Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly does what it says, but its setup and permission guidance could lead users to run unverified installer code and grant overly broad Alibaba Cloud access.
Review this skill before installing. Prefer a trusted package-manager or verified installer path for aliyun CLI, do not run the documented curl-to-bash command blindly, and avoid enabling automatic plugin installation unless you understand the source. Use a dedicated Alibaba Cloud RAM identity with bpstudio:ExecuteOperationSync plus only the read-only product policies needed for the architecture being drawn; avoid PowerUserAccess for routine use.
references/related-commands.md:10Remote installation script is downloaded and executed without verification
references/ram-policies.md:13PowerUserAccess recommendation violates least privilege for architecture drawing
The documentation instructs users to download a remote shell script and immediately execute it via a pipe to bash. This bypasses integrity verification and review, so a compromised CDN, DNS path, or upstream script could result in arbitrary code execution on the user's machine. In the context of an agent skill reference, this is more dangerous because operators may copy-paste setup commands directly to enable the skill quickly.
brew install aliyun-cli
# Universal
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash
# Post-install
aliyun configure set --auto-plugin-install true
Piping network-fetched content directly into bash is a classic command-chaining anti-pattern that turns any compromise of the fetched content into immediate shell execution. The risk is amplified by the installation context because users are likely to run the command with their own credentials and environment, potentially exposing local files, cloud credentials, or enabling persistence.
brew install aliyun-cli
# Universal
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash
# Post-install
aliyun configure set --auto-plugin-install true
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
If not met, see [`references/related-commands.md`](references/related-commands.md) § Installation.
> **Security**: NEVER read/echo AK/SK values, NEVER ask user to input credentials in conversation.
---
The document explicitly recommends attaching PowerUserAccess for a skill whose stated purpose is only architecture drawing. That grants broad cross-service privileges far beyond what is needed for a diagramming workflow and can normalize unnecessary overprivilege, increasing blast radius if the agent, user environment, or downstream backend is compromised.
The recommendation to attach PowerUserAccess is paired with only a terse 'Medium' label and language framing it as the recommended path, without a clear warning that it provides extensive non-IAM access across the account. That presentation understates the security consequences and makes unsafe privilege escalation more likely in routine use.
The guidance states that because drawing may involve any Alibaba Cloud product, PowerUserAccess is the pragmatic choice, which normalizes broad cross-product access unrelated to a narrow user task. In a documentation-driven workflow, this can pressure operators to overgrant permissions permanently rather than constrain access to the actual resources being modeled.