Alibabacloud Aes Ack Pod Performance Profiling

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:21 AM UTC
• Version: 0.0.1

Overview

This skill is for Alibaba Cloud ACK Pod diagnosis, but it can automatically make cloud network and service-role changes while also giving overbroad permission and credential-handling guidance.

Review before installing. Use only a dedicated least-privilege Alibaba Cloud identity, do not paste secrets into commands or chat, run any VPC endpoint creation only after an explicit change review, and verify how to remove the endpoint afterward. Treat the provided RAM policy and installation guide as needing tightening before production use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:247

Finding

Cloud network configuration is modified automatically without user confirmation

Content

View full analysis

**[AUTO-EXECUTE] This step creates a VPC internal endpoint connection for the cluster as a prerequisite for diagnosis. Although it modifies network configuration (write operation), it is executed automatically WITHOUT user confirmation, since it is a mandatory precondition and the diagnosis workflow cannot proceed without it.** `SKILL.md:412`: > The diagnosis operations in this skill are **read-only** and do not modify cluster state — no cleanup is needed. The corresponding command from `SKILL.md:241-243` is: ```bash .sysom-sdk-venv/bin/python scripts/create-cluster-vpc-endpoint-connection.py \ --region "" \ --cluster-id "" ``` The acceptance criteria directly contradict this behavior at `references/acceptance-criteria.md:204-213`: > Before running `scripts/create-cluster-vpc-endpoint-connection.py` with `--dry-run "false"`, the agent MUST display a write-operation banner showing `cluster_id`, `region`, and impact, then wait for explicit user confirmation (Y/N). Proceed only on Y. ### Technical Analysis Creating a cluster VPC endpoint connection is a cloud control-plane write operation. It changes connectivity associated with the target ACK cluster and is not equivalent to a read-only profiling request. The main workflow explicitly instructs the Agent to perform this operation automatically and forbids skipping it. It subsequently claims that the workflow is read-only and requires no cleanup. This misleading characterization prevents users from making an informed decision about a persistent network change. The behavior also conflicts with the repository's own acceptance criteria, which require an explicit confirmation gate. De ...[truncated 1624 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/ram-policies.md:29

Finding

Documented RAM policy grants unnecessary account-wide privileges

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:100

Finding

Installation guide encourages passing cloud secrets through command-line arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` The guide then states: ```text All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` It also provides concrete AK and STS examples: ```bash aliyun configure set \ --mode StsToken \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --sts-token v1.0:XXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` ### Technical Analysis Command-line arguments are commonly observable through: - Shell history files. - Process inspection utilities. - CI/CD command logs. - Terminal recording and audit systems. - Agent transcripts or automation telemetry. - Error reports that include the invoked command. Recommending non-interactive flags for long-lived access keys and STS tokens therefore creates a direct secret-exposure risk. The guidance also contradicts `SKILL.md:18-21`, which states that credentials must never be entered in the conversation or command line and prohibits `aliyun configure set` with literal credentials. Although the example values are placeholders rather than real secrets, users are instructed to replace them with actual credentials. The vulnerability is in the prescribed handling method. ### Attack Path 1. A user follows the installation guide to configure Aliyun CLI. 2. The user substitutes real AccessKey and token values into the command. 3. The command is recorded in shell history, CI output, terminal telemetry, or an Agent log. 4. Anot ...[truncated 781 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup-sdk.sh:12

Finding

SDK bootstrap installs mutable dependency versions in a credential-bearing environment

