T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/ram-policies.md:37- Finding
Overprivileged Alibaba Cloud Access Policies
- Content
View full analysis
- Remediation
View remediation
Security audit
Alibabacloud Bailian Videoanalysis
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to do the promised Alibaba Cloud video analysis, but its setup guidance asks for overly broad cloud access and risky credential/CLI configuration.
Review before installing. Use a dedicated least-privilege RAM user or role, restrict OSS access to one approved bucket and /temp/quanmiao/ prefix, avoid FullAccess policies, do not enter access keys into agent-visible commands or logs, prefer short-lived credentials, and be aware that local videos are uploaded to Alibaba Cloud for processing.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
references/cli-installation-guide.md:99- Finding
Access Keys Are Recommended as Command-Line Arguments
- Content
View full analysis
\ --access-key-secret \ --region cn-hangzhou ``` The guide immediately reinforces this approach: ```markdown All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` Additional examples at lines 115-148 use the same command-line pattern for long-lived access keys and STS credentials. ### Technical Analysis Passing an access-key secret on a command line can expose it through: - Shell history. - CI/CD command logs. - Agent transcripts or tool-call records. - Process-list inspection while the command is running. - Terminal recording and audit systems. - Error-reporting or command telemetry. This guidance directly conflicts with `SKILL.md:97-100`, which states that the Skill must never ask for access keys in conversation or use `aliyun configure set` with literal credential values. The values shown in the guide are placeholders rather than confirmed live credentials. The vulnerability is the recommended handling method, which encourages users to substitute real secrets into an observable command. ### Attack Path 1. A user follows the installation guide and replaces the placeholders with real access-key values. 2. The command is executed in a shell, CI job, or agent-controlled terminal. 3. The complete command is retained in shell history, logs, transcripts, or process metadata. 4. Another local user, log reader, CI administrator, compromised dependency, or support-system operator obtains the secret. 5. The exposed credentials are used against Alibaba Cloud APIs until they are revoked or expire. 6. If the us ...[truncated 544 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
references/cli-installation-guide.md:38- Finding
Unverified Mutable CLI Binary Installation with Elevated Placement
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/requirements.txt:1- Finding
Unbounded Python SDK Dependency Version
- Content
View full analysis
=2.13.8 ``` ### Technical Analysis Four direct dependencies are pinned, but `alibabacloud-quanmiaolightapp20240801` accepts any version at or above `2.13.8`. Consequently, future installations may obtain code that was not part of this audit. No package hashes or complete transitive lockfile are supplied. Because the SDK executes in the same Python process as the Skill scripts, a compromised or unexpectedly changed release can access the default credential chain, API parameters, local result paths, and process environment. There is no evidence in the reviewed project that the named package is currently malicious. The vulnerability is the lack of reproducible, integrity-verified dependency resolution. ### Attack Path 1. A malicious or compromised future SDK release is published under the accepted package name and version range. 2. A user runs the documented `pip install -r scripts/requirements.txt`. 3. The package resolver selects the newer release because it satisfies `>=2.13.8`. 4. Package installation or import executes attacker-controlled code. 5. That code reads available process data or credential providers and performs unauthorized local or cloud actions. ### Impact Assessment Malicious dependency code would run with the privileges of the Python interpreter. It could access user-readable files, the selected video and analysis results, environment variables, and Alibaba Cloud credentials exposed through the default credential chain. Cloud impact would be bounded by the RAM permissions of the configured identity, which may be extensive if the recommended full-access policies were granted. ...[truncated 3 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (33)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared purpose says this skill analyzes videos through Bailian/QuanMiaoLightApp and lists specific analysis-related triggers and required API actions. However, the supplied code chunk performs only dependency and credential checks. It does not submit or retrieve video analysis tasks, does not process video inputs, and does not interact with any video-analysis API endpoint. While environment checking could be a supporting utility, this chunk by itself materially differs from the declared primary purpose, so it should be flagged as a mismatch.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill description explains architecture but does not prominently warn users that local videos may be uploaded to OSS and then analyzed by external cloud services. This is a meaningful privacy and data-handling issue because users may provide sensitive local media without informed consent about off-device transfer and storage.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
The cleanup step includes a parameterized delete command against OSS:
rm oss://{oss_bucket}/{oss_object_key}. If those parameters are influenced incorrectly, omitted, or broadened, the skill could delete unintended cloud objects, causing irreversible data loss; this is especially sensitive because shell-based destructive commands are being recommended directly.- Content
Delete uploaded OSS objects:
bash aliyun ossutil rm oss://{oss_bucket}/{oss_object_key} --user-agent AlibabaCloud-Agent-Skills/alibabacloud-bailian-videoanalysisCleanup best practices:
Scope Creep
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The permission guidance introduces broader access than the declared baseline by adding OSS and ModelStudio permissions not reflected in the stated required product/actions. In a skill that may handle local or remote videos, unnecessary OSS permissions are especially risky because they can enable listing, copying, downloading, or exposing stored media beyond the narrow task of submitting and retrieving analysis jobs.
