Aliyun Ecs Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:02 AM UTC
• Version: 1.0.0

Overview

This skill is a plausible Alibaba Cloud ECS management tool, but it handles powerful cloud credentials and network-changing actions in ways users should review carefully before installing.

Install only if you are comfortable giving this skill Alibaba Cloud ECS authority. Use a least-privilege RAM user rather than broad ecs:* permissions, avoid pasting long-lived secrets into chat or shell commands, rotate any key already entered that way, verify ~/.aliyun/config.json permissions, and manually confirm all stop/reboot, snapshot rollback, and security-group changes, especially any rule that exposes a port to 0.0.0.0/0.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:183

Finding

Alibaba Cloud credentials are collected through exposed command-line arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/index.js:367

Finding

Security-group rules default to unrestricted public IPv4 ingress

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:88

Finding

Credential configuration is written non-atomically without securing the directory or destination first

Content

View full analysis

"$CONFIG_FILE" << EOF { "accessKeyId": "$access_key_id", "accessKeySecret": "$access_key_secret", "defaultRegion": "cn-hangzhou", "endpoint": "ecs.aliyuncs.com" } EOF chmod 600 "$CONFIG_FILE" ``` ### Technical Analysis The script writes plaintext cloud credentials before applying mode `600`. The initial file permissions therefore depend on the caller's current `umask`. Under a permissive `umask`, another local user may be able to read the file during the interval between creation and `chmod`. The configuration directory is created without an explicit `700` mode. The code also does not verify whether `CONFIG_FILE` is a regular file or a symbolic link. Normal shell redirection follows symbolic links, so an attacker capable of preparing that path could redirect the credential write or cause another writable target to be overwritten. Finally, writing directly to the destination is non-atomic. An interrupted write can leave a partially written configuration file containing sensitive material. ### Attack Path 1. The setup process runs in a multi-user or otherwise untrusted local environment. 2. A local attacker monitors the configuration path or, where filesystem permissions permit, prepares `~/.aliyun/config.json` as a symbolic link. 3. The setup script executes `cat > "$CONFIG_FILE"` and writes the AccessKey values before enforcing restrictive permissions. 4. The attacker reads the temporarily permissive file, follows access through an insufficiently protected directory, or receives the data through a redirected symbolic-link target. 5. The attacker reuses the recovered credentials against Alibaba Cloud APIs. For the ...[truncated 737 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The documented scope does not clearly disclose local credential file access under ~/.aliyun/config.json, and the claimed remote execution capability is not substantiated in the supplied content. Hidden or underexplained credential-file access is risky because it may expose or reuse sensitive secrets beyond what the user expects from an ECS operations skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented scope does not clearly disclose local credential file access under ~/.aliyun/config.json, and the claimed remote execution capability is not substantiated in the supplied content. Hidden or underexplained credential-file access is risky because it may expose or reuse sensitive secrets beyond what the user expects from an ECS operations skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented scope does not clearly disclose local credential file access under ~/.aliyun/config.json, and the claimed remote execution capability is not substantiated in the supplied content. Hidden or underexplained credential-file access is risky because it may expose or reuse sensitive secrets beyond what the user expects from an ECS operations skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Resetting a disk to a snapshot is inherently destructive and may overwrite current data or render a workload unusable if applied incorrectly. Performing this action without an explicit warning and strong confirmation is dangerous in an autonomous or assistant-driven workflow.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · src/api/ecs.js (reported line 271)May include surrounding context.