Content

View full analysis

=1.0.2" ``` ```bash echo "Installing pinned dependencies: ${SDK_PACKAGE}, ${TEA_OPENAPI_PACKAGE}, ${CREDENTIALS_PACKAGE}" if ! "${VENV_PATH}/bin/pip" install --quiet --upgrade pip; then echo "ERROR: Failed to upgrade pip in ${VENV_PATH}." >&2 echo " Check network connectivity to PyPI (https://pypi.org)." >&2 echo " If behind a proxy, export HTTPS_PROXY before re-running." >&2 exit 1 fi if ! "${VENV_PATH}/bin/pip" install --quiet "$SDK_PACKAGE" "$TEA_OPENAPI_PACKAGE" "$CREDENTIALS_PACKAGE"; then echo "ERROR: Failed to install ${SDK_PACKAGE}, ${TEA_OPENAPI_PACKAGE}, and/or ${CREDENTIALS_PACKAGE}." >&2 echo " Check network connectivity to PyPI (https://pypi.org)." >&2 echo " Retry with verbose output: ${VENV_PATH}/bin/pip install ${SDK_PACKAGE} ${TEA_OPENAPI_PACKAGE} ${CREDENTIALS_PACKAGE}" >&2 exit 1 fi ``` ### Technical Analysis Despite the “pinned dependencies” comment, `alibabacloud_credentials>=1.0.2` is not pinned. It permits any future compatible version selected by the package resolver. The script also automatically upgrades pip to the latest available release. No lock file, package hash, signature, controlled index, or transitive dependency constraints are used. Consequently, running the same audited Skill at different times can install different executable code. Python package installation may execute build-backend or installation logic. The resulting packages are then imported by a script that accesses the Alibaba Cloud default credential chain, including environment credentials, local credential files, CLI configuration, a ...[truncated 1367 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/cli-installation-guide.md:20

Finding

Mutable CLI binaries are installed into privileged paths without integrity verification

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The workflow includes bootstrap/setup behavior such as enabling AI mode, updating plugins, preparing an SDK environment, and running a local script that changes cluster connectivity. Those actions materially exceed the advertised end-user capability of Pod profiling and increase the attack surface through dependency changes and hidden side effects.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The workflow includes bootstrap/setup behavior such as enabling AI mode, updating plugins, preparing an SDK environment, and running a local script that changes cluster connectivity. Those actions materially exceed the advertised end-user capability of Pod profiling and increase the attack surface through dependency changes and hidden side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill auto-executes creation of a cluster VPC endpoint connection, which is a write operation affecting cluster/network configuration. Automatically performing this without a dedicated consent checkpoint is dangerous because it can change production connectivity and violate change-management expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The Cleanup section claims the workflow is read-only, but earlier steps explicitly modify local CLI configuration, initialize service roles, and create a cluster VPC endpoint connection. Misrepresenting write operations as read-only can mislead operators into approving actions that alter account and network state without appropriate review.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description frames the capability as performance profiling, but the actual workflow includes account/service initialization and cluster network configuration changes. This mismatch reduces informed consent and can cause users to run a more privileged workflow than intended.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill says all user-customizable parameters must be confirmed before commands are executed, yet Step 7 authorizes an automatic write operation without user confirmation. This internal inconsistency can bypass operator intent and undermine trust and governance controls.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The AUTO-EXECUTE instruction authorizes the agent to make an infrastructure change autonomously by creating a VPC endpoint connection. Autonomous execution of mutating cloud operations increases the risk of unintended changes, especially in production, and weakens human-in-the-loop safeguards.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

md

**Expected output on success**: `[OK] Cluster VPC endpoint connection created successfully.`

> **[AUTO-EXECUTE] This step creates a VPC internal endpoint connection for the cluster as a prerequisite for diagnosis. Although it modifies network configuration (write operation), it is executed automatically WITHOUT user confirmation, since it is a mandatory precondition and the diagnosis workflow cannot proceed without it.**
>
> - Cluster ID: `<cluster_id>`
> - Region: `<region>`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs automatic network-configuration changes without prior warning in the high-level description or an explicit consent gate. Hidden write actions are risky in operational environments because users may trigger changes under the assumption they are running a diagnostic-only procedure.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 176)May include surrounding context.

md

- When the user's request contains any temporal reference ("this morning", "yesterday afternoon", "around 3pm", "last night"), proactively ask for the specific time range and recommend historical diagnosis mode (`enable_diagnosis=false`, `start_time`/`end_time` set).

