Alibabacloud Bailian Rag Knowledgebase

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 0.0.3

Overview

The skill performs the advertised Alibaba Cloud knowledge-base retrieval, but its normal setup path can install tooling and create, persist, or delete cloud API keys without a separate explicit approval step.

Review before installing. Use an existing least-privileged DASHSCOPE_API_KEY when possible, avoid granting CreateApiKey/DeleteApiKey unless you explicitly want the skill to manage credentials, and do not run it in an environment where automatic plugin installation or writes to ~/.aliyun/config.json are unacceptable.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/api_key.py:67

Finding

Automatic Installation of an Unpinned Pre-release CLI Plugin

Content

View full analysis

bool: """Check if Alibaba Cloud CLI and ModelStudio plugin are available, auto-install plugin if missing.""" if not _check_aliyun_binary(): return False try: result = subprocess.run( ["aliyun", "modelstudio", "version"], capture_output=True, text=True, timeout=5 ) if result.returncode == 0: return True except (subprocess.TimeoutExpired, FileNotFoundError): pass if not _install_modelstudio_plugin(): return False ``` ### Technical Analysis When the ModelStudio plugin is unavailable, the application automatically invokes the Alibaba Cloud CLI plugin installer. The plugin version is not pinned, no package checksum or signature is verified by the Skill, and `--enable-pre` explicitly permits pre-release components. Consequently, the code reviewed during the audit does not fully determine the code that will execute at runtime. The effective plugin implementation can change as remote releases change. Although no malicious plugin is included in this project, this installation pattern creates a supply-chain exposure because future, compromised, or unexpectedly modified plugin releases may execute under the Agent user's account. The behavior is particularly sensitive because the plugin subsequently interacts with existing Alibaba Cloud CLI credentials and performs API-key management o ...[truncated 1507 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/api_key.py:263

Finding

Retrieval Implicitly Creates Cloud Credentials and Modifies Sensitive Configuration

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/requirements.txt:1

Finding

Unpinned and Unhashed Python Dependencies

Content

View full analysis

=1.25.0,<2.0.0 requests>=2.28.0,<3.0.0 ``` ### Technical Analysis The requirements allow any future package release within broad major-version ranges and do not provide integrity hashes. A future installation can therefore resolve to direct or transitive dependency versions that were not included in this audit. Python package installation may execute package build or installation logic. If a permitted future release or one of its transitive dependencies is compromised, users installing this requirements file could execute attacker-controlled code. The current project scripts use Python standard-library HTTP functionality and do not import `dashscope` or `requests`. This makes the listed dependencies apparently unnecessary for the code reviewed and increases supply-chain exposure without providing a demonstrated runtime benefit. ### Attack Path 1. A user installs `scripts/requirements.txt` at a later date. 2. The package resolver selects the newest versions satisfying the broad ranges. 3. Those versions or their transitive dependencies may differ from the versions originally tested. 4. Package build, installation, or imported runtime code executes locally. 5. If a selected package release has been compromised, malicious code executes with the privileges of the user performing the installation or running the Skill. This is a conditional supply-chain path. No evidence was found that the currently named packages are malicious. ### Impact Assessment A compromised dependency could execute with the privileges of the installing or invoking user. Depending on the execution environment, it could potentially: - Read project and user files. - Access environment variables and locally stored credentials. - Modify user-level files. - Make network req ...[truncated 219 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is knowledge-base retrieval, but the skill also instructs credential discovery, credential creation/deletion, local config modification, CLI/plugin installation, and workspace enumeration. That mismatch is dangerous because users or orchestrators may grant trust appropriate for read-only retrieval while the skill actually enables privileged account and credential-management actions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill explicitly instructs automated retrieval of API keys from local config and environment variables and describes auto-creation of new keys if none are found. Even though it warns against printing secrets, this is still credential access behavior: the skill is designed to locate and use existing secrets and to mint new ones, increasing the blast radius if the skill is misused or compromised.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

- **Key retrieval is automated**: Scripts internally call `api_key.py` to automatically obtain keys from config files/environment variables. The Agent only needs to run the script command.
- **Never hardcode any form of key**: Including `api_key = "sk-..."`, `export DASHSCOPE_API_KEY="sk-..."`, and assigning keys in shell scripts.
- **Never extract keys from CLI output**: The Agent must not write key values into any script, variable, or file.
- **Never expose keys in any output**: Including generated scripts, shell commands, log files, and terminal output containing strings starting with `sk-`.
- **Never read or print keys from config files**: Do not use `cat`, `jq`, `python -c`, or other commands to read and output API Key values.
- **Mandatory self-check before task completion**: Run `grep -rn "sk-" <output_directory>/` to check all output files; if any strings starting with `sk-` are found (excluding `sk-xxx` placeholders), delete the affected files and regenerate.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code writes credentials into ~/.aliyun/config.json and later supports deleting them, which exceeds the stated retrieval-focused purpose. Persisting secrets in a shared CLI configuration can affect other tools and sessions and creates hidden cross-application state changes on the user's machine.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module executes Alibaba Cloud CLI commands and auto-installs a plugin, including a pre-release plugin, despite the skill being presented as a retrieval tool. This broadens the blast radius from API use to local system modification and third-party code installation, making the context significantly more dangerous than the manifest suggests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description says it retrieves knowledge-base content, but this module also creates and deletes cloud API keys and edits the user's Alibaba Cloud configuration. This scope mismatch is dangerous because users and orchestrators may grant access expecting read-oriented retrieval behavior, while the code performs privileged credential-management actions instead.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill describes and instructs execution of operations that require broad capabilities (shell, file read/write, environment access, and network) but does not declare an explicit tool/permission scope. This weakens least-privilege controls and makes it easier for an agent or runtime to invoke more powerful actions than users may expect, especially given the credential-management and CLI installation behaviors documented in the skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

