Security audit

alibabacloud-agentloop-management

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate AgentLoop management skill, but it needs review because it can affect cloud and Kubernetes resources and includes unsafe install/delete patterns.

Install only for users who intentionally manage Alibaba Cloud AgentLoop resources. Use a least-privilege RAM role, avoid the HTTP Java-agent and curl-to-bash paths unless independently verified, use temporary scoped kubeconfigs instead of the global default, and run destructive probe or dataset/pipeline operations only after reviewing the exact target and rollback plan.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: references/apm.md:323
Finding: Unauthenticated HTTP Download of Executable Java Agent
Content: View full analysis
Vulnerability Details

File Location: references/apm.md:323-329, 394-405
Vulnerability Type: Unauthenticated remote component retrieval
Risk Level: High

Vulnerable instructions:

markdown
| Network | URL Pattern | |---------|-------------| | Public | `http://arms-apm-{regionId}.oss-{regionId}.aliyuncs.com/<path>` | | VPC | `http://arms-apm-{regionId}.oss-{regionId}-internal.aliyuncs.com/<path>` |

bash
wget -T 30 -t 3 "http://arms-apm-{regionId}.oss-{regionId}[-internal].aliyuncs.com/AliyunJavaAgent.zip" -O AliyunJavaAgent.zip unzip AliyunJavaAgent.zip -d /opt/

bash
# ARMS_LICENSE_KEY is exported from apm configuration get (see onboarding.md); never inline the token java -javaagent:/opt/AliyunJavaAgent/aliyun-java-agent.jar \ -Darms.licenseKey="$ARMS_LICENSE_KEY" \ -Darms.appName={appName} \ -Darms.workspace={workspace} \ -jar app.jar

Technical Analysis

The manual Java onboarding workflow downloads AliyunJavaAgent.zip over plain HTTP. HTTP provides neither server authentication nor transport integrity. The instructions also do not require verification of a cryptographic signature or an expected digest before extracting the archive.

The downloaded JAR is subsequently supplied to the JVM through -javaagent. A Java agent executes inside the target JVM and can instrument classes, inspect application memory, access process-level credentials, and perform actions with the operating-system privileges of the application process. Consequently, modification of the HTTP response is not merely a content-integrity issue—it creates a direct remote code-execution path.

Attack Path

A user or Agent follows the manual Java-agent onboarding instructions.

The host requests AliyunJavaAgent.zip over HTTP.

An attacker capable of intercepting or modifying network traffic substitutes a malicious archive.

The workflow extracts the substituted ...[truncated 828 chars]
Remediation: View remediation
Remediation Suggestions

Replace every HTTP download URL with an HTTPS endpoint and reject protocol downgrades.

Publish and pin an expected SHA-256 or stronger digest for each supported agent release.

Prefer a vendor signature and verify it against a pinned, trusted public key before extraction.

Abort installation if transport, signature, or digest validation fails.

Download into a restricted temporary directory, validate the archive, and inspect archive paths before extracting into /opt/.

Pin a specific agent version rather than implicitly retrieving mutable content.

Document the verification commands directly alongside the download and make them mandatory rather than optional.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/live-debug/delete_all_probes.sh:27
Finding: Bulk Probe Deletion Helper Does Not Enforce User Confirmation
Content: View full analysis
Vulnerability Details

File Location: scripts/live-debug/delete_all_probes.sh:27-32, 68-82
Vulnerability Type: Destructive cloud operation without an executable confirmation gate
Risk Level: Medium

Vulnerable code:

bash
WORKSPACE="$1" SERVICE_ID="$2" DRY_RUN=false if [ "${3:-}" = "--dry-run" ]; then DRY_RUN=true fi

bash
while IFS= read -r TASK_ID; do [ -z "$TASK_ID" ] && continue FOUND=$((FOUND + 1)) if [ "$DRY_RUN" = true ]; then echo "[dry-run] would delete taskId=${TASK_ID} type=${TASK_TYPE}" continue fi echo "Deleting taskId=${TASK_ID} type=${TASK_TYPE}" "${SCRIPT_DIR}/delete_task.sh" "$WORKSPACE" "$SERVICE_ID" "$TASK_ID" "$TASK_TYPE" DELETED=$((DELETED + 1)) done <<< "$TASK_IDS"

Technical Analysis

The helper defaults DRY_RUN to false. Supplying only a workspace and service ID therefore causes the script to enumerate all supported Live-Debug probe types and invoke delete_task.sh for every discovered task.

