Alibaba Cloud ACK

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:31 AM UTC
• Version: 1.0.0

Overview

The skill is ACK-related and mostly transparent, but it presents temporary kubeconfig generation as a safe read action and includes unverified remote installer commands.

Review before installing. Only use this skill if you expect it to generate temporary ACK kubeconfigs, understand the permissions those kubeconfigs grant, and are comfortable installing the oo CLI through a verified installation path instead of piping remote scripts directly to a shell.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:55
• Finding: Unverified Remote Shell Script Execution## Vulnerability Details **File Location**: `SKILL.md`, line 55 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command downloads a shell script from an external server and pipes the response directly into Bash. The downloaded content is neither pinned to an immutable release nor verified using a cryptographic signature or checksum before execution. Consequently, the effective code executed by this Skill can change after the Skill itself has been reviewed. HTTPS protects data in transit under normal conditions, but it does not protect against compromise of the hosting server, publication account, DNS or certificate infrastructure, or the upstream installer. The `-f`, `-s`, and `-S` options also minimize output and may make it harder for a user to inspect what is being executed. This installation behavior exceeds the minimum privileges needed for the declared Alibaba Cloud ACK connector functionality. Installing the CLI may be necessary when it is absent, but immediately granting a mutable network response shell execution is not necessary. A pinned and integrity-verified installation process can provide the same functionality with substantially less risk. ### Attack Path 1. The `oo` CLI is absent, causing an action to fail with `oo: command not found`. 2. The agent or user follows the first-time setup instructions in `SKILL.md`. 3. An attacker compromises the remote installer, its hosting infrastructure, publication process, DNS resolution, or another component in the delivery chain. 4. `curl` retrieves the attacker-controlled response from the installer URL. 5. The pipe passes that response directly to Bash without local inspection or integrity verification. 6. The malicious script executes with all permissions available to the user runnin ...[truncated 728 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation pattern. - Pin the CLI to a specific, reviewed release and download the artifact without immediately executing it. - Publish and verify a cryptographic signature using a trusted, separately distributed signing key. At minimum, verify a release-specific SHA-256 checksum obtained through an independent trusted channel. - Abort installation if signature or checksum verification fails. - Display the artifact source, pinned version, expected digest, and intended installation location before proceeding. - Require explicit user approval before executing an installer or making system changes. - Run installation with ordinary user privileges whenever possible and avoid unconditional use of `sudo`. - Prefer a trusted package manager with package-signature verification and version pinning. - Keep the existing guidance that installation occurs only after a genuine command-not-found failure, but do not treat that condition as authorization to execute unverified remote code.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unverified Remote PowerShell Script Execution## Vulnerability Details **File Location**: `SKILL.md`, line 59 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis This command uses `Invoke-RestMethod` (`irm`) to retrieve PowerShell source code from an external URL and sends the response directly to `Invoke-Expression` (`iex`). `Invoke-Expression` evaluates the downloaded text as PowerShell code without first pinning its version, saving it for inspection, or verifying a cryptographic signature or checksum. The executed payload is therefore controlled by mutable remote content rather than the reviewed contents of the Skill package. Compromise of the upstream script, hosting account, delivery infrastructure, or trusted network chain could turn the documented installation step into arbitrary code execution. Installation of the CLI may support the declared functionality, but direct evaluation of an unverified network response is broader than necessary. A signed, versioned package can install the same CLI without allowing arbitrary mutable content to execute immediately. ### Attack Path 1. A Windows user or agent attempts to use the Skill without the `oo` CLI installed. 2. The initial connector command fails because `oo` is not found. 3. The first-time setup guidance causes the PowerShell installation command to be run. 4. An attacker has modified the installer response or compromised an element of its publication or delivery chain. 5. `Invoke-RestMethod` downloads the attacker-controlled PowerShell content. 6. The pipeline passes the content directly to `Invoke-Expression`. 7. PowerShell executes the payload with the permissions and accessible credentials of the current process. ### Impact Assessment Exploitation permits arbitrary PowerShell execution as the invoking user. An attacker could a ...[truncated 643 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` pattern and never pass an unverified network response to `Invoke-Expression`. - Distribute a version-pinned installer or package whose Authenticode signature can be validated before execution. - Download the installer to a controlled location, verify the expected publisher and signature status, and reject unsigned, invalid, or unexpected artifacts. - If an archive is distributed, verify a release-specific cryptographic digest obtained from an independent trusted source before extraction. - Require explicit user confirmation after showing the exact version, publisher, source URL, digest, and changes the installer will make. - Execute with standard-user privileges unless a narrowly defined installation operation genuinely requires elevation. - Prefer a trusted Windows package manager with publisher validation, signature enforcement, and version pinning. - Document a manual inspection path and provide rollback or uninstall instructions.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Credential Access

High

• Category: Privilege Escalation

Content

## Available actions

- `get_temporary_kubeconfig` — Generate a short-lived kubeconfig for an Alibaba Cloud Container Service for Kubernetes (ACK) cluster.

## Safety

• Confidence: 97% confidence
• Finding: Generating a temporary kubeconfig is a credential-access operation because kubeconfig can provide authenticated access to the target Kubernetes cluster. Even if short-lived, exposure or misuse of the generated config could enable cluster reconnaissance, data access, workload manipulation, or privilege escalation depending on bound permissions.

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 93% confidence
• Finding: The documentation instructs users to install software via `curl ... | bash`, which executes a remotely fetched script without prior verification. If the distribution endpoint or network path is compromised, this can lead to arbitrary code execution on the user's machine.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill metadata and description frame the capability as limited to 'searching and reading data', but the documented action issues a temporary kubeconfig, which is an access credential to a Kubernetes cluster rather than mere data retrieval. This mismatch can cause downstream agents or users to invoke the skill under a lower-risk assumption and unintentionally grant cluster access material.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger language says to use this skill for 'ANY Alibaba Cloud ACK request,' which is overly broad and can cause the agent to route all ACK-related tasks through a skill that can mint access credentials. In context, this broad routing increases the chance of unnecessary or accidental execution of sensitive actions.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The safety section claims untagged actions are reads, yet the only listed untagged action generates a kubeconfig credential. Treating credential issuance as a harmless read is dangerous because it can normalize sensitive access operations and bypass the extra confirmation that write/destructive actions receive.

Static analysis

No suspicious patterns detected.