- **Key retrieval is automated**: Scripts internally call `api_key.py` to automatically obtain keys from config files/environment variables. The Agent only needs to run the script command.
- **Never hardcode any form of key**: Including `api_key = "sk-..."`, `export DASHSCOPE_API_KEY="sk-..."`, and assigning keys in shell scripts.
- **Never extract keys from CLI output**: The Agent must not write key values into any script, variable, or file.
- **Never expose keys in any output**: Including generated scripts, shell commands, log files, and terminal output containing strings starting with `sk-`.
- **Never read or print keys from config files**: Do not use `cat`, `jq`, `python -c`, or other commands to read and output API Key values.
- **Mandatory self-check before task completion**: Run `grep -rn "sk-" <output_directory>/` to check all output files; if any strings starting with `sk-` are found (excluding `sk-xxx` placeholders), delete the affected files and regenerate.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill mandates a persistent session identifier in a fixed User-Agent for every CLI/API call without offering user opt-in or explaining retention/privacy implications. While intended for observability, this creates cross-request traceability that can facilitate activity correlation and profiling beyond what is necessary for simple retrieval.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The module persists session-relevant credential state to ~/.aliyun/config.json, creating durable effects beyond the current interaction. In context, persistence is more dangerous because the skill is advertised for retrieval, yet it leaves behind long-lived credentials and modifies shared account configuration that other tools may later consume.

Content

Scanner excerpt · scripts/api_key.py (reported line 44)May include surrounding context.

python

def _write_aliyun_config(config: dict) -> None:
    """Write to the Alibaba Cloud CLI config file."""
    ALIYUN_CONFIG_DIR.mkdir(parents=True, exist_ok=True)
    with open(ALIYUN_CONFIG_FILE, 'w', encoding='utf-8') as f:
        json.dump(config, f, ensure_ascii=False, indent='\t')

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/api_key.py (reported line 63)May include surrounding context.

python

def _check_aliyun_binary() -> bool:
    """Check if Alibaba Cloud CLI binary is installed."""
    try:
        result = subprocess.run(
            ["aliyun", "version"],
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

This code automatically installs a CLI plugin on the user's system, which is a side effect far beyond a knowledge-base retrieval skill. Even though arguments are fixed and shell injection is not present, silently modifying the local toolchain and enabling pre-release software expands trust boundaries and can execute unreviewed code on the host.

Content

Scanner excerpt · scripts/api_key.py (reported line 78)May include surrounding context.

python

"""Auto-install ModelStudio plugin if missing."""
    try:
        print("Installing ModelStudio plugin...", file=sys.stderr)
        result = subprocess.run(
            ["aliyun", "plugin", "install",
             "--names", "aliyun-cli-modelstudio", "--enable-pre"],
            capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/api_key.py (reported line 99)May include surrounding context.

python

if not _check_aliyun_binary():
        return False
    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "version"],
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/api_key.py (reported line 112)May include surrounding context.

python

if not _check_aliyun_binary():
        return False
    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "version"],
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/api_key.py (reported line 134)May include surrounding context.

python

RuntimeError: When unable to retrieve the workspace ID
    """
    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "list-workspaces",
             "--region", "cn-beijing",
             "--user-agent", _get_user_agent()],

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 93% confidence

Finding

This code creates a real cloud API key through the Alibaba CLI, causing credential provisioning as a side effect of using a retrieval skill. Creating new credentials without an explicit, informed user action materially increases risk because it expands account access surface and can persist secrets unexpectedly.

Content

Scanner excerpt · scripts/api_key.py (reported line 188)May include surrounding context.

python

workspace_id = _get_workspace_id()

    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "create-api-key",
             "--region", "cn-beijing",
             "--workspace-id", workspace_id,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

A function named to retrieve an API key will silently fall back to creating a new cloud API key if none exists. That hidden behavior violates least surprise and can mint new credentials without the operator understanding that a read operation actually performs privileged account mutation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This logic auto-creates and stores an API key without any explicit confirmation step from the user. In the context of a retrieval skill, silently provisioning and persisting credentials is especially risky because it can surprise users and leave long-lived access behind on disk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 88% confidence

Finding

This subprocess call deletes a cloud API key, which is a destructive account operation unrelated to simple knowledge-base retrieval. Even without injection, embedding credential deletion in the skill increases the chance of accidental or unauthorized service disruption.

Content

Scanner excerpt · scripts/api_key.py (reported line 377)May include surrounding context.

python

}

    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "delete-api-key",
             "--region", "cn-beijing",
             "--api-key-id", api_key_id,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This function deletes both the cloud API key and the local record without an explicit warning or confirmation prompt. Because deletion is destructive and may break other dependent workflows, executing it implicitly from a skill materially increases the risk of accidental denial of service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code retrieves an API key and sends the user's query and index identifier to an external HTTPS endpoint, but there is no confirmation prompt or user-facing notice in the script output about that data transmission. While the module docstring mentions an HTTPS API at a high level, it does not clearly warn the user at execution time that their query content will be transmitted to a remote service using credentials from the environment/helper.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code retrieves an API key and sends an authenticated HTTPS request to an external service, which is a safety-relevant network operation. While the module docstring says it queries the HTTPS API, there is no runtime confirmation, user-facing notice, or explicit warning about transmitting authenticated request metadata.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency specification for requests is only range-pinned (>=2.28.0,<3.0.0), so builds may resolve to different versions over time, including releases with known security advisories. In a network-facing knowledge-base retrieval skill that makes HTTPS requests and may handle API keys or credentials, leaving the exact installed version unverifiable increases supply-chain and exposure risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.