Alibaba Cloud Model Setup

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:02 AM UTC
• Version: 0.1.4

Overview

The skill is a real OpenClaw Alibaba Cloud setup helper, but documented safe modes do not match the script and can still expose credentials or change configuration unexpectedly.

Review before installing. Use it only if you are comfortable with a local script editing your OpenClaw config and changing default models. Avoid passing API keys with --api-key, avoid inline storage, and do not rely on --list-models or env-var mode until those implementation mismatches are fixed. Use a scoped/rotatable Alibaba Cloud key and check config and backup file permissions afterward.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/alibaba_cloud_model_setup.py:394

Finding

Inline API keys are stored without enforcing restrictive file permissions

Content

View full analysis

None: """Save config to JSON file with pretty formatting.""" config_path.parent.mkdir(parents=True, exist_ok=True) with open(config_path, "w", encoding="utf-8") as f: json.dump(config, f, indent=2, ensure_ascii=False) f.write("\n") ``` ```python if api_key_source == "inline": provider_config["apiKey"] = api_key # else: apiKey will be read from env var ``` ### Technical Analysis When inline storage is selected, the script inserts the plaintext Alibaba Cloud API key into the OpenClaw JSON configuration. The file is opened using the process's default permission behavior, and the script neither creates it with an explicit owner-only mode nor corrects permissions on an existing file. The resulting permissions depend on the current umask. On systems with permissive defaults, a newly created configuration may be readable by other local users. An existing configuration with weak permissions also remains weak. Timestamped backups can preserve the same sensitive content and inherited permissions. The network transmission of the API key to a fixed Alibaba Cloud HTTPS endpoint is consistent with the declared validation functionality. The vulnerability is the subsequent plaintext storage without enforced filesystem protection. ### Attack Path 1. A user runs the configurator and selects `inline` API-key storage. 2. The script adds the API key to `models.providers.bailian.apiKey`. 3. The script creates or rewrites the configuration without enforcing mode `0600`. 4. The file or a generated backup remains readable under local filesystem permissions. 5. Another local account or comprom ...[truncated 631 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/alibaba_cloud_model_setup.py:106

Finding

API keys can be exposed through command-line arguments

Content

View full analysis

`. 2. The complete command is stored in shell history, CI output, orchestration metadata, or process accounting, or is temporarily exposed in the process list. 3. Another local user or a party with access to those logs retrieves the argument. 4. The attacker reuses the API key against the corresponding Alibaba Cloud endpoint. ### Impact Assessment An attacker can obtain all cloud privileges associated with the exposed API key. Likely consequences include unauthorized model requests, quota or billing consumption, and access to any other API operations permitted to the credential. The issue does not independently elevate local operating-system privileges. Exploitation requires visibility into process arguments, history, or execution logs. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/alibaba_cloud_model_setup.py:146

Finding

Documented list-only mode unexpectedly validates credentials and writes configuration

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/alibaba_cloud_model_setup.py:445

Finding

Environment-key mode falsely reports secure credential storage without configuring it

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description says the skill configures Alibaba/Qwen through a strict interactive flow focused on flagship series, but the documented behavior also includes network API-key validation, backup creation, config mutation, and third-party model support. This mismatch can mislead users and policy systems about the true operational scope, increasing the chance of unreviewed outbound requests or unintended configuration changes.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs execution of a local Python script that can read and write configuration files, invoke shell commands, and make outbound network requests, but the skill metadata declares no tool scope or permissions. This creates a transparency and governance gap: an agent or reviewer cannot accurately constrain or assess what capabilities the skill needs before use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill persists changes by backing up and rewriting user configuration, including an example that stores an API key inline in the config file. Persistent modification of authentication material and defaults can expose secrets at rest, alter future agent behavior, and create durable impact beyond the current session.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

- API key storage mode (env-var recommended or inline)
   - Primary model selection
   - Whether to set as default model
4. **Validate API key** against selected site before config write
5. **Backup existing config** before modification
6. **Update config** with provider, models, and defaults
7. **Validate JSON** and report final status

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly recommends exporting the API key and adding it to shell startup files for persistence, which stores a long-lived secret in plaintext in commonly read config files. This increases exposure through local compromise, backups, dotfile sync, accidental sharing, or process/environment leakage, even though the goal is ordinary setup guidance rather than credential theft.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The argument help text says --persist-env-shell writes an export line to a shell profile and --persist-env-systemd writes a systemd user override and restarts a service. No code in main() or elsewhere uses these flags or performs shell-profile edits, systemd override writes, or service restarts, so the documented behavior contradicts the implementation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/alibaba_cloud_model_setup.py (reported line 122)May include surrounding context.

python

parser.add_argument(
        "--persist-env-shell",
        action="store_true",
        help="Write export line to shell profile (default ~/.bashrc) when using env key mode.",
    )
    parser.add_argument(
        "--shell-profile",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

When api_key_source is set to inline, the script writes the API key directly into the JSON configuration file. In a setup skill like this, config files are often backed up, shared, or stored with permissive filesystem access, so embedding long-lived credentials materially increases the risk of credential disclosure and downstream account abuse.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/alibaba_cloud_model_setup.py (reported line 566)May include surrounding context.

python

if api_key_source == "env":
        print(f"\n🔐 API key stored in environment variable: {env_var}")
        print(f"   Add to ~/.bashrc: export {env_var}=YOUR_KEY")
    
    print(f"\n🚀 Next steps:")
    print(f"  1. Restart Gateway: openclaw gateway restart")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Section headings and labels such as 按量付费 and 订阅制 introduce Chinese-language content into an otherwise English document, but the file does not indicate that the content is region-specific or give users a language/locale option. This can violate a language/locale policy when a skill or reference forces a specific language without explicit user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a strict interactive flow for adding or repairing Alibaba Cloud configuration, implying guided prompting. However, the script accepts enough command-line arguments to perform configuration updates without that flow, including config path, API key, plan type, site, model, and default-setting options.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.