The domain instructions in references/live-debug-runtime.md:111-114 describe a two-phase process in which the exact deletion plan is shown and execution occurs only after explicit approval in a subsequent user message. That requirement is not enforced by the executable helper. There is no confirmation token, interactive prompt, exact-target acknowledgement, or mandatory execution flag.

Because the script can be called directly by an Agent or another local workflow, a policy-level instruction alone does not protect the destructive operation at the execution boundary. The available --dry-run flag does not mitigate this because it is optional and the destructive mode is the default.

Attack Path

An Agent workflow or another caller has access to valid Alibaba Cloud credentials with ServiceTask deletion permission.

The caller invokes delete_all_probes.sh with a workspace and service ID but omi ...[truncated 777 chars]
Remediation: View remediation
Remediation Suggestions

Make dry-run behavior the default.

Require an explicit destructive flag such as --confirm-delete-all.

Bind confirmation to the exact workspace and service ID, for example by requiring the caller to repeat both target values.

Require an approval token generated only after displaying the deletion plan, or use an interactive confirmation when a trusted terminal is available.

Reject unknown third arguments rather than silently entering destructive mode.

Display the complete task list and count before deletion.

Preserve the documented two-phase user-approval workflow as an additional policy control, while enforcing confirmation independently in the script.

Where practical, support deletion limits or selection by task ID so broad removal is not the default operation.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (117)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents the skill as an AgentLoop assistance/router capability, but the analyzed behavior reportedly includes fetching remote content from help.aliyun.com and GitHub and writing downloaded material to local storage. This mismatch undermines informed consent and security review because a user or platform may authorize a benign-looking observability skill while it also performs network retrieval and local persistence that can introduce untrusted content, data exfiltration paths, or supply-chain-style abuse.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
CK/ECS onboarding, LLM and AI-framework tracing (Dify, LangChain, DashScope) | [references/onboarding.md](references/onboarding.md) - internally routes to [refe

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
CK/ECS onboarding, LLM and AI-framework tracing (Dify, LangChain, DashScope) | [references/onboarding.md](references/onboarding.md) - internally routes to [refe

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
ime inspection), disable/clear probes, and query capture results through SLS | [references/live-debug-runtime.md](references/live-debug-runtime.md) |

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill normalizes fetching and executing a remote script in one step via curl -fsSL ... | bash, which is a classic unsafe pattern. In an observability onboarding skill, this is more dangerous because it encourages execution on production application hosts and may combine with supplied environment variables or secrets, increasing blast radius if the script source is compromised.
Content: Scanner excerpt · references/ai.md (reported line 233)May include surrounding context.
md
### OpenClaw / CoPaw / Hermes - Each framework provides a dedicated installer script (`curl -fsSL ... | bash`) that installs the corresponding observability plugin. - Pass parameters via `--x-arms-license-key "$ARMS_LICENSE_KEY"`, `--serviceName`, and `--endpoint`; keep the token in the environment variable rather than inlining it in the installer command. - Only the `opentelemetry` protocol is supported. Render output from the addon template.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/ai.md (reported line 9)May include surrounding context.
md
## Scope Guided workflow to onboard server-side applications into AgentLoop application observability. Uses `aliyun cms2` CLI to initialize APM infrastructure and retrieve access credentials, then generates configuration for the user's specific language and deployment method. **In-Scope**: Initialize APM infra, retrieve LicenseKey/Endpoint, register app services, generate startup configuration for all supported languages, **auto-modify K8s Deployment YAML** (with user confirmation) via `aliyun cs` + `kubectl`.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/apm.md (reported line 9)May include surrounding context.
md
## Scope Guided workflow to onboard server-side applications into AgentLoop application observability. Uses `aliyun cms2` CLI to initialize APM infrastructure and retrieve access credentials, then generates configuration for the user's specific language and deployment method. **In-Scope**: Initialize APM infra, retrieve LicenseKey/Endpoint, register app services, generate startup configuration for all supported languages, **auto-modify K8s Deployment YAML** (with user confirmation) via `aliyun cs` + `kubectl`.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/ai.md (reported line 91)May include surrounding context.
md
2. **Workspace format is `agentloop-{32-char-code}`**: Prefix `agentloop-` followed by exactly 32 characters (e.g. `agentloop-2694ecf8****************1f84542d`). If missing or invalid, run `aliyun cms2 workspace list -o json` and reuse the first matching `agentloop-[0-9a-f]{32}` workspace; if none match, stop and prompt: **Please provide a valid AgentLoop workspace in the format `agentloop-{32-char-code}`.** 3. **Quota fallback**: if workspace creation hits **403/400** quota errors, list existing workspaces, reuse a matching `agentloop-*` workspace, log the reuse reason, and continue - do not abort or fall back to `default-cms-*`. 4. **Do NOT proceed without a valid workspace**: All `apm configuration` / `apm service` commands require `--workspace`; do not guess or fabricate a value. 5. **Region must be obtained separately**: `regionId` is NOT encoded in the workspace name. Derive it from cluster metadata or kubeconfig context in container flows; ask the user in non-container flows. ---

