Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent Alibaba Cloud SysOM inspection purpose, but its setup and runtime authority are broad enough that users should review it before installing.
Install only if you trust the publisher and are comfortable granting Alibaba Cloud SysOM permissions, possible service activation, agent installation, fleet inspection, and local report storage. Avoid running the documented curl | sudo bash command unless you can independently verify the installer contents and integrity; prefer a reviewed, pinned, least-privilege installation path.
SKILL.md:39Mutable Remote Installation Script Is Executed Directly as Root
scripts/sysom_cli/__main__.py:12CLI Automatically Installs Unpinned Dependencies at Runtime
The declared description promises operational diagnostics for ECS instances, including health inspection, anomaly detection, and automated deep memory diagnosis. However, the provided code chunk does not inspect system state or perform any diagnosis at all. It only initializes a local Python virtual environment and installs dependencies. While setup scripts can be a supporting detail, this chunk by itself does not exhibit the declared functionality and instead has a materially different immediate purpose: environment initialization. Therefore, the description does not accurately represent what the supplied code chunk actually does.
The declared description promises substantial system inspection and diagnostic behavior, but the provided code chunk does not implement any of it. The file only contains an encoding header and no executable logic. This is a clear description-to-code mismatch because the actual code has no observable functionality related to ECS instance health, anomaly detection, or diagnosis.
The declared description promises substantial inspection and diagnostic functionality, but the provided code chunk does not implement any of it. Since the code is effectively empty, the actual behavior does not match the stated primary purpose. There are no undeclared capabilities present; rather, the issue is that the claimed capabilities are unsupported by the supplied code.
Yes, this is a mismatch. The declared description promises substantial operational behavior for ECS health inspection and automated diagnosis, but the provided code chunk contains only an empty init.py file. There is no evidence of system metric collection, anomaly detection, deep diagnosis, trigger processing, or any other functionality matching the description. This is not merely a partial implementation detail; the supplied code does not implement the declared primary purpose at all.
The code chunk does not perform instance health inspection, anomaly detection, memory/disk/CPU/load analysis, leak detection, or deep diagnosis triggering. Its sole purpose is credential acquisition and role assumption for Alibaba Cloud access. While authentication can be a supporting component of a broader diagnostic tool, this chunk itself implements materially different capabilities involving credential access and cloud authentication resources that are not reflected in the declared description. Therefore this description does not accurately represent what this specific code chunk actually does.
Fetching a remote script with curl and piping it directly to bash removes any opportunity for integrity verification, code review, or safe staging before execution. Because the script runs as root in this same command, compromise of the hosting bucket, DNS/TLS trust, or the distribution path could yield immediate full-system compromise.
If it is missing, install it:
curl -fsSL --connect-timeout 1000 https://sysom-prd-cn-hangzhou.oss-cn-hangzhou.aliyuncs.com/sysom_prd/skill_cli/install.sh | sudo bash
Then verify only the binary:
The direct pipeline from network fetch to sudo bash is a classic unsafe command chain that combines untrusted input and immediate privileged execution. This chaining magnifies risk by preventing validation checkpoints and turning any upstream compromise into root-level arbitrary code execution.
If it is missing, install it:
curl -fsSL --connect-timeout 1000 https://sysom-prd-cn-hangzhou.oss-cn-hangzhou.aliyuncs.com/sysom_prd/skill_cli/install.sh | sudo bash
Then verify only the binary:
The skill goes beyond read-only inspection and can activate SysOM and install an agent on the target instance. Those are state-changing operations with security and operational consequences, and the code performs them after only a generic prompt, which can lead to unintended software deployment and privilege use in environments expecting diagnostics only.
Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.
def _fetch_ram_role_credentials(role_name: str) -> Optional[Dict[str, str]]:
url = f"http://100.100.100.200/latest/meta-data/ram/security-credentials/{role_name}"
try:
response = requests.get(url, timeout=3)
if response.status_code != 200:
Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.
def _fetch_ram_role_credentials(role_name: str) -> Optional[Dict[str, str]]:
url = f"http://100.100.100.200/latest/meta-data/ram/security-credentials/{role_name}"
try:
response = requests.get(url, timeout=3)
if response.status_code != 200:
The skill clearly instructs use of shell, network access, environment variables, and likely file access, but it does not declare any explicit tool scope such as allowed-tools or permissions. This weakens least-privilege controls and makes it harder for a host agent or reviewer to constrain dangerous capabilities before execution.