- Content
Scope Creep
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Recommending full-access system policies such as AliyunBailianFullAccess, AliyunQuanMiaoLightAppFullAccess, and AliyunOSSFullAccess grants far more privilege than this skill's narrowly described video-analysis workflow requires. This is dangerous because it normalizes over-privileged deployment and could expose unrelated cloud resources, stored videos, and broader service capabilities if the skill, operator, or credentials are abused.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | `aliyun ossutil ls` | List OSS buckets | | `aliyun ossutil cp <local-file> oss://<bucket>/<key>` | Upload file to OSS | | `aliyun ossutil sign oss://<bucket>/<key> --expires-duration 2h` | Generate temporary URL | | `aliyun ossutil rm oss://<bucket>/<key>` | Delete uploaded OSS object (cleanup) | ## Execution Order
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill clearly instructs the agent to run shell commands, upload files to OSS, write result files, and delete cloud objects, yet it declares no explicit tool scope such as allowed-tools or permissions. That creates a hidden capability gap where a caller may not realize the skill can execute commands and modify local/cloud state, increasing the risk of unsafe invocation and poor policy enforcement.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list contains broad natural-language phrases like 'analyze video', 'summarize this video', and 'what is this video about', which could match ordinary conversation and invoke cloud actions unexpectedly. In this skill, accidental invocation is more dangerous because execution may enumerate workspaces, upload local files to OSS, and send content to external APIs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill mandates a detection priority that falls back to a default of Chinese for all user-facing messages. This imposes a locale choice on the user when language cannot be inferred, without offering explicit opt-in or an interactive language choice.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 83% confidence
- Finding
The instruction to auto-fetch available workspaces and default to the first one reduces user control over which cloud workspace is used. In a multi-tenant or multi-project environment, this can lead to processing data in the wrong workspace, exposing metadata or causing cross-project operational mistakes.
- Content
Step 2: Get Workspace ID
Do not ask the user for workspace_id upfront. Always auto-fetch available workspaces first:
bash aliyun modelstudio list-workspaces --user-agent AlibabaCloud-Agent-Skills/alibabacloud-bailian-videoanalysis
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
❌ INCORRECT
bash # Assuming a specific workspace_id without checking python scripts/quanmiao_submit_videoAnalysis_task.py --workspace_id llm-known-good --file_url ...- Always fetch workspaces via step 4 first; default to the first result or present a selection list if the user explicitly asks to choose
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
❌ INCORRECT
bash # Assuming a specific workspace_id without checking python scripts/quanmiao_submit_videoAnalysis_task.py --workspace_id llm-known-good --file_url ...- Always fetch workspaces via step 4 first; default to the first result or present a selection list if the user explicitly asks to choose
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This file is a broad Alibaba Cloud CLI administration guide embedded in a skill whose declared scope is Bailian video analysis via QuanMiaoLightApp only. Including unrelated installation, authentication, ECS, RAM, and plugin workflows materially expands the operational scope an agent or user may follow, increasing the chance of unauthorized or unnecessary cloud actions outside the skill’s intended boundary.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guide explicitly instructs users to enable automatic plugin installation and frames this as necessary for the full plugin ecosystem, even though the skill metadata forbids use of other products for video analysis. Auto-installing plugins changes CLI behavior to fetch and install additional code/components on demand, which broadens attack surface and undermines the skill’s stated product restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction to run 'aliyun configure set --auto-plugin-install true' omits an immediate warning that future CLI operations may automatically download and install plugins. That lack of disclosure is dangerous because it alters execution behavior and trust boundaries in a way users may not expect, especially inside an agent skill where minimizing side effects is important.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz
Move to PATH
sudo mv aliyun /usr/local/bin/
Verify
aliyun version
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz
Move to PATH
sudo mv aliyun /usr/local/bin/
Verify
aliyun version
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz
Move to PATH
sudo mv aliyun /usr/local/bin/
Verify
aliyun version
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz
Move to PATH
sudo mv aliyun /usr/local/bin/
Verify
aliyun version
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The quick-start commands encourage users to provide access keys directly to 'aliyun configure set' without warning at the point of use that these credentials will be persisted to '~/.aliyun/config.json'. In agent-driven or shared environments, silently storing long-lived secrets on disk increases the risk of credential exposure, reuse, or accidental inclusion in backups and images.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md **Where to Get Access Keys** 1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once ### Configuration Modes Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
7. Secure Config File
bash # Restrict permissions chmod 600 ~/.aliyun/config.jsonTroubleshooting
Issue: Command Not Found
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The next-steps section tells users to install and explore unrelated service plugins such as ECS, VPC, RDS, and FC. In the context of a Bailian-only video-analysis skill, this encourages capability drift into broader cloud administration and can lead agents or operators to invoke services well beyond intended permissions or review scope.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill manifest says it only requires QuanMiaoLightApp video-analysis actions, but this document expands the required permissions to include ModelStudio and broad OSS operations. That creates a permission scope mismatch and can pressure users into granting capabilities unrelated to the declared function, increasing the blast radius if the skill is misused or compromised.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill is described as a Bailian video analysis skill using QuanMiaoLightApp API, but this verification method instructs operators to interact with OSS for bucket enumeration, object upload, and URL signing. While obtaining a URL for video input can support analysis, listing buckets and performing storage-management steps are broader cloud-storage capabilities not clearly justified by the stated skill purpose.
- Content