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/apm.md (reported line 25)May include surrounding context.
md
2. **Workspace format is `agentloop-{32-char-code}`**: Prefix `agentloop-` followed by exactly 32 characters (e.g. `agentloop-2694ecf8****************1f84542d`). If missing or invalid, run `aliyun cms2 workspace list -o json` and reuse the first matching `agentloop-[0-9a-f]{32}` workspace; if none match, stop and prompt: **Please provide a valid AgentLoop workspace in the format `agentloop-{32-char-code}`.** 3. **Quota fallback**: if workspace creation hits **403/400** quota errors, list existing workspaces, reuse a matching `agentloop-*` workspace, log the reuse reason, and continue - do not abort or fall back to `default-cms-*`. 4. **Do NOT proceed without a valid workspace**: All `apm configuration` / `apm service` commands require `--workspace`; do not guess or fabricate a value. 5. **Region must be obtained separately**: `regionId` is NOT encoded in the workspace name. Derive it from cluster metadata or kubeconfig context in container flows; ask the user in non-container flows. ---

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/apm.md (reported line 33)May include surrounding context.
md
2. **Workspace format is `agentloop-{32-char-code}`**: Prefix `agentloop-` followed by exactly 32 characters (e.g. `agentloop-2694ecf8****************1f84542d`). If missing or invalid, run `aliyun cms2 workspace list -o json` and reuse the first matching `agentloop-[0-9a-f]{32}` workspace; if none match, stop and prompt: **Please provide a valid AgentLoop workspace in the format `agentloop-{32-char-code}`.** 3. **Quota fallback**: if workspace creation hits **403/400** quota errors, list existing workspaces, reuse a matching `agentloop-*` workspace, log the reuse reason, and continue - do not abort or fall back to `default-cms-*`. 4. **Do NOT proceed without a valid workspace**: All `apm configuration` / `apm service` commands require `--workspace`; do not guess or fabricate a value. 5. **Region must be obtained separately**: `regionId` is NOT encoded in the workspace name. Derive it from cluster metadata or kubeconfig context in container flows; ask the user in non-container flows. ---

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/apm.md (reported line 43)May include surrounding context.
md
2. **Workspace format is `agentloop-{32-char-code}`**: Prefix `agentloop-` followed by exactly 32 characters (e.g. `agentloop-2694ecf8****************1f84542d`). If missing or invalid, run `aliyun cms2 workspace list -o json` and reuse the first matching `agentloop-[0-9a-f]{32}` workspace; if none match, stop and prompt: **Please provide a valid AgentLoop workspace in the format `agentloop-{32-char-code}`.** 3. **Quota fallback**: if workspace creation hits **403/400** quota errors, list existing workspaces, reuse a matching `agentloop-*` workspace, log the reuse reason, and continue - do not abort or fall back to `default-cms-*`. 4. **Do NOT proceed without a valid workspace**: All `apm configuration` / `apm service` commands require `--workspace`; do not guess or fabricate a value. 5. **Region must be obtained separately**: `regionId` is NOT encoded in the workspace name. Derive it from cluster metadata or kubeconfig context in container flows; ask the user in non-container flows. ---

