Alibabacloud Analyticdb Postgresql Knowledgebase Ops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:35 AM UTC
• Version: 0.0.2

Overview

The skill is mostly aligned with Alibaba Cloud knowledge-base management, but it asks for risky setup changes and handles database passwords in ways users should review carefully.

Install only if you are comfortable with Alibaba Cloud CLI setup changes and cloud document upload. Prefer installing the CLI and plugins through verified vendor or package-manager methods, avoid curl-to-bash, do not enable global auto-plugin installation unless you accept that behavior, use least-privilege RAM credentials, avoid pasting reusable passwords into chat or command lines, and verify any non-default upload endpoint before sending files.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:42

Finding

Mutable Remote Installation Script Executed Directly by Bash

Content

View full analysis

**Pre-check: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions. > Then **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > Then **[MUST]** run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date. ``` ### Technical Analysis The installation command downloads a mutable remote shell script and immediately sends it to Bash. There is no opportunity to inspect the retrieved content, and the workflow performs no version pinning, signature validation, or checksum verification. HTTPS protects the connection in transit but does not establish that the current remote payload is identical to the version reviewed with this Skill. Compromise of the publishing account, origin server, CDN, or associated delivery infrastructure could therefore change the effective code executed by the Skill after review. Installing the Aliyun CLI supports the declared functionality, but direct remote-to-shell execution is not the minimum-risk method required to install it. ### Attack Path 1. The Skill determines that Aliyun CLI is absent or older than version 3.3.3. 2. The Skill executes the documented `curl` pipeline. 3. An upstream compromise causes `setup.sh` to contain attacker-controlled commands. 4. Bash executes those commands immediately without local verification. 5. The payload operates with the privileges and environment of the user running the Skill. ### Impact Assessment A succe ...[truncated 431 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:46

Finding

Mandatory Global Automatic Plugin Installation and Unpinned Updates

Content

View full analysis

Then **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > Then **[MUST]** run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date. ``` ### Technical Analysis The Skill mandates a persistent global configuration change that enables automatic plugin installation. It then updates every existing Aliyun CLI plugin rather than installing only the GPDB functionality needed by this Skill. No plugin versions are pinned, and the instructions specify no checksum, signature, provenance, or compatibility verification. Consequently, the components executed by the CLI can change independently of the audited Skill package. Updating unrelated plugins also exceeds the minimum scope needed for ADBPG knowledge-base operations. ### Attack Path 1. The Skill enables automatic plugin installation in the user's Aliyun CLI configuration. 2. It invokes a global plugin update. 3. The CLI retrieves current plugin releases from its configured distribution source. 4. A compromised or unsafe plugin release is installed. 5. The affected plugin executes later in the context of the credentialed Aliyun CLI process. ### Impact Assessment A compromised plugin could execute code with the local user's privileges and operate in a process that has access to the user's Alibaba Cloud credential chain. The global update can also modify unrelated plugins, introducing compatibility failures or security regressions outside the declared ADBPG workflow. The persistent auto-install setting broadens the exposure beyond a single Skill invocation because future CLI commands may install additional mutable components automatically. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:95

Finding

Database Passwords Collected in Conversation and Passed as Command-Line Arguments

Content

View full analysis

**Documentation placeholders:** CLI examples use strings like `` and ``. Replace them with real values from the user; **never** commit or log real passwords in docs, tickets, or chat. ``` ```bash aliyun gpdb create-document-collection \ --biz-region-id cn-hangzhou \ --db-instance-id gp-xxxxx \ --manager-account admin_user \ --manager-account-password '' \ --namespace ns_my_knowledge_base \ --collection my_knowledge_base \ --embedding-model text-embedding-v4 \ --dimension 1024 \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-knowledgebase-ops \ --ConnectTimeout 10 \ --ReadTimeout 10 ``` ### Technical Analysis The interaction guidelines direct the agent to collect manager and namespace passwords through free-form text conversation. The main Skill then directs replacement of placeholders with real user values in command-line parameters. This design conflicts with the instruction not to log passwords. A secret entered into conversation can be retained in conversation history or platform telemetry. Once substituted into a command, it can also be exposed through shell history, command auditing, process inspection, debugging output, or automation logs. Shell quoting reduces command interpretation risk but does not p ...[truncated 1047 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/upload_document_local.py:172

Finding

User-Controlled API Endpoint Can Receive a Local Document and Namespace Password

Content

View full analysis

str | None: if not value or len(value) > _MAX_ENDPOINT_LEN: return "--endpoint invalid length." if not _ENDPOINT_RE.match(value): return "--endpoint must be a hostname (letters, digits, dots, hyphens)." return None ``` ```python def build_client(region_id: str, endpoint: str) -> Client: return Client( Config( credential=CredentialClient(), region_id=region_id, endpoint=endpoint, connect_timeout=DEFAULT_TIMEOUT_MS, read_timeout=DEFAULT_TIMEOUT_MS, user_agent=USER_AGENT, ) ) ``` ```python parser.add_argument("--endpoint", default="gpdb.aliyuncs.com") ``` ```python client = build_client(args.region_id, args.endpoint) with open(path, "rb") as fh: request = models.UploadDocumentAsyncAdvanceRequest( region_id=args.region_id, dbinstance_id=args.db_instance_id, namespace=args.namespace, namespace_password=args.namespace_password, collection=args.collection, file_name=os.path.basename(path), file_url_object=fh, document_loader_name=args.document_loader_name, chunk_size=args.chunk_size, chunk_overlap=args.chunk_overlap, ) runtime = RuntimeOptions( connect_timeout=DEFAULT_TIMEOUT_MS, read_timeout=DEFAULT_TIMEOUT_MS, ) response = client.upload_document_async_advance(request, runtime) ``` ### Technical Analysis The script permits callers to replace the Alibaba Cloud endpoint with any syntactically valid hostname. Validation only checks hostname characters and ...[truncated 1723 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (23)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill instructs users to execute a remote installer via curl ... | bash, which runs network-fetched code without prior integrity verification or review. In a security-sensitive skill that also manages cloud credentials and encourages plugin updates, this materially increases the risk of supply-chain compromise, arbitrary code execution, and credential theft on the operator's machine.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

> **Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions.
> Then **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> Then **[MUST]** run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The skill instructs users to execute a remote installation script directly via curl ... | bash, which allows arbitrary code from an external server to run immediately in the user's shell without prior verification. In this skill's context, that risk is amplified because the same workflow later enables auto-plugin installation and performs cloud-authenticated operations, increasing the blast radius if the fetched script or delivery path is compromised.

