Security audit

alibabacloud-core

Security checks for vulnerabilities and agentic risk

Overview

This Alibaba Cloud plugin appears legitimate, but it deserves review because it installs hooks, records telemetry/traces, and can drive broad cloud and Terraform actions under the user's credentials.

Install only if you are comfortable granting this plugin persistent hooks, default telemetry/tracing, and broad Alibaba Cloud API reach through your existing credentials. Before using it in production, disable or review telemetry settings, configure an MCP safety policy, avoid '-y' global skill installs unless you have reviewed the target skill, and manually confirm any Terraform import, RunIaC, RunScript, or billable/mutating cloud command.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: # Alibaba Cloud Resource Terraform Import Wizard Step-by-step guide to import existing resources under an Alibaba Cloud account into local Terraform management. Automatically performs environment checks, resource discovery, HCL generation, state import, etc. Users only need to confirm at key decision points. Two modes are supported:
Confidence: 81% confidence
Finding: The skill repeatedly authorizes autonomous execution of local commands, cloud discovery, file generation, Terraform imports, and even optional package installation with only limited confirmation points. In a high-impact cloud/IaC context, this can lead to unintended host changes, writes to the working directory, imports against the wrong account or region, and large-scale state manipulation before the user has reviewed each sensitive action.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: # Recommended: use non-interactive mode to avoid blocking. # --agent <client> Agent client to install for (see references/npx-skills-agents.md) # -g Install globally (home dir); omit for project-local install # -y Skip confirmation (requires --agent and -g/-local to be set) npx skills add aliyun/alibabacloud-aiops-skills \ --skill <skill-name> \ --full-depth \
Confidence: 93% confidence
Finding: The installation example recommends non-interactive mode with `-y`, explicitly skipping confirmation for skill installation. This reduces human oversight for an action that can modify the environment, install globally, and pull in transitive content (`--full-depth`) from packages or dependent skills. In the context of an agent skill marketplace, suppressing confirmation makes accidental or over-broad installs materially more likely.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill directs the agent to perform network access and local file reads/validation activities, but these capabilities are not transparently declared as permissions. This creates a trust and review gap: operators may approve or install the skill expecting only code generation, while the workflow also instructs external metadata retrieval and local checker usage.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill metadata declares only Alibaba Cloud MCP tools, but the workflow later relies on reading a local validator script path and interacting with the local filesystem. This hidden capability increases the effective privilege surface and can mislead reviewers or orchestrators that rely on declared permissions for isolation decisions.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs the agent to use environment access, read and write arbitrary files in a target directory, and execute shell commands, yet no declared permissions are present to make those capabilities explicit or constrain them. This creates a trust and containment problem: callers may invoke what appears to be a code-generation skill without realizing it can modify the filesystem and run commands, increasing the chance of unintended side effects or abuse if the skill is triggered in a sensitive workspace.

Unvalidated Output Injection

High

Category: Output Handling
Content: ### 5. Single-Call Execution Use `AlibabaCloud___CallCLI` to execute the generated command. Key constraints: - Commands must start with `aliyun` - No shell pipes, redirections, or operators
Confidence: 88% confidence
Finding: The skill instructs the agent to execute a generated CLI command after discovery and generation steps, but it does not require strict validation that the generated command exactly matches user intent, approved API/action, and safe parameter constraints before execution. In a skill whose core purpose is driving cloud administrative actions, this creates a realistic output-injection risk: unsafe, over-privileged, or user-manipulated command content could be propagated into remote execution, potentially causing unauthorized state changes or costly operations.