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/apm.md (reported line 899)May include surrounding context.
md
2. **Workspace format is `agentloop-{32-char-code}`**: Prefix `agentloop-` followed by exactly 32 characters (e.g. `agentloop-2694ecf8****************1f84542d`). If missing or invalid, run `aliyun cms2 workspace list -o json` and reuse the first matching `agentloop-[0-9a-f]{32}` workspace; if none match, stop and prompt: **Please provide a valid AgentLoop workspace in the format `agentloop-{32-char-code}`.** 3. **Quota fallback**: if workspace creation hits **403/400** quota errors, list existing workspaces, reuse a matching `agentloop-*` workspace, log the reuse reason, and continue - do not abort or fall back to `default-cms-*`. 4. **Do NOT proceed without a valid workspace**: All `apm configuration` / `apm service` commands require `--workspace`; do not guess or fabricate a value. 5. **Region must be obtained separately**: `regionId` is NOT encoded in the workspace name. Derive it from cluster metadata or kubeconfig context in container flows; ask the user in non-container flows. ---

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/ram-policies.md (reported line 48)May include surrounding context.
md
2. **Workspace format is `agentloop-{32-char-code}`**: Prefix `agentloop-` followed by exactly 32 characters (e.g. `agentloop-2694ecf8****************1f84542d`). If missing or invalid, run `aliyun cms2 workspace list -o json` and reuse the first matching `agentloop-[0-9a-f]{32}` workspace; if none match, stop and prompt: **Please provide a valid AgentLoop workspace in the format `agentloop-{32-char-code}`.** 3. **Quota fallback**: if workspace creation hits **403/400** quota errors, list existing workspaces, reuse a matching `agentloop-*` workspace, log the reuse reason, and continue - do not abort or fall back to `default-cms-*`. 4. **Do NOT proceed without a valid workspace**: All `apm configuration` / `apm service` commands require `--workspace`; do not guess or fabricate a value. 5. **Region must be obtained separately**: `regionId` is NOT encoded in the workspace name. Derive it from cluster metadata or kubeconfig context in container flows; ask the user in non-container flows. ---

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/ram-policies.md (reported line 109)May include surrounding context.
md
2. **Workspace format is `agentloop-{32-char-code}`**: Prefix `agentloop-` followed by exactly 32 characters (e.g. `agentloop-2694ecf8****************1f84542d`). If missing or invalid, run `aliyun cms2 workspace list -o json` and reuse the first matching `agentloop-[0-9a-f]{32}` workspace; if none match, stop and prompt: **Please provide a valid AgentLoop workspace in the format `agentloop-{32-char-code}`.** 3. **Quota fallback**: if workspace creation hits **403/400** quota errors, list existing workspaces, reuse a matching `agentloop-*` workspace, log the reuse reason, and continue - do not abort or fall back to `default-cms-*`. 4. **Do NOT proceed without a valid workspace**: All `apm configuration` / `apm service` commands require `--workspace`; do not guess or fabricate a value. 5. **Region must be obtained separately**: `regionId` is NOT encoded in the workspace name. Derive it from cluster metadata or kubeconfig context in container flows; ask the user in non-container flows. ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/apm.md (reported line 147)May include surrounding context.
Idempotent - if already initialized, returns successfully. Use apm configuration get to check status.

