Alibabacloud Ack Cli

• Outcome: Review
• Latest audit: Jun 5, 2026 · 6:55 AM UTC
• Version: 0.0.1

Overview

This looks like a legitimate Alibaba Cloud Kubernetes operations skill, but it documents broad admin access and credential-handling workflows without enough safety guardrails.

Install only if you intentionally want an agent to assist with Alibaba Cloud ACK administration. Review and restrict the RAM policy before use, prefer short-lived or role-based credentials, avoid curl-to-shell installers unless verified, protect any kubeconfig files as secrets, and require explicit confirmation before destructive cluster or addon operations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill includes destructive ACK operations such as cluster deletion, addon uninstall, and task cancellation without consistently requiring an explicit confirmation step at the example point of use. In an agent context, this increases the chance of accidental destructive execution against production infrastructure when a user asks for a related action ambiguously.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The kubeconfig retrieval section writes access material directly to a local file and exports it for `kubectl` use, but it does not explicitly warn that kubeconfig contains credentials or cluster access tokens. That can lead users or agents to persist sensitive access material in insecure locations, expose it via logs/backups, or overwrite existing configuration unsafely.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide explicitly recommends exporting long-lived Alibaba Cloud access keys into shell environment variables, which increases the chance of credential leakage through shell history, CI logs, process inspection, inherited environments, or accidental persistence in startup files. In the context of cloud administration tooling for ACK, exposed keys can enable unauthorized cluster and cloud resource access, making this more dangerous than a generic developer example.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The installation instructions use a curl-to-bash one-liner that downloads and executes a remote script directly with potential system-level effects, without any integrity verification or warning. If the hosting endpoint, transport, or script content is compromised, users could execute arbitrary code on their workstation or admin host, which is especially sensitive in an ACK/Alibaba Cloud operations context.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The examples retrieve kubeconfig content and redirect it into files under ~/.kube without explicitly warning that the file contains bearer-style cluster access credentials. In operational docs this can lead users to persist sensitive access material on disk with default permissions, backups, shell history, or shared workstations, increasing the chance of credential disclosure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The worked example shows how to bind a public EIP to the Kubernetes API server but does not warn that this increases the attack surface by exposing the control plane to the Internet. Users may enable public exposure for convenience without also tightening source restrictions, authentication, monitoring, and certificate handling.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This creation workflow ends by writing the returned kubeconfig directly to ~/.kube/ack-$CID.yaml, again without warning that it stores live cluster credentials on disk. Because the example is end-to-end and copy-pasteable, users are especially likely to follow it verbatim and leave sensitive access tokens in persistent storage.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document recommends attaching an extremely broad ACK RAM policy with destructive, administrative, and credential-related actions on all resources using `Resource: "*"`, but it does not warn users about the blast radius or advise least-privilege scoping. In the context of an operational skill that can create, modify, delete clusters and issue kubeconfig-related permissions, this can enable full cluster takeover, destructive changes, and misuse of generated access if the principal is compromised or the skill is misused.

Credential Access

High

• Category: Privilege Escalation

Content

--private-ip-address false \
  | jq -r '.config' > ~/.kube/ack-<cid>.yaml

# Private-endpoint kubeconfig (works inside the cluster's VPC)
aliyun cs describe-cluster-user-kubeconfig \
  --cluster-id <cid> \
  --region <region> \

• Confidence: 91% confidence
• Finding: kubeconfig

Credential Access

High

• Category: Privilege Escalation

Content

./scripts/wait-for-task.sh "$TID" cn-beijing

# 3. Fetch kubeconfig (cluster lives in cn-beijing per the create-cluster call)
aliyun cs describe-cluster-user-kubeconfig --cluster-id "$CID" --region cn-beijing \
  | jq -r '.config' > ~/.kube/ack-$CID.yaml
export KUBECONFIG=~/.kube/ack-$CID.yaml
kubectl get nodes

• Confidence: 92% confidence
• Finding: kubeconfig

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.