js

if (!rules) return [];
    
    return rules.map(rule => ({
        ipProtocol: rule.ipProtocol,
        portRange: rule.portRange,
        sourceCidrIp: rule.sourceCidrIp,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README prominently advertises security-sensitive and potentially destructive capabilities such as starting/stopping/restarting instances, managing snapshots, and modifying security group rules, but it does not warn users about service disruption, accidental exposure, or rollback risks. In a cloud infrastructure skill, these operations directly affect production availability and network security, so omission of cautions increases the likelihood of harmful misuse or operator error.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The installation instructions tell users to pass the Alibaba Cloud Access Key ID and Access Key Secret directly on the command line without any warning about shell history, process listing exposure, or secure storage. Because these are cloud credentials for infrastructure management, disclosure could let an attacker control instances, snapshots, and security groups across the account scope granted to the key.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes shell scripts and depends on environment/local filesystem state, but it declares no explicit tool scope or permissions boundary. In an agent setting, this increases the chance of unintended shell execution and local data access without clear user/admin review, especially because the skill can install packages and write config files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs users to paste long-lived AccessKey ID and AccessKey Secret directly into the chat-driven workflow, then passes them on the command line to a setup script and stores them in ~/.aliyun/config.json. This is dangerous because secrets may be exposed in conversation logs, shell history, process listings, or local plaintext storage, enabling full compromise of the associated Alibaba Cloud account or ECS resources.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 103)May include surrounding context.

sh

}
EOF
    
    chmod 600 "$CONFIG_FILE"
    echo -e "${GREEN}✓ 配置文件创建完成 ($CONFIG_FILE)${NC}"
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script accepts the Alibaba Cloud AccessKey Secret via the --access-key-secret command-line argument, which exposes the secret to shell history, process listings, audit logs, and potentially other local users while the process runs. In the context of a cloud-management skill, this is especially sensitive because compromise of these credentials can enable broad control over ECS resources.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes querying instances, monitoring, firewall, snapshots, and remote execution, but does not mention powering instances on/off or rebooting them. These functions introduce state-changing operational control over ECS instances that goes beyond the listed behavior in the skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Start, stop, and reboot operations are state-changing and can disrupt workloads, but this file executes them directly with no user-facing warning, confirmation, or safety interlock. In an agent context, missing confirmation increases the chance of accidental downtime from misunderstood or ambiguous prompts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code can reset a disk to a snapshot, which is a destructive rollback operation with significant availability and integrity impact. Because this capability is not surfaced in the stated skill description, users may invoke the skill without understanding it can perform irreversible restoration actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Authorizing security group rules changes network exposure and can unintentionally open services to the internet, especially given the permissive default sourceCidrIp of 0.0.0.0/0. Without warning or confirmation, an agent could expose sensitive ports or widen access based on a vague request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The help text and user-facing messages are presented only in Chinese, and the code later also formats timestamps with a fixed 'zh-CN' locale. This enforces a specific language/locale without any opt-in or alternative, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The skill description is entirely presented in Chinese and says the user can manage ECS with natural language, but it does not indicate whether other languages are supported or allow user opt-in to a preferred language. This can be a locale/language policy concern when a skill appears to force a specific language without explicit justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency uses a caret version range, which allows installation of newer upstream releases that were not explicitly reviewed by the skill author. If the dependency publisher account is compromised, a malicious release is published, or a breaking/security-regressing update lands, consumers of this skill could pull unsafe code during install or deployment.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json

"author": "Leo & AI Agent",
  "license": "MIT",
  "dependencies": {
    "@alicloud/openapi-client": "^0.4.10",
    "@alicloud/ecs20140526": "^7.0.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency uses a caret version range, which permits unreviewed future versions of the Alibaba Cloud ECS SDK to be resolved. In a cloud-management skill, third-party SDK code often runs with access to cloud credentials and management operations, so a compromised or vulnerable update could materially affect infrastructure.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "@alicloud/openapi-client": "^0.4.10",
    "@alicloud/ecs20140526": "^7.0.0"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

User-facing messages, help text, and usage instructions are all hard-coded in Chinese throughout the script. This imposes a specific language on all users without any documented choice, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code uses toLocaleString('zh-CN') for monitor output, which forces Chinese locale formatting regardless of user preference. Because no language or locale choice is offered, this is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.