Alibabacloud Apigw Inspection

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:04 AM UTC
• Version: 0.0.1

Overview

The skill’s read-only gateway inspection goal is coherent, but its setup instructions can install or update mutable executable components without strong user control or integrity checks.

Install only after reviewing and controlling setup yourself: prefer vendor package managers or pinned, verified Aliyun CLI and plugin versions, avoid curl-to-bash and automatic plugin updates, use a least-privilege read-only RAM identity, and do not paste access keys into agent-visible commands or logs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:42

Finding

Mutable Remote Installation Script Is Piped Directly into Bash

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:21

Finding

Mutable “Latest” CLI Binaries Are Installed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:53

Finding

Automatic and Unconditional Plugin Installation Creates Executable Supply-Chain Exposure

Content

View full analysis

[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ``` ```text > **[MUST] Plugin Mode Only:** > All commands in this skill MUST be executed using CLI plugin mode. Traditional API format (PascalCase action names) is NOT allowed. > If the plugin is not installed, run `aliyun plugin install --names apig` to install it, then retry. ``` ```text 1. **Plugin Mode Only**: All commands MUST be executed using `aliyun` CLI plugin mode. Traditional API format (PascalCase action names) is NOT allowed. If a required plugin is not installed, run `aliyun plugin install --names ` to install it first. ``` ### Technical Analysis The Skill mandates enabling automatic plugin installation and updating all existing plugins. No plugin versions, package digests, signatures, or approved dependency manifests are specified. Plugins are executable components loaded into an authenticated cloud-management workflow. Automatically retrieving or updating them allows the code executed by the Skill to change independently of the audited project. Updating every existing plugin also exceeds the minimum necessary behavior: the declared inspection workflow only needs the specific `apig`, `cms`, or `cloudapi` functionality relevant to the selected product. This does not prove that the current Alibaba Cloud plugin repository is malicious. The vulnerability is the lack of version and integrity controls combined with mandatory automatic execution of mutable dependencies. ### Attack Path 1. An attacker compromises a plugin repository, plugin publisher, ...[truncated 1133 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:102

Finding

Credential Configuration Examples Expose Secrets Through Command-Line Arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` ```bash aliyun configure set \ --mode StsToken \ --access-key-id \ --access-key-secret \ --sts-token \ --region cn-hangzhou ``` ```bash aliyun configure set \ --mode RamRoleArn \ --access-key-id \ --access-key-secret \ --ram-role-arn acs:ram:::role/ \ --role-session-name my-session \ --region cn-hangzhou ``` The guide further states: ```text All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` ### Technical Analysis The examples contain placeholders rather than live credentials, so no hardcoded secret was found in the project. However, the guide recommends substituting credentials into command-line flags and presents non-interactive flags as the recommended automation approach. When users replace the placeholders with actual values, secrets can be exposed through: - Shell history. - CI/CD command logs. - Process monitoring or telemetry. - Debugging and audit records. - Error reports that capture the invoked command. This guidance also conflicts with the stronger rules in `SKILL.md`, which prohibit asking users to enter AK/SK values directly in conversation or command lines and prohibit using `aliyun configure set` with literal credential values. ### Attack Path 1. A user follows the configuration guide and replaces placeholder ...[truncated 1084 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (10)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to execute a remote script fetched over the network directly into bash. This is a classic supply-chain and remote-code-execution risk because the downloaded content is not pinned, verified, or reviewed before execution, and the skill context normalizes running it as part of setup.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

text

- **Linux / macOS (binary)**:
  ```bash
  curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

• Windows (PowerShell):

  powershell

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The pipe into bash creates an execution chain where untrusted network content is immediately run in the shell. This removes opportunities for inspection and makes compromise of the download endpoint, CDN, or transport path directly result in command execution on the host.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

text

- **Linux / macOS (binary)**:
  ```bash
  curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

• Windows (PowerShell):

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger scenarios include generic phrases like "how is the gateway performing", "check if the gateway has any anomalies", and "check gateway health status". These are broad natural-language requests without explicit scope constraints or exclusion conditions, increasing the risk that the skill activates for general troubleshooting requests beyond this specific Alibaba Cloud inspection workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill requires enabling auto-plugin installation and updating plugins as a prerequisite for a read-only inspection workflow. That expands the skill from gateway monitoring into software/package management, which increases supply-chain and environment-modification risk beyond what is necessary for the stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Mandating plugin installation during execution causes the skill to alter the local toolchain in order to complete a monitoring task. Even if the plugin is legitimate, this unnecessarily broadens permissions and creates opportunities for unreviewed code installation or unexpected side effects on the host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The best-practices section authorizes installing any 'required plugin', which is overly broad and not constrained to the minimum functionality needed for this skill. In an agent context, that instruction can be abused to justify arbitrary environment changes unrelated to gateway inspection.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 406)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill links users to help.aliyun.com/zh/... documentation pages, which imposes a Chinese-language locale by default. There is no indication that the user can choose another language or that the Chinese locale is required for a region-specific compliance reason.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file applies to SQP-3, which covers natural-language policy violations such as forcing a specific language without user opt-in. The sample config sets "language": "en" as the stored profile value, but the guide does not explain that this is only an example or mention how users can choose another language.

Content

No source excerpt is available for this finding.