alibabacloud-cas-ssl-common-tools

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:35 AM UTC
• Version: 0.0.1

Overview

This skill is a coherent Alibaba Cloud certificate toolkit, but it asks for broad cloud authority and handles private keys in ways users should review carefully before installing.

Install only if you are comfortable granting this skill Alibaba Cloud certificate, DNS, and RAM-related authority. Use a least-privilege profile, avoid the broad quick-trial policies, do not enable automatic plugin installation without reviewing versions, prefer verified CLI binaries over mutable setup scripts, and treat all certificate keys and keystore passwords as sensitive secrets.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:38

Finding

Mandatory Automatic Installation and Update of Unpinned Aliyun CLI Plugins

Content

View full analysis

[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ``` ### Technical Analysis The Skill mandates enabling automatic plugin installation and updating all existing Aliyun CLI plugins. Plugins are executable components obtained from an external repository, but the workflow does not pin plugin versions or require validation of package checksums, signatures, publishers, or expected plugin contents. Consequently, the code reviewed during this audit is not necessarily the code that will run later. A compromised plugin repository, publisher account, update channel, or upstream release could cause the CLI to install and execute modified plugin code. Because the Aliyun CLI is used with a configured cloud identity, a malicious plugin could potentially access that process environment and act with the permissions of the selected Alibaba Cloud profile. ### Attack Path 1. An attacker compromises an Aliyun CLI plugin distribution channel, publisher account, or plugin release. 2. A modified plugin version is published through the trusted update channel. 3. The Skill mandates running `aliyun plugin update` or automatically installs the plugin when an API command is first used. 4. The modified plugin is loaded or executed by the Aliyun CLI. 5. The plugin operates under the local execution identity and may interact with the configured cloud credential profile. 6. It can perform cloud operations allowed to that identity or access certificate material available to the process. ### Impact Assessment Successful exploitation could provide code execution with the privileg ...[truncated 411 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/cli-installation-guide.md:11

Finding

Mutable Remote Installer Is Executed Without Cryptographic Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/convert-format.sh:28

Finding

Keystore Passwords Are Exposed Through Process Arguments and Weak Defaults

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/convert-format.sh:36

Finding

Extracted Private Keys Are Written Without Enforced Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:443

Finding

Cleanup Logic Deletes Broad Non-Session-Specific Temporary Paths

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code chunk implements only one narrow function from the declared toolkit: checking whether a key, certificate, and/or CSR match by comparing modulus or public key hashes. That behavior aligns with the declared 'certificate matching' / 'check key cert match' capability, but the overall declared description presents a much broader Alibaba Cloud CAS toolkit with multiple certificate-management functions that are not present in this code. There is no evidence of CAS API usage, identity configuration, domain verification, upload/download, CSR generation, or format conversion. Therefore the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a broad Alibaba Cloud CAS certificate management toolkit with multiple cloud-related operations and matching features. The supplied code chunk only performs a local file-processing task: splitting a certificate chain PEM into component files and verifying the server certificate against the intermediate chain using openssl. While this is loosely related to certificate handling and possibly format manipulation, it does not implement the advertised CAS-focused functionality or most listed capabilities. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill instructs users to run self-update actions (aliyun upgrade, plugin auto-install, plugin update), which modify local tooling outside the immediate certificate task. Self-modifying or auto-installing tooling expands supply-chain risk and can change runtime behavior in ways the user has not independently reviewed.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

**Pre-check: Aliyun CLI >= 3.3.3 required**
> [MUST] Verify: `aliyun version` — must be >= 3.3.3.
> - **First install or major upgrade:** Follow the verified steps in `references/cli-installation-guide.md` — download the installer first, review/verify its content, then execute the local copy. Never pipe remote content directly into a shell.
> - **Routine update (CLI >= 3.3.5):** `aliyun upgrade` — prefer this built-in self-update over re-running the install script.

**Pre-check: Aliyun CLI plugin update required**
> [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The combined rm -rf /tmp/cert-*.pfx /tmp/cert-output /tmp/cert-verify /tmp/cert-upload performs destructive deletion against fixed shared paths. In a multi-user or multi-process context, this can delete unrelated artifacts and makes the cleanup behavior broader than necessary for secret disposal.

Content

Scanner excerpt · SKILL.md (reported line 448)May include surrounding context.

