T03 · Remote Payload Retrieval and Execution
Error
- Location
references/cli-installation-guide.md:11- Finding
Unverified Remote Installer Is Downloaded and Executed Immediately
- Content
View full analysis
- Remediation
View remediation
Security audit
alibabacloud-cas-ssl-cert-purchase
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with Alibaba Cloud SSL certificate purchasing, but its install and permission guidance is too broad for a workflow that can spend money and mutate cloud certificate resources.
Review before installing. Use a pinned and verified Aliyun CLI/plugin installation path, avoid pasting access keys into commands or chats, grant a custom least-privilege RAM policy instead of full-access billing/certificate policies, and require a separate explicit confirmation before any purchase or certificate submission.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T03 · Remote Payload Retrieval and Execution
Error
- Location
references/cli-installation-guide.md:30- Finding
Unpinned Latest Archives Are Streamed into Extraction and Installed System-Wide
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:33- Finding
Mandatory Automatic Plugin Installation and Global Updates Expand Supply-Chain Exposure
- Content
View full analysis
[MUST] Verify `aliyun version` >= 3.3.3 (full install/upgrade guide: `references/cli-installation-guide.md`; routine update via `aliyun upgrade` when >= 3.3.5). > [MUST] Run `aliyun configure set --auto-plugin-install true` and `aliyun plugin update` to keep plugins up-to-date. **Script Dependencies:** `scripts/bss-purchase.sh` requires: bash >= 4.0, aliyun CLI >= 3.3.3 with `aliyun-cli-bssopenapi` plugin (`aliyun plugin install --names aliyun-cli-bssopenapi`). ``` ### Technical Analysis The Skill requires users to enable automatic plugin installation and run a general plugin update. Its declared functionality only requires the `aliyun-cli-bssopenapi` plugin in addition to the CAS commands. The instructions do not pin plugin versions or require publisher, signature, or checksum verification. A global update can modify unrelated plugins already installed in the user's CLI environment, exceeding the minimum dependency changes required for this Skill. Automatic installation is particularly sensitive because plugins operate in an authenticated cloud CLI context. A compromised or unexpectedly changed plugin can access command data and act with the credentials available to the CLI. ### Attack Path 1. A malicious or compromised plugin version is published through the configured plugin repository. 2. The user follows the mandatory instructions and enables automatic plugin installation. 3. The user runs the global plugin update command. 4. The CLI retrieves and installs the compromised component without a Skill-defined version or integrity constraint. 5. The malicious plugin executes when the corresponding CLI command is invoked. 6. It can inspect local cloud configuration or abuse the active profile's permissions. ### Impact Assessment Pote ...[truncated 339 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/cli-installation-guide.md:80- Finding
Credential Guidance Exposes Secrets Through Command Arguments and Plaintext Environment Variables
- Content
View full analysis
\ --access-key-secret \ --region cn-hangzhou ``` ```bash aliyun configure set \ --mode StsToken \ --access-key-id \ --access-key-secret \ --sts-token \ --region cn-hangzhou ``` ```bash **Access Key Mode** ```bash export ALIBABA_CLOUD_ACCESS_KEY_ID= export ALIBABA_CLOUD_ACCESS_KEY_SECRET= export ALIBABA_CLOUD_REGION_ID=cn-hangzhou ``` **STS Token Mode** ```bash export ALIBABA_CLOUD_ACCESS_KEY_ID= export ALIBABA_CLOUD_ACCESS_KEY_SECRET= export ALIBABA_CLOUD_SECURITY_TOKEN= export ALIBABA_CLOUD_REGION_ID=cn-hangzhou ``` ``` ### Technical Analysis The guide encourages users to place access keys, secrets, and STS tokens directly in command-line arguments. Depending on the operating system and shell configuration, these values may be retained in command history, terminal logs, process telemetry, automation logs, or process listings. The environment-variable examples expose credentials to child processes and potentially to diagnostic tools, crash collectors, environment dumps, and accidentally verbose scripts. Long-lived static keys create greater impact than short-lived, automatically refreshed identities. This guidance also conflicts with the primary instructions in `SKILL.md`, which state that the agent must never ask the user to enter literal access keys in the conversation or command line. ### Attack Path 1. A user copies a documented command and replaces the placeholders with real credentials. 2. The command is stored in she ...[truncated 946 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/ram-policies.md:24- Finding