Step 3 - Retrieve Access Credentials

bash
aliyun cms2 apm configuration get --workspace {workspace} --region {regionId} -o json

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Even though the path is constrained, recommending rm -rf /opt/AliyunJavaAgent in a reusable skill normalizes dangerous deletion patterns. In operational environments, users may adapt the command incorrectly or run it with elevated privileges, leading to accidental removal of the wrong files.
Content: Scanner excerpt · references/apm.md (reported line 828)May include surrounding context.
md
| Method | What to Remove | |--------|----------------| | **proprietary agent (JVM)** | Remove `-javaagent:/opt/AliyunJavaAgent/...` and all `-Darms.*` from startup command; optionally `rm -rf /opt/AliyunJavaAgent` | | **proprietary agent (Golang)** | Re-compile without `instgo` (`go build` instead of `./instgo go build`); remove `ARMS_*` env vars | | **proprietary agent (Python)** | Remove `aliyun-instrument` wrapper from CMD; `pip3 uninstall aliyun-bootstrap`; remove `ARMS_*` env vars | | **proprietary agent (Node.js)** | Remove `-r @loongsuite/cms_node_sdk/register` from startup; `npm uninstall @loongsuite/cms_node_sdk`; remove `ARMS_*`/`CMS_*` env vars |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Even though the path is constrained, recommending rm -rf /opt/AliyunJavaAgent in a reusable skill normalizes dangerous deletion patterns. In operational environments, users may adapt the command incorrectly or run it with elevated privileges, leading to accidental removal of the wrong files.
Content: Scanner excerpt · references/apm.md (reported line 828)May include surrounding context.
md
| Method | What to Remove | |--------|----------------| | **proprietary agent (JVM)** | Remove `-javaagent:/opt/AliyunJavaAgent/...` and all `-Darms.*` from startup command; optionally `rm -rf /opt/AliyunJavaAgent` | | **proprietary agent (Golang)** | Re-compile without `instgo` (`go build` instead of `./instgo go build`); remove `ARMS_*` env vars | | **proprietary agent (Python)** | Remove `aliyun-instrument` wrapper from CMD; `pip3 uninstall aliyun-bootstrap`; remove `ARMS_*` env vars | | **proprietary agent (Node.js)** | Remove `-r @loongsuite/cms_node_sdk/register` from startup; `npm uninstall @loongsuite/cms_node_sdk`; remove `ARMS_*`/`CMS_*` env vars |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Even though the path is constrained, recommending rm -rf /opt/AliyunJavaAgent in a reusable skill normalizes dangerous deletion patterns. In operational environments, users may adapt the command incorrectly or run it with elevated privileges, leading to accidental removal of the wrong files.
Content: Scanner excerpt · references/apm.md (reported line 828)May include surrounding context.
md
| Method | What to Remove | |--------|----------------| | **proprietary agent (JVM)** | Remove `-javaagent:/opt/AliyunJavaAgent/...` and all `-Darms.*` from startup command; optionally `rm -rf /opt/AliyunJavaAgent` | | **proprietary agent (Golang)** | Re-compile without `instgo` (`go build` instead of `./instgo go build`); remove `ARMS_*` env vars | | **proprietary agent (Python)** | Remove `aliyun-instrument` wrapper from CMD; `pip3 uninstall aliyun-bootstrap`; remove `ARMS_*` env vars | | **proprietary agent (Node.js)** | Remove `-r @loongsuite/cms_node_sdk/register` from startup; `npm uninstall @loongsuite/cms_node_sdk`; remove `ARMS_*`/`CMS_*` env vars |

Credential Access

High

Category: Privilege Escalation
Confidence: 83% confidence
Finding: The workflow explicitly includes 'Discover clusters and obtain kubeconfig,' which directs the agent to obtain privileged cluster access material. In a skill that also patches deployments and installs components, this creates a meaningful avenue for overreach or misuse of user infrastructure access.
Content: Scanner excerpt · references/apm.md (reported line 903)May include surrounding context.
Workflow

Discover clusters and obtain kubeconfig:

bash
# List ACK clusters to find clusterId (only needed when clusterId is unknown)