Broad trigger keywords like 'inspection', 'instance diagnosis', and 'memory usage' can cause the skill to activate for generic admin requests outside the user's specific intent. In this skill, unintended activation is more dangerous because execution may lead to broad ECS inspection, diagnosis workflows, and possible installation of a privileged CLI.
The skill instructs users to run an installation pipeline under sudo, which executes fetched code with root privileges. In context, this is especially dangerous because the command is positioned as a routine setup step for an operational skill, increasing the chance that users run it without review.
If it is missing, install it:
curl -fsSL --connect-timeout 1000 https://sysom-prd-cn-hangzhou.oss-cn-hangzhou.aliyuncs.com/sysom_prd/skill_cli/install.sh | sudo bash
Then verify only the binary:
The skill advertises batch and region-wide inspection with auto-diagnosis and report generation, but it does not require an explicit warning or user confirmation about scanning up to 5000 instances and collecting metrics/log-derived findings. This creates a meaningful risk of overbroad access, unintended data exposure, and surprising operational impact if triggered accidentally or by an under-informed user.
This text specifies a fixed output language (Chinese) for LLM-generated reports, which is a natural-language locale constraint. Because no alternative language option or explicit justification is provided, it may violate language/locale policy expectations requiring user choice or documented constraint.
A health-inspection skill should not silently modify the host environment by downloading and installing Python packages on execution. This behavior increases risk because it can trigger arbitrary third-party package code during install, creates nondeterministic behavior across environments, and may be abused in compromised or intercepted package supply chains.
The CLI automatically invokes pip at runtime to install packages, which introduces a supply-chain and unexpected code-execution path unrelated to the core inspection operation. Even though shell injection is not present because arguments are passed as a list and package names are hardcoded, installing and executing packages during normal CLI startup expands the trust boundary to package indexes, network transport, and the local Python environment.
print(
f"[Setup] Installing missing dependencies: {', '.join(sorted(missing))}", file=sys.stderr)
try:
subprocess.check_call(
[sys.executable, "-m", "pip", "install",
"--quiet", *sorted(missing)],
)
The code asks for a broad confirmation to 'activate and install SysOM' but does not clearly disclose that it will perform state-changing actions on the account and instance. This weak consent flow increases the risk of users authorizing unexpected system modification, agent deployment, and service-linked role creation without understanding the impact.
The code persists inspection reports to local disk and those reports may include process command lines and memory diagnostics extracted from diagnosis results. Command lines often contain secrets, internal paths, host details, or tenant data, so writing them unredacted to disk increases exposure through local file access, backups, and log collection.
The manifest describes an ECS health inspection skill focused on anomaly detection and diagnosis. In this file, the skill implements credential harvesting from process environment variables and ~/.aliyun/config.json, which is a sensitive capability not mentioned in the manifest and not obviously inherent to simple local inspection logic.
The helper can retrieve instance-role credentials from the ECS metadata service and can also assume additional RAM roles via STS, which materially broadens the trust and access boundary of the skill. In the context of an inspection/diagnosis skill, this creates an unexpected identity-access path that could expose privileged cloud credentials or enable cloud-side actions beyond local health inspection if other parts of the skill are compromised or overly permissive.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
The dependency manifest does not pin exact versions, which makes builds non-reproducible and can cause different environments to install different releases. In a security-sensitive automation skill that performs instance inspection and diagnosis, this increases supply-chain risk because a newly published vulnerable or malicious package version could be pulled in unintentionally.
requests>=2.31.0
alibabacloud-tea-openapi>=0.4.4,<1.0.0
alibabacloud-tea-util>=0.3.14,<1.0.0
Detected: suspicious.exposed_resource_identifier