Recommended Full-Access RAM Policies Exceed the Skill's Required Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description presents a complete SSL certificate purchase and application workflow through Alibaba Cloud CAS, including reuse of existing instances and the sequence list-instances → update-instance → apply-certificate. The actual code chunk only wraps BSS billing operations: plugin check, paid instance creation, and order-detail lookup. While purchasing a certificate instance is consistent with part of the declared purpose, the central claimed behaviors around CAS-side certificate instance management and certificate application are absent from this code. Therefore the description overstates what this supplied code chunk actually does in a material way.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
aliyun version
text ### Self-Update (CLI >= 3.3.5) Once the CLI is at version 3.3.5 or newer, routine updates can use the built-in self-update subcommand instead of re-running the install script:
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
Self-Update (CLI >= 3.3.5)
Once the CLI is at version 3.3.5 or newer, routine updates can use the built-in self-update subcommand instead of re-running the install script:
bash aliyun upgrade
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md | Command | Description | |---------|-------------| | `aliyun version` | Check CLI version (must be >= 3.3.3) | | `aliyun upgrade` | Self-update CLI (available >= 3.3.5) | | `aliyun configure list` | List configured profiles and credentials | | `aliyun configure set` | Configure CLI profile settings | | `aliyun plugin update` | Update installed plugins |
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger phrases are broad enough to activate on loosely related certificate requests, which can route users into a money-spending and certificate-submission workflow unintentionally. In this skill context, overbroad activation is more dangerous because the skill includes billing operations, resource modification, and irreversible application steps.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The catch-all trigger for 'any scenario requiring a certificate application to Alibaba Cloud CAS' is overly expansive and can cause the skill to engage for planning, troubleshooting, informational, or unrelated certificate-management requests. Because this skill can lead to paid purchases and certificate application actions, accidental invocation materially increases the risk of unintended operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guide recommends executing a remotely downloaded script directly via curl piped to bash, which gives immediate code execution to whatever is served from that URL or any compromised delivery path. In an agent skill context, this is more dangerous because users may follow instructions non-interactively and run privileged bootstrap commands without inspecting them.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
x86_64
bash wget --connect-timeout=10 --read-timeout=120 --tries=3 -qO- https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz sudo mv aliyun /usr/local/bin/ARM64
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
x86_64
bash wget --connect-timeout=10 --read-timeout=120 --tries=3 -qO- https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz sudo mv aliyun /usr/local/bin/ARM64
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once ### Configuration Modes
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest describes purchasing and applying SSL certificates, but this guide instructs users to configure RamRoleArn and RamRoleArnWithEcs modes for elevated or cross-account access. Those are broader account-access capabilities than the stated certificate-order flow and are not presented as CAS-specific requirements.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill manifest scopes the skill to CAS SSL certificate purchasing and application, but this file teaches general-purpose Aliyun CLI operations for unrelated services such as ECS, VPC, RDS, and FC, including listing instances, regions, and installing arbitrary product plugins. That materially expands the described behavior from certificate-order automation into broad cloud CLI enablement.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Restrict permissions chmod 600 ~/.aliyun/config.jsonTroubleshooting
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documented recommended permissions include broad billing and purchasing access (
AliyunBSSFullAccess) and a custom policy that allows certificate instance creation, which can directly trigger paid purchases. Because the file presents these permissions as required/recommended without an explicit warning about financial impact, operators may grant overly broad access and enable unintended or unauthorized spending through the skill.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The PowerShell example updates the machine PATH persistently, which alters system configuration beyond the current session. Although one inline note mentions admin privileges, the section does not clearly warn that this is a persistent system-wide change and may impact other users or shells.
- Content