#### INCORRECT
- Assuming `region=cn-hangzhou` without asking or extracting from the cluster lookup response.
- Using the raw cluster `name` as `instance` (may contain Chinese / spaces, violating regex `^[a-zA-Z0-9_-]*$`).
- Silently defaulting to real-time diagnosis when the user clearly described a past event.
- Skipping the parameter-confirmation gate before invoking diagnosis.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide explicitly demonstrates configuring long-lived access keys and shows that they are stored in ~/.aliyun/config.json, but it does not clearly warn that this writes reusable secrets to disk. On shared hosts, developer workstations, CI runners, or compromised accounts, those persisted credentials can be recovered and abused for unauthorized cloud access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Recommending non-interactive credential configuration for scripts and CI/CD without warning about command-line secret exposure is risky because access keys passed as flags may be captured in shell history, process listings, audit logs, CI job output, or orchestration metadata. This is especially relevant in automation-heavy environments, where secrets often traverse multiple systems and logging layers.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow requires executing a network-modifying operation (CreateClusterVpcEndpointConnection) as part of a diagnostic skill, which exceeds read-only profiling and changes cluster connectivity state. Because this write action is automatic and framed as mandatory, an agent could make infrastructure changes without the user's informed approval, creating risk of unintended exposure, policy violations, or environmental drift.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The [AUTO-EXECUTE] instruction authorizes the agent to make an autonomous write decision on behalf of the user for a network configuration change. In a cloud administration context, autonomous execution of state-changing actions is dangerous because it reduces human oversight and can normalize unsafe behavior even when the action is framed as operationally necessary.

Content

Scanner excerpt · references/diagnose-workflow.md (reported line 157)May include surrounding context.

md

>
> **⛔ MUST EXECUTE — this is NOT optional.** Without this call, the subsequent `invoke-diagnosis` cannot reach the cluster. The script is **idempotent** — safe to re-run.
>
> **[AUTO-EXECUTE]** Although this is a write operation that modifies network configuration, it runs automatically WITHOUT user confirmation, since it is a mandatory precondition for diagnosis.

> **⛔ HOW TO EXECUTE: You must run the following command in the terminal (shell).** This is a LOCAL Python script in this workspace — you must execute it as a shell command. Reading API documentation, web-fetching API metadata, or finding the API name in a list is NOT execution. The API call only happens when you run this script.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document explicitly states that a write operation modifying network configuration runs automatically without user confirmation. This bypasses a key safety control for sensitive infrastructure changes and increases the chance that an agent performs impactful actions the user did not intend or would not have authorized if properly informed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The 'Minimum Permission Policy Example' contradicts the preceding permission list by adding undeclared actions and even inconsistent namespace/action names such as sysom:CreateClusterVpcEndpointConnection and sysom:AuthDiagnosis. This mismatch undermines least-privilege review, increases the chance of excessive grants, and may conceal capability creep in a security-sensitive document users rely on for authorization setup.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented 'minimum' policy grants permissions beyond what the skill description and earlier API table justify, including sts:AssumeRole, cms:QueryMetricList, and extra CS actions such as DescribeClusterNodes and DescribeClusterEvents. In an agent skill context, overbroad IAM guidance is dangerous because users may apply it as-is, giving the skill lateral visibility or privilege expansion paths unrelated to Pod performance profiling.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/create-cluster-vpc-endpoint-connection.py (reported line 3)May include surrounding context.

python

#!/usr/bin/env python3
"""
Create Cluster VPC Endpoint Connection (SysOM)

Purpose:
    Use the SysOM SDK to create a Cluster VPC Endpoint Connection for the

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script resolves cloud credentials and uses them to invoke a privileged API that creates a VPC endpoint connection for the cluster. While this may enable SysOM diagnostics, granting the skill the ability to provision cluster access infrastructure is an administrative capability that is not explicitly declared in the manifest's profiling-focused purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes a skill for performing SysOM profiling and diagnosing pod-level performance issues, but this script creates a Cluster VPC Endpoint Connection against the target ACK cluster. Creating cluster networking/access configuration is a state-changing infrastructure operation, not profiling or diagnosis itself, so the actual behavior exceeds the described profiling scope.

Content

No source excerpt is available for this finding.