alibabacloud-bailian-memory

• Outcome: Review
• Latest audit: Aug 19, 2026 · 10:06 AM UTC
• Version: 0.0.1

Overview

The skill is a coherent Alibaba Cloud memory tool, but normal use can automatically install a CLI plugin and create persistent cloud API keys without a separate approval gate.

Install only if you are comfortable letting this skill use Alibaba Cloud/DashScope credentials and potentially bootstrap them. Prefer configuring a least-privilege DASHSCOPE_API_KEY manually before use, review ~/.aliyun/config.json handling, and avoid the automatic CLI plugin/key creation path unless you explicitly want it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence

Findings (14)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""Auto-install ModelStudio plugin if missing."""
    try:
        print("Installing ModelStudio plugin...", file=sys.stderr)
        result = subprocess.run(
            ["aliyun", "plugin", "install",
             "--names", "aliyun-cli-modelstudio", "--enable-pre"],
            capture_output=True,

• Confidence: 94% confidence
• Finding: This code automatically installs a CLI plugin on the host, which modifies the local system and expands the skill's capabilities beyond memory operations. In an agent context, silent software installation is dangerous because it changes the execution environment without explicit user consent and increases supply-chain and privilege risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

workspace_id = _get_workspace_id()

    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "create-api-key",
             "--region", "cn-beijing",
             "--workspace-id", workspace_id,

• Confidence: 95% confidence
• Finding: This subprocess creates a real cloud API key through the CLI, which is a privileged credential-management action outside the manifest's stated memory-library behavior. In an agent skill, creating credentials automatically can expand access, create billable resources, and leave persistent secrets on disk without explicit authorization.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

}

    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "delete-api-key",
             "--region", "cn-beijing",
             "--api-key-id", api_key_id,

• Confidence: 93% confidence
• Finding: This subprocess deletes cloud API keys, a destructive credential-management action that exceeds the skill's declared memory-management scope. If triggered unexpectedly, it can revoke service access and cause denial of service or operational disruption for the user's environment.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly instructs the agent to execute Python scripts, read environment/configured credentials, perform file operations, invoke shell commands, and make outbound network calls, yet it declares no permissions. This creates a capability-transparency gap: a caller or policy layer cannot accurately constrain or review what the skill can do, increasing the chance of unauthorized execution in sensitive environments.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is memory-library management, but the skill also references API key generation, CLI plugin installation, workspace discovery, local credential storage in ~/.aliyun/config.json, and cloud-side key lifecycle operations. That expands the trust boundary from application-level memory operations into credential provisioning and host configuration changes, which can expose secrets or alter the local environment in ways the user did not expect.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The module can install the ModelStudio plugin automatically, which adds software installation capability not disclosed in the skill's manifest. In an agent setting, hidden host modification is dangerous because users expect memory-library actions, not package management or environment changes.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The code creates and persists DashScope API keys, which is a sensitive credential-management capability not described in the skill metadata. This mismatch increases risk because users and orchestrators may grant or invoke the skill for memory tasks while it can actually mint long-lived secrets and store them locally.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The code deletes cloud API keys and local credential records, which is a destructive administrative function outside the declared memory/profile administration scope. In context, this is especially risky because the skill can affect account access and service continuity while presenting itself as a memory utility.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill automatically creates a cloud API key when none is found, without explicit user confirmation. In an agent environment this is unsafe because it provisions persistent credentials and changes account state as a side effect of a normal lookup path.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code auto-installs a plugin without prior warning or consent, modifying the host system as part of normal execution. Silent installation is especially dangerous in agent skills because it violates least surprise and broadens the attack surface through new software components.

Memory Manipulation

High

• Category: Memory Poisoning

Content

|------|-----------|----------------|
| 🟢 Read-only | search, list, get node, get event, get profile, list/get project, list schema | Execute directly, no confirmation needed |
| 🟡 Write | add (messages/content), update memory, profile value ops (add/update/delete item), create/update project, create/update schema | Show the content/values/settings to be written, then execute; for update ops, get/list current state first |
| 🔴 Destructive | delete memory | **Follow the mandatory delete flow below** |

### 🔴 Mandatory delete flow

• Confidence: 95% confidence
• Finding: The skill includes destructive memory deletion functionality, and the content itself acknowledges that deletion is irreversible and that the API does not verify user_id ownership. In a memory-management skill this capability is expected, but it is still security-relevant because a wrong memory_node_id can silently delete another user's or context's stored memory, causing permanent data loss or integrity damage.

Memory Manipulation

High

• Category: Memory Poisoning

Content

Output: `request_id`. `--meta-data` merges incrementally (unspecified keys remain unchanged).

### 8. Delete Memory (🔴)

Follow the mandatory delete flow in Security Tiers — get, confirm, delete, verify.

• Confidence: 95% confidence
• Finding: This workflow operationalizes destructive deletion of persisted memory records. Even with confirmation steps, the underlying action remains dangerous because the API semantics permit irreversible removal and the skill is designed to expose that operation to an agent, so misuse, prompt confusion, or identifier mix-ups can permanently destroy stored context.

Session Persistence

Medium

• Category: Rogue Agent

Content

def _write_aliyun_config(config: dict) -> None:
    """Write to the Alibaba Cloud CLI config file."""
    ALIYUN_CONFIG_DIR.mkdir(parents=True, exist_ok=True)
    with open(ALIYUN_CONFIG_FILE, 'w', encoding='utf-8') as f:
        json.dump(config, f, ensure_ascii=False, indent='\t')

• Confidence: 96% confidence
• Finding: The module writes API keys into ~/.aliyun/config.json, creating persistent local storage of sensitive credentials and session continuity beyond the immediate task. In a memory-focused skill, persistent credential storage increases blast radius if the host account is later compromised and is more dangerous because the skill also auto-creates those credentials.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.20.0

• Confidence: 94% confidence
• Finding: The dependency is specified as `requests>=2.20.0`, which is unpinned and allows installation of a wide range of versions depending on resolver behavior and environment state. This weakens build reproducibility and can unintentionally permit vulnerable or incompatible versions, which is especially risky in a skill that handles API keys, user profiles, and conversation memory over network requests.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/api_key.py:181