
```

Idempotent. Never `rm` under the app directory or any data path. Then verify and record the audit

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest summary narrows the stated recovery scope to a small set of actions, but the body later authorizes additional state-changing operations such as rebooting ECS, changing security-group ingress, rebinding EIPs, resizing disks, and certificate/DNS updates. That mismatch can mislead users or higher-level orchestration into granting trust or invoking the skill under incomplete assumptions, increasing the chance of unintended infrastructure changes.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Qwen Cloud Operate

Fault diagnosis and confirmed recovery for an application deployed by `qwencloud-deploy` on
Alibaba Cloud International. Diagnosis is read-only and needs no confirmation; any action that
changes cloud or app state requires explicit confirmation.

## Interaction Flow

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Qwen Cloud Operate

Fault diagnosis and confirmed recovery for an application deployed by `qwencloud-deploy` on
Alibaba Cloud International. Diagnosis is read-only and needs no confirmation; any action that
changes cloud or app state requires explicit confirmation.

## Interaction Flow

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install aliyun-cli && brew upgrade aliyun-cli
# Linux
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz
tar -xzf aliyun-cli-linux-latest-amd64.tgz && sudo mv aliyun /usr/local/bin/

aliyun version   # verify 3.x
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Minimal Diagnosis

Read-only. No confirmation required. Stop at the first clearly actionable fault layer, but gather
enough evidence to recommend one action.
Judge in short-circuit order; merge the read-only checks on one ECS into a single Cloud Assistant
script fetched in one round trip to cut round trips.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The file states that write permissions are limited to confirmed recovery actions, but the actual permission set includes additional recovery behaviors not disclosed in the manifest. This mismatch is dangerous because operators and reviewers may trust the narrower description while the runtime identity can perform broader changes, undermining informed consent and review accuracy.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The policy documentation enumerates several destructive or configuration-changing operations without embedding explicit impact warnings for each class of action. In this skill context, those writes affect live cloud infrastructure, so weak warning language increases the chance that a user or downstream agent authorizes disruptive changes without understanding risks such as downtime, exposure, or DNS breakage.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This recovery reference expands the skill from the manifest's declared recovery scope (start ECS, restart app service, reload Nginx) into certificate issuance, DNS challenge orchestration, and mutation of the local deployment state file. That mismatch is dangerous because an operator or agent may perform privileged infrastructure and state-changing actions the user did not reasonably expect from this skill, increasing the chance of unauthorized changes, broken renewals, or incorrect resource targeting.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The file instructs the agent to reuse an HTTPS deployment flow involving certbot, DNS-01 auth hooks, TXT record creation, Nginx reconfiguration, and cleanup, which goes beyond minimal diagnosis and the narrow recovery operations described in the skill metadata. Introducing certificate issuance and DNS challenge management in an operational recovery skill increases the attack surface and can enable unintended domain-control actions or service disruption if executed against the wrong domain, zone, or host.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: This recovery document authorizes a network perimeter change by adding public ingress rules to the security group, but the skill metadata says recovery actions should be limited to actions like starting ECS, restarting the app service, or reloading Nginx after confirmation. Expanding inbound exposure to 0.0.0.0/0 on 80/443 is a materially different capability that can alter the security posture of the deployment and exceeds the declared operational scope, increasing the chance of unintended exposure or abuse.

Intent-Code Divergence

Low

• Confidence: 75% confidence
• Finding: This section frames behavior around code review and editing even though the skill is described as an infrastructure/runtime operator. While not proof of hidden code-editing behavior, this documentation emphasis is inconsistent with the stated narrow operational intent and suggests a conflicting conception of the skill's role.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The references section points users to Chinese-language CLI documentation and related account-management resources (`/zh/cli/`) without indicating that alternative language options are available. This creates a locale preference in the skill documentation that may conflict with a language-choice policy when not explicitly justified or made optional.

Static analysis

No suspicious patterns detected.