Alibabacloud Aes Sysom Pai Diagnosis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 0.0.1

Overview

This skill is for Alibaba Cloud PAI/SysOM diagnosis, but it asks users to make persistent CLI and cloud-authorization changes that are broader and less clearly controlled than a read-only diagnosis tool should require.

Review before installing. Use a narrowly scoped RAM policy instead of full-access managed policies, avoid global auto-plugin-install where possible, verify any Aliyun CLI download through trusted package/signature mechanisms, and run commands only after validating region/resource IDs and understanding that the workflow may change local CLI configuration and Alibaba Cloud authorization state.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:27

Finding

Unpinned Executable Downloads and Automatic Plugin Updates

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/diagnose-workflow.md:219

Finding

Shell and JSON Injection Exposure in User-Controlled CLI Parameters

Content

View full analysis

","region":"","product":"","start_time":,"end_time":,"type":"ocd","ai_roadmap":true,"enable_sysom_link":false}' \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-aes-sysom-pai-diagnosis ``` Additional unquoted user-controlled substitutions appear at `references/diagnose-workflow.md:102-106`: ```bash aliyun eas list-services \ --region \ --filter \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-aes-sysom-pai-diagnosis ``` And at `references/diagnose-workflow.md:131-135`: ```bash aliyun pai-dlc get-job \ --region \ --job-id \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-aes-sysom-pai-diagnosis ``` ### Technical Analysis The workflow instructs an Agent to substitute user-provided region and resource identifiers directly into shell command templates. The `--region`, `--filter`, and `--job-id` examples are unquoted. The diagnosis request additionally embeds user-controlled values inside a single-quoted JSON argument without requiring JSON serialization or escaping. Parameter confirmation establishes user intent but is not input validation. If these templates are executed through a shell, whitespace or shell metacharacters can alter argument boundaries or introduce additional shell syntax. A single quote in a value embedded in `--params` can terminate the quoted JSON string, after which the shell can parse attacker-controlled text. The optional problem description and account identifier also require strict type and encoding enforcement before being incorporated into the JSON payload. ### Attack ...[truncated 1386 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/ram-policies.md:55

Finding

Managed-Policy Guidance Exceeds the Skill's Documented Minimum Permissions

Content

View full analysis

**Recommended minimal combination for this skill**: `AliyunSysOMFullAccess` + `AliyunEASReadOnlyAccess`. ``` The workflow also performs a state-changing authorization operation at `SKILL.md:136-140`: ```bash aliyun sysom initial-sysom --check-only false --source aes-skills --user-agent AlibabaCloud-Agent-Skills/alibabacloud-aes-sysom-pai-diagnosis ``` This conflicts with the unqualified statement at `SKILL.md:276-280`: ```markdown ## Cleanup The diagnosis operations in this skill are **read-only** and do not modify the PAI service / job state — no cleanup is needed. ``` ### Technical Analysis The policy file already defines a narrower custom policy containing the five actions needed by the workflow: - `sysom:InitialSysom` - `sysom:InvokeDiagnosis` - `sysom:GetDiagnosisResult` - `eas:ListServices` - `pai-dlc:GetJob` Despite this, it labels a combination containing `AliyunSysOMFullAccess` as the recommended minimal managed-policy combination and offers full PAI and EAS access as convenient alternatives. These managed policies authorize operations beyond the documented diagnosis workflow. Furthermore, `initial-sysom --check-only false` initializes service authorization and may create or confi ...[truncated 1416 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description says the skill should be used for 'Any issue related to EAS instance health, DLC job health, or underlying compute resource performance,' which is a broad catch-all rather than a narrowly bounded trigger. This can overlap with many unrelated or non-SysOM issues and may cause unintended invocation because no negative examples or tighter constraints are given for that clause.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file requires ocd_description to be 'in English' and later repeats that it must contain 'no Chinese characters, no spaces,' which imposes a language constraint on user input. This is a natural-language policy concern because the skill forces a specific language rather than offering translation help, opt-in, or a documented locale-specific justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims to perform read-only diagnosis, but its workflow changes local CLI state by enabling AI mode, setting a user agent, enabling auto-plugin installation, and updating plugins. These persistent changes alter the operator environment beyond the stated scope and can create unintended side effects, trust-boundary violations, or future command behavior changes on the host.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation says the operations are read-only and that no cleanup is needed, yet the workflow itself requires disabling AI mode afterward and earlier makes other persistent CLI changes. This mismatch can leave modified local settings in place if execution is interrupted, causing follow-on commands to behave differently or exposing the environment to unnecessary plugin or telemetry behavior.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 31)May include surrounding context.

md

# macOS amd64
curl -O https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz
tar xzf aliyun-cli-macosx-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Linux amd64
curl -O https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 36)May include surrounding context.

Linux amd64

curl -O https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz tar xzf aliyun-cli-linux-latest-amd64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/diagnose-workflow.md (reported line 31)May include surrounding context.

md

**4b. Product Auto-Inference**

The `product` field is determined automatically from the `instance` prefix — do NOT ask the user to confirm unless inference fails:

| Instance Prefix | Inferred Product |
|----------------|-----------------|

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction requires ocd_description to be in English only, with no Chinese characters, which is a language-policy constraint expressed in natural language. The document does not offer the user a language choice or explain a justified locale limitation, so it fits the policy-violation category.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document defines successful completion as disabling AI-Mode at the end, but it does not warn that this modifies the user's persistent CLI configuration state. Silent state-changing cleanup steps can surprise users, break later workflows, or disable features they intentionally enabled, which is a real security and safety concern even if the direct impact is limited.

Content

No source excerpt is available for this finding.