Alibaba Cloud Model Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:09 AM UTC
• Version: 1.0.0

Overview

This setup skill is purpose-aligned, but it needs review because it handles Alibaba Cloud API keys with weak secret-storage and exposure safeguards.

Review this before installing if you will use a real paid Alibaba Cloud key. Prefer an environment variable or secret manager, avoid passing the key with --api-key, avoid inline storage unless you accept plaintext local-file risk, check config and backup permissions, and rotate any key that was written to a shared config, backup, shell history, or logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/alibaba_cloud_model_setup.py:107

Finding

API Key Exposure Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/alibaba_cloud_model_setup.py:410

Finding

Plaintext Inline API Key Written Without Enforced Restrictive Permissions

Content

View full analysis

None: """Save config to JSON file with pretty formatting.""" config_path.parent.mkdir(parents=True, exist_ok=True) with open(config_path, "w", encoding="utf-8") as f: json.dump(config, f, indent=2, ensure_ascii=False) f.write("\n") ``` Credential-bearing backups are also created from the existing configuration: ```python timestamp = dt.datetime.now().strftime("%Y%m%d-%H%M%S") backup_path = config_path.parent / f"{config_path.name}.{timestamp}.bak" shutil.copy2(config_path, backup_path) ``` ### Technical Analysis When inline mode is selected, the Alibaba Cloud API key is stored in plaintext in the OpenClaw JSON configuration. The save operation relies on the caller's current umask and any existing file permissions rather than requiring a secure mode. For a newly created file, a permissive umask may result in group-readable or world-readable configuration. For an existing file, `open(..., "w")` preserves the file's existing permission mode, including unsafe permissions. The parent directory is likewise created without an explicit restrictive mode. Backups can contain current or historical pla ...[truncated 1542 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The documented behavior understates what the skill can do: it is not strictly interactive, it can run via CLI flags, and it performs remote API-key validation over the network. This mismatch can mislead operators and automated policy systems about the skill's actual execution model and trust boundary, which is dangerous for a credential-handling setup flow.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises operational behavior that includes shell execution, file reads/writes, and network access, but it declares no explicit tool scope or permissions boundary. That makes the skill harder to audit and increases the chance an agent will invoke powerful capabilities without clear user visibility or policy enforcement.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill intentionally writes persistent configuration and backups, including provider settings and potentially credentials, to disk. Persistence is expected for a setup skill, but it still enlarges the attack surface because secrets or sensitive configuration may remain in config files and backup copies after the session ends.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

- API key storage mode (env-var recommended or inline)
   - Primary model selection
   - Whether to set as default model
4. **Validate API key** against selected site before config write
5. **Backup existing config** before modification
6. **Update config** with provider, models, and defaults
7. **Validate JSON** and report final status

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example configuration includes an inline apiKey field in plaintext and does not prominently warn against storing secrets directly in config files. Users often copy examples verbatim, so this pattern can lead to long-lived credential exposure through local files, backups, logs, screenshots, or source control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document recommends exporting a long-lived API key and adding it to shell startup files for persistence, but it does not warn that this exposes the credential to local account compromise, shell-history mishandling, accidental disclosure during debugging, or inheritance into child processes and tooling. In a setup skill that guides users through provider configuration, this normalizes weak secret-handling practices and can lead to credential theft or misuse of paid cloud resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Although labeled 'Not Recommended,' the inline JSON example still shows plaintext API key storage in a primary configuration file without a strong warning about source-control leaks, backups, shared home directories, or accidental disclosure through support bundles and screenshots. Because this skill is specifically for configuring OpenClaw, users are likely to copy the example directly, making credential compromise a realistic outcome.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script exposes options implying it may persist API credentials into shell profiles or systemd user overrides, expanding from local config editing into persistence of secrets in broader execution contexts. That increases the chance of accidental credential exposure, long-lived secret retention, and unintended use by other processes or future sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The script defines a feature to write an API key export directly into a shell profile, creating durable credential persistence outside the tool's immediate config scope. Persisting secrets in startup files can expose them to other local users, shell history mishandling, backups, and unrelated processes that inherit the environment.

Content

Scanner excerpt · scripts/alibaba_cloud_model_setup.py (reported line 122)May include surrounding context.

python

parser.add_argument(
        "--persist-env-shell",
        action="store_true",
        help="Write export line to shell profile (default ~/.bashrc) when using env key mode.",
    )
    parser.add_argument(
        "--shell-profile",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

When api_key_source is set to inline, the script writes the API key directly into the JSON configuration file in plaintext. Plaintext credentials in config files are commonly exposed through backups, source control, filesystem access by other local users, or diagnostic collection, making credential compromise much more likely.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/alibaba_cloud_model_setup.py (reported line 566)May include surrounding context.

python

if api_key_source == "env":
        print(f"\n🔐 API key stored in environment variable: {env_var}")
        print(f"   Add to ~/.bashrc: export {env_var}=YOUR_KEY")
    
    print(f"\n🚀 Next steps:")
    print(f"  1. Restart Gateway: openclaw gateway restart")

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest says configuration happens 'through a strict interactive flow,' implying guided prompting is the intended behavior. However, the argument parser accepts plan, site, API key, model, default-setting, and other options directly, allowing the skill to bypass the interactive flow entirely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.