alibabacloud-bailian-memory

• Outcome: Review
• Latest audit: Aug 19, 2026 · 10:06 AM UTC
• Version: 0.0.1

Overview

The skill is a coherent Alibaba Cloud memory tool, but normal use can automatically install a CLI plugin and create persistent cloud API keys without a separate approval gate.

Install only if you are comfortable letting this skill use Alibaba Cloud/DashScope credentials and potentially bootstrap them. Prefer configuring a least-privilege DASHSCOPE_API_KEY manually before use, review ~/.aliyun/config.json handling, and avoid the automatic CLI plugin/key creation path unless you explicitly want it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence

Findings (14)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

This code automatically installs a CLI plugin on the host, which modifies the local system and expands the skill's capabilities beyond memory operations. In an agent context, silent software installation is dangerous because it changes the execution environment without explicit user consent and increases supply-chain and privilege risk.

Content

Scanner excerpt · scripts/api_key.py (reported line 78)May include surrounding context.

python

"""Auto-install ModelStudio plugin if missing."""
    try:
        print("Installing ModelStudio plugin...", file=sys.stderr)
        result = subprocess.run(
            ["aliyun", "plugin", "install",
             "--names", "aliyun-cli-modelstudio", "--enable-pre"],
            capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

This subprocess creates a real cloud API key through the CLI, which is a privileged credential-management action outside the manifest's stated memory-library behavior. In an agent skill, creating credentials automatically can expand access, create billable resources, and leave persistent secrets on disk without explicit authorization.

Content

Scanner excerpt · scripts/api_key.py (reported line 188)May include surrounding context.

python

workspace_id = _get_workspace_id()

    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "create-api-key",
             "--region", "cn-beijing",
             "--workspace-id", workspace_id,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 93% confidence

Finding

This subprocess deletes cloud API keys, a destructive credential-management action that exceeds the skill's declared memory-management scope. If triggered unexpectedly, it can revoke service access and cause denial of service or operational disruption for the user's environment.

Content

Scanner excerpt · scripts/api_key.py (reported line 377)May include surrounding context.

python

}

    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "delete-api-key",
             "--region", "cn-beijing",
             "--api-key-id", api_key_id,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill clearly instructs the agent to execute Python scripts, read environment/configured credentials, perform file operations, invoke shell commands, and make outbound network calls, yet it declares no permissions. This creates a capability-transparency gap: a caller or policy layer cannot accurately constrain or review what the skill can do, increasing the chance of unauthorized execution in sensitive environments.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared purpose is memory-library management, but the skill also references API key generation, CLI plugin installation, workspace discovery, local credential storage in ~/.aliyun/config.json, and cloud-side key lifecycle operations. That expands the trust boundary from application-level memory operations into credential provisioning and host configuration changes, which can expose secrets or alter the local environment in ways the user did not expect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module can install the ModelStudio plugin automatically, which adds software installation capability not disclosed in the skill's manifest. In an agent setting, hidden host modification is dangerous because users expect memory-library actions, not package management or environment changes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code creates and persists DashScope API keys, which is a sensitive credential-management capability not described in the skill metadata. This mismatch increases risk because users and orchestrators may grant or invoke the skill for memory tasks while it can actually mint long-lived secrets and store them locally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code deletes cloud API keys and local credential records, which is a destructive administrative function outside the declared memory/profile administration scope. In context, this is especially risky because the skill can affect account access and service continuity while presenting itself as a memory utility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill automatically creates a cloud API key when none is found, without explicit user confirmation. In an agent environment this is unsafe because it provisions persistent credentials and changes account state as a side effect of a normal lookup path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code auto-installs a plugin without prior warning or consent, modifying the host system as part of normal execution. Silent installation is especially dangerous in agent skills because it violates least surprise and broadens the attack surface through new software components.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 95% confidence

Finding

The skill includes destructive memory deletion functionality, and the content itself acknowledges that deletion is irreversible and that the API does not verify user_id ownership. In a memory-management skill this capability is expected, but it is still security-relevant because a wrong memory_node_id can silently delete another user's or context's stored memory, causing permanent data loss or integrity damage.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

|------|-----------|----------------|
| 🟢 Read-only | search, list, get node, get event, get profile, list/get project, list schema | Execute directly, no confirmation needed |
| 🟡 Write | add (messages/content), update memory, profile value ops (add/update/delete item), create/update project, create/update schema | Show the content/values/settings to be written, then execute; for update ops, get/list current state first |
| 🔴 Destructive | delete memory | **Follow the mandatory delete flow below** |

### 🔴 Mandatory delete flow

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 95% confidence

Finding

This workflow operationalizes destructive deletion of persisted memory records. Even with confirmation steps, the underlying action remains dangerous because the API semantics permit irreversible removal and the skill is designed to expose that operation to an agent, so misuse, prompt confusion, or identifier mix-ups can permanently destroy stored context.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

md

Output: `request_id`. `--meta-data` merges incrementally (unspecified keys remain unchanged).

### 8. Delete Memory (🔴)

Follow the mandatory delete flow in Security Tiers — get, confirm, delete, verify.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The module writes API keys into ~/.aliyun/config.json, creating persistent local storage of sensitive credentials and session continuity beyond the immediate task. In a memory-focused skill, persistent credential storage increases blast radius if the host account is later compromised and is more dangerous because the skill also auto-creates those credentials.

Content

Scanner excerpt · scripts/api_key.py (reported line 44)May include surrounding context.

python

def _write_aliyun_config(config: dict) -> None:
    """Write to the Alibaba Cloud CLI config file."""
    ALIYUN_CONFIG_DIR.mkdir(parents=True, exist_ok=True)
    with open(ALIYUN_CONFIG_FILE, 'w', encoding='utf-8') as f:
        json.dump(config, f, ensure_ascii=False, indent='\t')

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified as requests>=2.20.0, which is unpinned and allows installation of a wide range of versions depending on resolver behavior and environment state. This weakens build reproducibility and can unintentionally permit vulnerable or incompatible versions, which is especially risky in a skill that handles API keys, user profiles, and conversation memory over network requests.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.20.0

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/api_key.py:181