ClawHub
Back to skill

Security audit

Alibabacloud Alert Intent Router

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Alibaba Cloud alert-routing skill with some broad triggers and manual CLI setup caveats, but no hidden, destructive, or deceptive behavior was found.

Before installing, confirm that broad trigger terms are acceptable in your agent environment and that users understand when CMDB/cloud resource lookups and backend diagnostic skills may run. Use least-privilege read-only RAM credentials for this router, install the Aliyun CLI only from trusted sources, and review any report-suggested remediation commands before executing them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes very broad terms such as "alert", "error", "异常", and "故障", which are common in ordinary user conversations and unrelated troubleshooting contexts. In a routing skill that can query CMDB, inspect cloud resources, and invoke backend diagnostic skills, overly permissive activation increases the chance of unintended execution, disclosure of infrastructure context, and accidental invocation of sensitive operational workflows.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The network intent includes very broad terms such as generic connection failures, timeouts, and service errors that can match many non-network incidents, including database, application, or single-instance failures. In an alert router, this can misroute incidents to the wrong downstream skill, producing incorrect diagnostics, wasted triage effort, and potentially masking the actual root cause during incident response.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The ECS section uses vague symptoms like 'website down', 'service not responding', and 'server unreachable', which overlap heavily with load balancer, network, application, and database incidents. Because this file drives intent routing, these generic triggers can cause false classification into ECS diagnosis, leading responders away from the real failing component and degrading incident handling accuracy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file presents the report template entirely in Chinese from the title onward, and the example/output structure also assumes Chinese-language report generation. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The guide instructs users to move the aliyun binary into /usr/local/bin/ using sudo, which writes to a system location and changes the machine state. While this is normal for installation, the markdown does not explicitly warn that the command requires elevated privileges and modifies system-wide executables.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The PowerShell example updates the machine-level Path environment variable, which affects all users/processes on the system and requires elevated privileges. The section notes admin privileges in-line, but it does not clearly warn about the persistent, system-wide change and its potential impact.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file presents all user-facing policy and permission guidance exclusively in Chinese. Under the language/locale policy rule, forcing a specific language without user opt-in or an explicit justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.