Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this skill suspicious because its setup guidance includes risky installer and credential-handling practices, and scanners report possible behavior outside database management; some referenced content was only partially analyzed.
Consider the verdict's suspicious Review status before installing. In particular, avoid following the unverified downloaded-installer instructions or entering real secrets in command-line arguments, and review the credential-disclosure and out-of-scope inventory reports. The scan was partial: 10 of 12 components were fully inspected, two were partially inspected, and no components were entirely uninspected.
The supplied code exposes a cloud credential rather than performing a declared database-management operation. Using credentials for authentication could be a supporting implementation detail, but printing the secret is an undeclared disclosure capability. No network transmission is shown.
The commands target the ECS service, not a database service. ECS instance enumeration accesses resources outside the declared database-management scope. Selecting a CLI profile is a supporting implementation detail and is not independently a mismatch.
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
**Pre-check: Aliyun CLI >= 3.5.0 required**
> [MUST] Verify: `aliyun version` — must be >= 3.5.0 before using DAS. In an authorized setup step, an older CLI must first get one `aliyun upgrade --yes` attempt and a version recheck; report an environment error only if upgrade fails or the active version remains insufficient.
> - **First install or major upgrade:** `/bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh)"`
> - **Routine update (CLI >= 3.3.5):** `aliyun upgrade --yes` — prefer this built-in self-update over re-running the install script.
> - See `references/cli-installation-guide.md` for the official installation reference.
**Pre-check: Aliyun CLI plugin update required**
Referenced artifact was not completely inspected
> - See `references/cli-installation-guide.md` for the official installation reference.
Referenced artifact was not completely inspected
| [references/cli-installation-guide.md](references/cli-installation-guide.md) | CLI, plugin, jq, and credential setup |
Referenced artifact was not completely inspected
5. Use `scripts/call_apsaradb_agent.sh` for every agent request, directly or through the local job tool. Inject the scoped session/version environment values; t
Referenced artifact was not completely inspected
bash scripts/call_apsaradb_agent.sh \
Referenced artifact was not completely inspected
bash scripts/call_apsaradb_agent.sh \
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
aliyun version
### Self-Update (CLI >= 3.3.5)
Once the CLI is at version 3.3.5 or newer, routine updates can use the built-in self-update subcommand instead of re-running the install script:
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Once the CLI is at version 3.3.5 or newer, routine updates can use the built-in self-update subcommand instead of re-running the install script:
aliyun upgrade --yes
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
exit 1
fi
printf '[Setup] CLI %s is below 3.5.0; attempting aliyun upgrade --yes.\n' "$cli_version"
# Use the official self-update through PATH; do not bypass platform wrappers.
# No sudo, identity changes, alternate binary or repeated upgrade attempts.
if aliyun upgrade --yes </dev/null; then
hash -r
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
D` for related follow-ups; it is distinct from `SKILL_SESSION_ID`.
6. Prefer the matching product source below: PolarDB MySQL uses `polardb-console`, Tair/Redis uses `tair-console`, and RDS uses `yaochi-console`. Keep related follow-ups on the same source; never invent a route or use an unrelated product route to bypass throttling.
7. Answer in the user's language with the business conclusion, evidence, and limitations, then finish. A plan-only request ends with its plan and verification steps, without asking whether to execute it now. A request to list missing target information ends with that checklist; do not invent a target or wait for optional input to complete the checklist. A report file supplements this answer; a file list alone does not complete the task. Ask only for indispensable missing input, following the authentication and permission gates above.
8. In platform evaluation environments, preserve the platform's execution mode. If `ALIBABA_CLOUD_CLI_MOCK` is enabled, identi
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
usible interpretation. Confirm migration/online-expansion support for the actual engine, edition and storage type before making it the basis of a mandatory recommendation. If it remains unverified, put that condition directly on the recommendation, including priority tables, rather than only in a later caveat. Distinguish illustrative change windows and estimates from verified interruption guarantees; present no exact outage bound without applicable evidence. Provide a complete conditional plan without asking for approval to execute it.