Content

Scanner excerpt · references/SKILL.zh-CN.md (reported line 46)May include surrounding context.

md

> **Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see [cli-installation-guide.md](cli-installation-guide.md) for installation instructions.
> Then **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> Then **[MUST]** run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

These instructions direct collection of account and namespace passwords in conversation for later operational use, creating unnecessary exposure of reusable secrets. In the context of a cloud database management skill, compromise of these credentials could enable unauthorized access to the database instance, knowledge bases, and associated data operations.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The session-memory instruction tells the agent to remember sensitive parameters including manager and namespace passwords for reuse, which materially increases the blast radius of any prompt leak, logging exposure, tool misuse, or accidental disclosure later in the session. Persisting reusable secrets in agent memory is especially dangerous in a skill that performs administrative cloud and data operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest trigger list includes generic terms such as "knowledge base," "document upload," "knowledge search," and especially "Q&A" and "embedding," which are broad enough to overlap with many ordinary user requests. The description does not provide activation constraints, exclusions, or negative examples to clarify when this skill should or should not activate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

该 markdown 文件的触发词包含“知识库”“问答”等高频、泛化的自然语言表达，缺少更明确的上下文约束或排除条件。这类词汇容易与普通对话重叠，增加非预期调用该技能的风险。

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 41)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 56)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 69)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 82)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 129)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 415)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/interaction-guidelines.md (reported line 19)May include surrounding context.

md

| Scenario | Usage |
|----------|-------|
| Chunking strategy selection (General/Technical/FAQ/Legal) | AskUserQuestion |
| Yes/No confirmation | AskUserQuestion |
| Guiding when user intent is unclear | AskUserQuestion |
| File paths, URLs, passwords, instance IDs, knowledge base names | **Collect via text conversation**, not AskUserQuestion |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to collect manager and namespace passwords through plain text conversation, which is an unsafe channel for secrets because prompts, transcripts, logs, and memory may retain them. Although there is a later note to remind users about security, the collection pattern itself lacks a safe secret-entry mechanism and exposes highly sensitive credentials.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/interaction-guidelines.md (reported line 95)May include surrounding context.

md

## Best Practices

1. **Focus on user goals**, don't expose underlying concepts (namespaces, vector dimensions, HNSW params, etc.) unless user asks
2. **Execute query operations directly** without confirmation
3. **Show key parameters for modification operations** and confirm before execution, don't show all parameters
5. **Execute in sequence when creating knowledge base**: InitVectorDatabase → CreateNamespace → CreateDocumentCollection; **duplicate creates return explicit errors**—handle per [SKILL.md](../SKILL.md) **Create Knowledge Base** pre-checks (not silent idempotency); keep transparent to the user where possible
6. **Collect namespace password when creating knowledge base**, needed for upload/search/Q&A later, don't wait to ask

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guidance explicitly expands this skill from knowledge-base management into infrastructure provisioning by directing the agent to locate and invoke another skill to create ADBPG instances automatically. That broadens authority and side effects beyond the declared scope, increasing the chance of unexpected resource creation, cost impact, and cross-skill privilege misuse without sufficiently explicit user approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The file lists upload-document-async and later documents --file-name and --file-url, indicating the skill can transmit user-provided document content to a remote service. The markdown does not warn users that uploaded files or referenced URLs may contain sensitive data or that content is sent to external infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file documents --manager-account-password and --namespace-password as CLI parameters, which implies users may pass secrets on the command line. Command-line secrets can be exposed through shell history, process listings, or logs, but the document provides no warning or safer usage guidance.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/related-apis.md (reported line 130)May include surrounding context.

md

## Reference Documentation

- [ADBPG OpenAPI Documentation](https://api.aliyun.com/product/gpdb)
- [ADBPG Knowledge Base API Reference](https://help.aliyun.com/zh/analyticdb-for-postgresql/developer-reference/api-reference)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The verification examples place manager and namespace passwords directly on the command line, which can expose secrets through shell history, process listings, terminal logging, CI logs, or shared session capture. In a cloud database administration skill, these credentials are high-value and could enable unauthorized access or destructive operations if leaked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The upload example instructs users to provide an external file URL without warning that the service will fetch and ingest content from that remote location, which can unintentionally transmit sensitive document references or cause retrieval of untrusted content. In a knowledge-base/RAG context, document ingestion is a core operation, so lack of guidance about data provenance and exposure increases the risk of accidental data leakage or ingestion of malicious documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code reads a local file and sends it to Alibaba Cloud via upload_document_async_advance, but the CLI description and argument help do not explicitly warn that file contents will be transmitted to a remote knowledge base. Although uploading is the script's purpose, the code lacks any explicit disclosure about the privacy/data-handling impact of sending local document contents off-host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file contains a natural-language/config example that sets "language": "en" as part of the sample configuration. Under the policy, forcing a specific language without user opt-in can be a locale policy violation, and the guide does not mention that users may choose another language or that English is only an example.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.