Security audit

Alibabacloud Agentloop Contextstore

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Alibaba Cloud ContextStore operator, but its install and permission guidance gives broad, persistent, and under-verified authority that users should review before installing.

Review this skill carefully before installing. Use a pinned, verified Aliyun CLI and CMS plugin instead of pipe-to-shell or latest downloads, avoid global automatic plugin updates, never paste real access keys or tokens into command lines or chats, and grant only the exact CMS actions and resource scope needed for the current task. Treat delete and API-key operations as high impact and confirm targets before execution.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:23
Finding: Unverified Remote Installer Is Executed Directly by Bash
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/cli-installation-guide.md:39
Finding: Mutable “Latest” CLI Binaries Are Installed Without Integrity Verification
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:29
Finding: Mandatory Automatic and Unpinned Plugin Updates Expand Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/cli-installation-guide.md:102
Finding: Credential Guide Passes Cloud Secrets Through Command-Line Arguments
Content: View full analysis
\ --access-key-secret \ --region cn-hangzhou ``` The guide repeats this pattern for long-lived access keys, STS credentials, multiple profiles, credential rotation, and token refresh. ### Technical Analysis Supplying access-key IDs, access-key secrets, and STS tokens as literal command-line arguments can expose them through: - Shell history files. - Process inspection and process telemetry. - Terminal session recording. - CI/CD logs. - Debugging or audit logs. - AI-agent command transcripts. - Copy-and-paste history. The guide states that non-interactive flags are recommended, increasing the likelihood that secrets will be embedded in scripts or automation logs. It also shows credentials stored in `~/.aliyun/config.json`. These instructions conflict with `SKILL.md:60-63`, which explicitly says never to ask for AK/SK values in a conversation or command line and never to use `aliyun configure set` with literal credential values. The contradictory reference makes the effective security behavior ambiguous. ### Attack Path 1. A user follows the referenced configuration guide. 2. The user enters a real access-key secret or STS token as a command-line argument. 3. The command is retained in shell history, process telemetry, a CI log, or an agent transcript. 4. Another local user, log reader, compromised process, or repository reader obtains the credential. 5. The attacker authenticates to Alibaba Cloud using the exposed credential. 6. The attacker invokes any API allowed by the associated RAM identity u ...[truncated 576 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/ram-policies.md:25
Finding: Wildcard RAM Policy Grants Unnecessary Destructive and API-Key Permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Rogue AgentSelf-Modification, Session Persistence

Findings (14)

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: alibabacloud-agentloop-contextstore description: | Operate Alibaba Cloud CloudMonitor Service (CMS) AgentLoop ContextStore by using aliyun CLI with api version 2024-03-30. Use when users mention CloudMonitor, CMS, AgentLoop, agent loop, context, memory, experience, ContextStore, context store, 上下文库, 记忆库, 经验库, or ask to create/query/update/delete stores, write/search/update/delete context records, manage store API keys, or debug aliyun cms ContextStore commands. --- # AgentLoop ContextStore Skill

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs users to execute a remote installer via curl ... | bash, which downloads and immediately runs code without prior integrity verification or pinning to a trusted artifact. If the hosting endpoint, network path, or served script is compromised, this becomes arbitrary code execution on the operator's machine.
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
Installation

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low, run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to install/update, or see references/cli-installation-guide.md for installation instructions.

bash
aliyun version

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.
md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.
md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.
md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.
Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text
### Windows

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guide shows secrets passed directly on the command line without warning that shell history, process listings, CI logs, and terminal recording can expose credentials. Because this skill concerns cloud administration, users may copy real access keys into these commands, leading to credential theft and full account misuse depending on permissions.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.
md
1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once ### Configuration Modes

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The debug guidance recommends verbose logging without warning that debug output may include sensitive configuration, request metadata, tokens, or credential-provider details. In agent-driven troubleshooting, such output is likely to be pasted into chats, tickets, or logs, creating secondary credential leakage risk.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.
bash
# Restrict permissions chmod 600 ~/.aliyun/config.json

Troubleshooting

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide expands into generic Alibaba Cloud plugin installation and cross-service command discovery far beyond the declared CMS ContextStore scope. In an agent skill, this scope creep increases the chance the agent will assist with unrelated cloud operations, potentially broadening reachable capabilities and enabling misuse outside intended boundaries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document provides bulk deletion examples using delete-contexts --filter and comma-separated IDs without an adjacent explicit warning that these operations are destructive and can remove many records at once. In an agent skill context, users or downstream agents may copy commands directly, so the lack of a clear caution increases the chance of accidental mass deletion of memory or experience data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This reference file prominently lists destructive commands such as delete-context-store, delete-context, delete-contexts, and delete-context-store-api-key without any adjacent warning about irreversible data loss, scope, or confirmation expectations. In a skill intended to help agents operate a live ContextStore and its records, that omission increases the chance that an agent or user will invoke destructive operations casually or without understanding the consequences.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Verification and troubleshooting rely on ECS commands unrelated to CMS ContextStore, which trains users or agents to validate credentials using a different service. In a scoped operational skill, unrelated service examples can normalize cross-service access and encourage permission grants or actions beyond what the skill should need.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Memory Manipulation

External Script Fetching

Installation

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Extract and install

Missing User Warnings

Session Persistence

Missing User Warnings

Sudo/Root Execution

Troubleshooting

Description-Behavior Mismatch

Missing User Warnings

Missing User Warnings

Description-Behavior Mismatch