Once the requested findings or plan are ready, return them directly and stop. Do not ask whether to execute a proposal the user only asked to review, offer another optional task as a question, or suspend the answer for deleting, renaming, comparing, or reorganizing report files. Leave duplicate or unfamiliar artifacts intact, identify the complete report if relevant, and finish the business answer. Lack of optional evidence is a stated limitation, not
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Readonly task completion
- Correct: return the requested analysis or capacity plan with evidence and unavailable-data caveats, then stop. Keep duplicate or unfamiliar output files intact and identify the complete report without asking the user to organize artifacts.
- Incorrect: finish with only a file list, ask whether to execute a proposal when only advice was requested, or block completion on deleting/renaming a report.
- Correct: a failed partial response retains its actual conversation UUID and is labeled incomplete; any focused continuation stays readonly and uses that same UUID.
- Incorrect: equate a returned SessionID or partial answer with successful completion, or fabricate an ID to recover a failed request.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
ir, a PolarDB backup, and enabling PolarDB deletion protection. Before preparing one of these plans, read the operation contract below for the exact API and argument names; do not infer write parameters from readonly response fields. See [the operation contract](references/related-commands.md#confirming-an-operation) for the exact allowed arguments and the corresponding readonly verification.
Decline destructive and very high-risk operations, even if the service offers them or the user asks to skip approval: deleting databases, clusters or nodes; dropping or truncating data; releasing resources; disabling deletion protection; and changing passwords, privileges or public access. Plan-only scenarios include instance provisioning, orders, resizing and other changes outside the execution contract. Do not substitute direct product writes, SQL or generic RPC.
Classify forbidden operations separately from permitted plan-only scenarios: procurement and resizing may receive a plan; destructiv
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### Cross-region and cross-product inventory
An explicit request for “all regions” confirms that scope; do not ask the user to pick one region or silently substitute the CLI profile's region. The DAS endpoint is the agent service endpoint, not the target resource region. Ask the remote agent to enumerate accessible regions and paginate results, and report the regions actually covered. A permission error or an unsupported region is a coverage gap, not an empty region.
Scope completeness claims to the current identity, the enumerated regions and the sources actually queried. Agreement between product inventories and a resource index is corroboration, not proof that permission-invisible or unindexed resources cannot exist. If a billing or other source contains extra resource IDs, keep unresolved differences explicit: a bounded sample does not classify every unmatched ID, and a NotFound response alone does not prove deletion or exclude an endpoint, region or visibility mismatch. Do not
The recommended command immediately executes mutable network content without inspecting it or verifying an independently trusted signature or digest. HTTPS protects transport but does not prevent compromised release infrastructure from supplying code that could access local cloud credentials.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
x86_64
wget --connect-timeout=10 --read-timeout=120 --tries=3 -qO- https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz
sudo mv aliyun /usr/local/bin/
ARM64
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
ARM64
wget --connect-timeout=10 --read-timeout=120 --tries=3 -qO- https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz | tar xz
sudo mv aliyun /usr/local/bin/
The guide recommends substituting real access-key secrets into command-line arguments, which can expose them through shell history, process inspection, and automation logs. The placeholders are not leaked credentials themselves, but following this recommendation can disclose credentials with substantial cloud-account privileges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Follow the mandatory permission-failure workflow in [SKILL.md](../SKILL.md#ram-policy).
Report the returned action and request ID when available. Never ask the user to paste an AccessKey, secret, or STS token.
For `Forbidden.RAM` without an action, verify `hdm:GetYaoChiAgent` first, then check read permissions for the target database product.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
succeeded. Read the original stream to its terminal event and verify the
resource state with a separate readonly request.
[Official DAS OpenAPI catalog](https://api.aliyun.com/document/DAS)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
save(job, "status.json", result)
if prepare:
with (job / "setup.stdout").open("wb") as out, (job / "setup.stderr").open("wb") as err:
code = subprocess.run(
["bash", str(SCRIPTS / "prepare_apsaradb_agent.sh")],
stdin=subprocess.DEVNULL, stdout=out, stderr=err, check=False,
).returncode
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
result.update(phase="agent", query_started_at=now())
save(job, "status.json", result)
with query.open("rb") as inp, (job / "stdout").open("wb") as out, (job / "stderr").open("wb") as err:
code = subprocess.run(
["bash", str(SCRIPTS / "call_apsaradb_agent.sh"), "-", *options],
stdin=inp, stdout=out, stderr=err, check=False,
).returncode