/tmp/cert-?) rm -rf "$CERT_TMPDIR" ;; ) echo "Skipped: CERT_TMPDIR is unset or not an expected /tmp/cert- path" ;; esac rm -rf /tmp/cert-.pfx /tmp/cert-output /tmp/cert-verify /tmp/cert-upload unset CERT_PROFILE CERT_REGION CERT_INSTANCE_ID CERT_CERT_ID CERT_DOMAIN CERT_SESSION_ID CERT_TMPDIR

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

The combined rm -rf /tmp/cert-*.pfx /tmp/cert-output /tmp/cert-verify /tmp/cert-upload performs destructive deletion against fixed shared paths. In a multi-user or multi-process context, this can delete unrelated artifacts and makes the cleanup behavior broader than necessary for secret disposal.

Content

Scanner excerpt · SKILL.md (reported line 448)May include surrounding context.

/tmp/cert-?) rm -rf "$CERT_TMPDIR" ;; ) echo "Skipped: CERT_TMPDIR is unset or not an expected /tmp/cert- path" ;; esac rm -rf /tmp/cert-.pfx /tmp/cert-output /tmp/cert-verify /tmp/cert-upload unset CERT_PROFILE CERT_REGION CERT_INSTANCE_ID CERT_CERT_ID CERT_DOMAIN CERT_SESSION_ID CERT_TMPDIR

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The combined rm -rf /tmp/cert-*.pfx /tmp/cert-output /tmp/cert-verify /tmp/cert-upload performs destructive deletion against fixed shared paths. In a multi-user or multi-process context, this can delete unrelated artifacts and makes the cleanup behavior broader than necessary for secret disposal.

Content

Scanner excerpt · SKILL.md (reported line 448)May include surrounding context.

/tmp/cert-?) rm -rf "$CERT_TMPDIR" ;; ) echo "Skipped: CERT_TMPDIR is unset or not an expected /tmp/cert- path" ;; esac rm -rf /tmp/cert-.pfx /tmp/cert-output /tmp/cert-verify /tmp/cert-upload unset CERT_PROFILE CERT_REGION CERT_INSTANCE_ID CERT_CERT_ID CERT_DOMAIN CERT_SESSION_ID CERT_TMPDIR

text

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 116)May include surrounding context.

aliyun version

text

### Self-Update (CLI >= 3.3.5)

Once the CLI is at version 3.3.5 or newer, routine updates can use the built-in self-update subcommand instead of re-running the install script:

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

Self-Update (CLI >= 3.3.5)

Once the CLI is at version 3.3.5 or newer, routine updates can use the built-in self-update subcommand instead of re-running the install script:

bash

aliyun upgrade

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/split-chain.sh (reported line 43)May include surrounding context.

sh

# Clean up only the intermediate files created by this run (cert1 was renamed above)
for i in $(seq 2 "$CERT_COUNT"); do
  rm -f "$OUTPUT_DIR/cert${i}.pem"
done

# Also create fullchain (server + intermediate)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

| "match certificate", "check key cert match", "key mismatch", "check if they match", "are they a pair" | `"证书匹配"`, `"检查密钥匹配"`, `"不匹配"`, `"是否匹配"`, `"是不是一对"`, `"是否不匹配"`, `"是不是配套"` | [Certificate Matching](#certificate-matching) | ✅ Active |

> **[MUST] Intent Clarification:** If user input does NOT match any trigger keyword above, or is too vague (e.g., "帮我处理一下ram", "配置证书", "搞一下SSL"), **STOP immediately**. Ask the user to clarify which specific operation they need (configure identity / verify domain / download / upload / CSR / format conversion / matching). Do **NOT** call any CAS, RAM, STS, or Alidns API until the user provides a clear intent.
> **[MUST] HITL Blocking:** When any instruction requires asking the user (clarification, name conflict, parameter confirmation), you MUST halt ALL subsequent actions and **WAIT for the user's explicit reply**. Never auto-advance, auto-retry, assume consent, or proceed to the next step without receiving a non-empty user response. **An empty, blank, or silent user response is NOT consent — re-prompt with the exact same question and continue waiting; never treat emptiness as a signal to auto-retry (e.g., re-issuing `upload-user-certificate` with a different name). You are strictly FORBIDDEN from calling `upload-user-certificate` or any retry API until a non-empty, explicit user reply is received.**
## Installation

**Pre-check: Aliyun CLI >= 3.3.3 required**

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes role creation and policy attachment guidance that expands privileges beyond basic certificate handling, including attaching broad system policies. In a certificate-management context, embedding IAM/RAM role provisioning increases blast radius and can normalize over-privileged access, especially if users follow it without least-privilege review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill proposes auto-upload via SSH/SCP for HTTP validation, which introduces remote server access not declared in the manifest. That capability materially changes the trust boundary: instead of guiding DNS/HTTP validation, the skill may write files to external hosts, creating risk of unauthorized modification or misuse of server credentials.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.