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: Saving retrieved kubeconfig to ~/.kube/config risks overwriting or merging with existing cluster credentials and leaves privileged access material persistently available to later agent actions or local compromise. Because kubeconfig authorizes kubectl operations, mishandling it can lead to unauthorized cluster inspection or modification.
Content: Scanner excerpt · references/apm.md (reported line 909)May include surrounding context.
List ACK clusters to find clusterId (only needed when clusterId is unknown)

aliyun cs describe-clusters --region {regionId}

Get kubeconfig for the target cluster (saved to ~/.kube/config by default)

aliyun cs describe-cluster-user-kubeconfig --cluster-id {clusterId} --temporary-duration-minutes 480

text

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: Saving retrieved kubeconfig to ~/.kube/config risks overwriting or merging with existing cluster credentials and leaves privileged access material persistently available to later agent actions or local compromise. Because kubeconfig authorizes kubectl operations, mishandling it can lead to unauthorized cluster inspection or modification.
Content: Scanner excerpt · references/apm.md (reported line 909)May include surrounding context.
List ACK clusters to find clusterId (only needed when clusterId is unknown)

aliyun cs describe-clusters --region {regionId}

Get kubeconfig for the target cluster (saved to ~/.kube/config by default)

aliyun cs describe-cluster-user-kubeconfig --cluster-id {clusterId} --temporary-duration-minutes 480

text

Credential Access

High

Category: Privilege Escalation
Confidence: 86% confidence
Finding: Directing the user to provide a self-managed cluster kubeconfig path encourages the agent to access sensitive cluster credentials from arbitrary local files. In context, that credential can then be used for discovery and mutation of deployments, increasing the blast radius of any misuse or compromise.
Content: Scanner excerpt · references/apm.md (reported line 910)May include surrounding context.
aliyun cs describe-clusters --region {regionId}

Get kubeconfig for the target cluster (saved to ~/.kube/config by default)

aliyun cs describe-cluster-user-kubeconfig --cluster-id {clusterId} --temporary-duration-minutes 480

text
If the user's cluster is not ACK (self-managed K8s), ask for the kubeconfig file path (default `~/.kube/config`).

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: The instruction to ask for a kubeconfig file path normalizes access to cluster credentials that may provide broad control over production infrastructure. Given the skill's later patch/install flows, this is a sensitive escalation point and should be treated as dangerous unless tightly controlled.
Content: Scanner excerpt · references/apm.md (reported line 913)May include surrounding context.
aliyun cs describe-cluster-user-kubeconfig --cluster-id {clusterId} --temporary-duration-minutes 480

text
If the user's cluster is not ACK (self-managed K8s), ask for the kubeconfig file path (default `~/.kube/config`). Verify access: ```bash

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: The instruction to ask for a kubeconfig file path normalizes access to cluster credentials that may provide broad control over production infrastructure. Given the skill's later patch/install flows, this is a sensitive escalation point and should be treated as dangerous unless tightly controlled.
Content: Scanner excerpt · references/apm.md (reported line 913)May include surrounding context.
aliyun cs describe-cluster-user-kubeconfig --cluster-id {clusterId} --temporary-duration-minutes 480

text
If the user's cluster is not ACK (self-managed K8s), ask for the kubeconfig file path (default `~/.kube/config`). Verify access: ```bash

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: The guide instructs users to fetch an executable shell script from the internet and later run it locally. Even with a review step, this creates a supply-chain risk: a compromised CDN, TLS interception in a hostile environment, or reviewer error could lead to arbitrary code execution on the user's machine.
Content: Scanner excerpt · references/evaluation/cli-installation-guide.md (reported line 14)May include surrounding context.
bash
# Step 1: Download the setup script curl -fsSL --connect-timeout 10 --max-time 120 -o /tmp/aliyun-cli-setup.sh https://aliyuncli.alicdn.com/setup.sh # Step 2: Review the script contents before running it less /tmp/aliyun-cli-setup.sh

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tp4

Ae1

Ae1

Ae1

External Script Fetching

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Step 3 - Retrieve Access Credentials

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Credential Access

Workflow

Credential Access

List ACK clusters to find clusterId (only needed when clusterId is unknown)

Get kubeconfig for the target cluster (saved to ~/.kube/config by default)

Credential Access

List ACK clusters to find clusterId (only needed when clusterId is unknown)

Get kubeconfig for the target cluster (saved to ~/.kube/config by default)

Credential Access

Get kubeconfig for the target cluster (saved to ~/.kube/config by default)

Credential Access

Credential Access

External Script Fetching