External Script Fetching

High

Category: Supply Chain
Content: | **B — Environment or one-shot** | One-off commands, scripts without `configure`, or no AI-mode | `export ALIBABA_CLOUD_USER_AGENT=AlibabaCloud-Agent-Skills/alibabacloud-cli-guidance` for the session, **or** prefix each API call: `ALIBABA_CLOUD_USER_AGENT=AlibabaCloud-Agent-Skills/alibabacloud-cli-guidance aliyun ...` | If you used **`export`**, run `unset ALIBABA_CLOUD_USER_AGENT` when done so other skills are not mis-attributed. Inline prefix needs no unset. **Do not** enable AI-mode on path B for the same skill string. | **Pre-check: Aliyun CLI >= 3.3.3 required** — Run `aliyun version`. If too low: `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` or see `references/installation-guide.md`. **Pre-check: Aliyun CLI plugin update required** — [MUST] `aliyun configure set --auto-plugin-install true`; [MUST] `aliyun plugin update`.
Confidence: 97% confidence
Finding: The skill recommends piping a remotely fetched script directly into bash, which creates a classic supply-chain and remote code execution risk. If the hosting endpoint, network path, or delivered script is compromised, the user will execute attacker-controlled code immediately, often with the user's privileges.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: Although the skill says it only suggests commands, its documented workflow writes attacker-influenced command strings to /tmp and runs a local Python validator against them. That creates real side effects and a local execution path, undermining the 'suggest-only' safety model and potentially exposing the host to parser or toolchain abuse.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs fallback to external HTTP fetching plus local shell and python command execution for metadata extraction. For a code-generation skill, this unnecessarily expands the attack surface and can lead the agent to access remote content and run local commands based on adversarial or malformed inputs.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to create a local file and invoke python3 on a local script without a strong functional need visible to the user. This expands the attack surface from cloud-command suggestion into host interaction, which can be abused if generated content or environment assumptions trigger unsafe behavior in the validator path.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill states that it is read-only and creates no resources, but later instructs the agent to install additional skills using `npx` commands. Installation changes the local or global environment, may fetch and execute package-managed content, and can introduce code from downstream skills, so the read-only claim is materially misleading. This increases the chance an agent or user will approve actions under a false assumption of safety.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill contains conflicting guidance: it says to use only the local alibabacloud-core MCP server, yet earlier instructions authorize HTTP fetching and local shell commands. Such contradictions undermine safety boundaries and make it more likely the agent will choose the broader, riskier execution path.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The file explicitly tells users not to include shell metacharacters in CallCLI input, but later includes examples such as `2>&1` for ACK and FC commands. This inconsistency can cause unsafe copying of command strings into the MCP tool or local shell contexts, undermining the stated safety boundary and increasing the risk of command misuse or injection-adjacent behavior.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger list contains very broad phrases such as '阿里云' and '帮我找一个 skill', which can match ordinary conversation and cause the skill to activate in contexts where the user did not actually request catalog search or installation guidance. Unintended invocation is risky here because the skill can steer the agent toward network lookups and optional package installation workflows. The danger is amplified by the skill's broad Alibaba Cloud scope and install guidance.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The workflow instructs writing generated content to /tmp/aliyun-runscript.py and repeatedly validating it without clearly surfacing that a local file will be created or overwritten. While /tmp is lower risk than arbitrary paths, silent file creation still violates least surprise and can affect local state unexpectedly.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The skill instructs users to place long-lived cloud credentials in environment variables without an explicit warning about shell history, process inheritance, CI log leakage, or preferring short-lived credentials. In a cloud administration context, this can lead to credential exposure and unauthorized access if users copy these patterns into shared or poorly isolated environments.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: These RAM and KMS discovery commands enumerate identity objects, attached policies, and key metadata, all of which are sensitive security-relevant information. In a skill designed for Terraform import and resource discovery, exposing such commands without an explicit warning or least-privilege guidance makes accidental over-collection and disclosure more likely.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: RDS, Redis, and MongoDB inspection commands can reveal database names, account names, connection addresses, IP whitelists, and other configuration details that materially aid reconnaissance. In the context of an import/migration skill, this is more dangerous because broad discovery is expected, so the absence of explicit sensitivity warnings increases the chance that confidential infrastructure details will be collected or surfaced unnecessarily.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The workflow silently writes generated commands to a local file despite presenting itself as a command-suggestion skill. Lack of disclosure matters because user prompts may contain sensitive identifiers, and persisting them locally creates unnecessary data-retention and privacy risk on the host.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation explicitly includes `--insecure` as a way to force HTTP, which can disable transport security and expose credentials, tokens, and API payloads to interception or tampering. In a CLI guidance skill, this is more dangerous because users may copy commands directly into production workflows, and the warning is too brief to adequately discourage unsafe use.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document includes an installation command that performs a global package/skill install with `-g -y`, which suppresses confirmation and can modify the user's environment immediately. In a verification guide, this is risky because readers may execute it during testing without a clear warning about system changes, trust implications, or the need to review the package/skill before installation.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The examples send user-derived search phrases directly to an external Alibaba Cloud endpoint without any privacy notice, minimization guidance, or warning against including secrets, internal project names, or sensitive business context. In a skill-discovery workflow, users may paste operational needs or internal standards queries that can leak confidential information to a third-party service.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The security group templates include an ingress rule allowing TCP/80 from 0.0.0.0/0 and an egress rule allowing all traffic to 0.0.0.0/0, but the surrounding guidance does not warn that these are internet-exposed defaults that may be unsafe for many environments. In an import/migration skill, users may copy these patterns directly into production Terraform, normalizing overly permissive network access and increasing exposure of workloads to the public internet.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guidance recommends using `--log-level debug` and states it reveals the full request/response cycle, including serialized parameters and response bodies, but it does not warn that these logs may contain credentials, tokens, request signatures, or sensitive cloud resource data. In a CLI guidance skill, users may copy this advice directly into real production environments, increasing the likelihood of accidental secret exposure in terminals, shell history, CI logs, or shared troubleshooting output.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The guide recommends executing a remote install script directly via curl piped to bash, which runs downloaded code without prior inspection or integrity verification. In an agent skill context, this is more dangerous because users or automations may copy-paste or execute the command verbatim, so a compromised CDN, MITM in weaker environments, or malicious upstream change could lead to arbitrary code execution.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: skills/alibabacloud-terraform-import/examples/rds-example.tf:35
Evidence: account_password = [REDACTED]

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: skills/alibabacloud-terraform-import/references/terraform-patterns.md:155
Evidence: password = [REDACTED] # Or use key_name; never hardcode passwords