Step 2: Extract Certificate Content — Parse Cert (server PEM) and Key (private key PEM) from response. Write to secure temp directory:

bash

CERT_TMPDIR=$(mktemp -d /tmp/cert-XXXXXX)
chmod 700 "$CERT_TMPDIR"
echo "{{cert_content}}" > "$CERT_TMPDIR/server.pem"
echo "{{key_content}}" > "$CERT_TMPDIR/server.key"
chmod 600 "$CERT_TMPDIR/server.key"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

chmod 700 "$CERT_TMPDIR" echo "{{cert_content}}" > "$CERT_TMPDIR/server.pem" echo "{{key_content}}" > "$CERT_TMPDIR/server.key" chmod 600 "$CERT_TMPDIR/server.key"

text

**Step 3: Split Chain**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 441)May include surrounding context.

chmod 700 "$CERT_TMPDIR" echo "{{cert_content}}" > "$CERT_TMPDIR/server.pem" echo "{{key_content}}" > "$CERT_TMPDIR/server.key" chmod 600 "$CERT_TMPDIR/server.key"

text

**Step 3: Split Chain**

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 452)May include surrounding context.

unset CERT_PROFILE CERT_REGION CERT_INSTANCE_ID CERT_CERT_ID CERT_DOMAIN CERT_SESSION_ID CERT_TMPDIR

text

> **Security:** Never leave private key files in world-readable locations. Always clean up temp files containing private keys after use.
## Command Tables

Key commands (full list in `references/related-commands.md`): `list-instances`, `get-instance-detail`, `upload-user-certificate`, `add-domain-record`, `get-caller-identity`, plus `scripts/` utilities.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The reference explicitly documents API response fields that include private key material (Key, EncryptPrivateKey, SignPrivateKey) but provides no warning, gating, or safe-handling guidance for highly sensitive secrets. In an agent skill context, this increases the chance an automated workflow will retrieve, display, log, or persist private keys unintentionally, which could enable certificate impersonation and compromise of protected services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation instructs users to place full certificate and private key material directly on the command line and to extract unencrypted private keys with -nodes. Command-line arguments can be exposed via shell history, process listings, logging, or terminal capture, which creates a real risk of private key disclosure even though the skill's purpose is legitimate certificate management.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 85)May include surrounding context.

md

tar xzf "aliyun-cli-linux-${VERSION}-arm64.tgz"

# 5. Install into a user-owned bin directory — no elevated privileges required
mkdir -p "$HOME/.local/bin"
mv aliyun "$HOME/.local/bin/"
# Ensure $HOME/.local/bin is on your PATH. For a system-wide install, move the
# binary into a system PATH directory (e.g. /usr/local/bin) with administrator privileges.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This guide substantially broadens a CAS SSL certificate skill into a general Alibaba Cloud CLI onboarding and cloud-operations document, including credential setup, region management, ECS commands, RAM roles, and plugin workflows. That scope expansion increases the chance the skill will be activated for unrelated cloud administration tasks and can normalize handling powerful credentials within the skill context, which is risky for a narrowly scoped certificate tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly tells users to install arbitrary Alibaba Cloud product plugins such as ECS, VPC, and RDS, which are unrelated to certificate management. In an agent skill, that broadens reachable functionality beyond the intended CAS SSL scope and can enable unexpected cloud actions if the agent later uses the installed plugins.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document instructs the agent to create DNS TXT records and potentially upload HTTP validation files without an explicit warning that these actions modify external infrastructure. In an agent setting, omission of confirmation and change-safety language increases the chance of silent or overly broad changes to production DNS or web servers, especially because the skill is operational rather than purely informational.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The reference includes SSH/SCP-based file upload steps that can cause the agent to write content onto arbitrary remote servers, which is a materially sensitive action beyond passive certificate inspection. Although the content is framed as HTTP domain validation and includes an SSRF note for the later curl, it does not constrain the SSH destination or require strong ownership/authorization checks for the target host, creating a path for unintended remote system modification or misuse of stored credentials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The quick-trial guidance recommends broad system policies granting effectively full certificate-service and DNS access, which is excessive for many of the stated workflows. If followed, compromise or misuse of the skill could enable certificate issuance/management and DNS manipulation across the account, including domain-verification abuse and service disruption.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documentation expands from certificate operations into IAM administration by instructing creation of a RAM role and attachment of policies. That introduces new privilege-management capabilities not implied by a certificate utility and can lead users to grant standing permissions that the skill can later rely on, increasing blast radius well beyond the immediate task.

Content

No source excerpt is available for this finding.