alibabacloud-cas-ssl-common-tools

• Outcome: Review
• Latest audit: Jul 30, 2026 · 11:46 AM UTC
• Version: 0.0.1

Overview

The skill fits SSL certificate management, but it grants and changes high-impact cloud, local tooling, private-key, and remote-server state with some overbroad or under-scoped instructions.

Install only if you are comfortable with an agent managing Alibaba Cloud certificate workflows. Use the fine-grained RAM policy, avoid the broad quick-trial policies in production, review every DNS/IAM/SSH command before approval, do not allow automatic plugin updates in sensitive environments, and keep private keys and certificate passwords out of logs, shell history, and shared terminals.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The HTTP verification section expands from CAS/API guidance into operational SSH/SCP remote file deployment, which grants a generic remote write capability to user-managed servers. Even though the example includes an SSRF guard for the verification fetch, the dangerous action is the documented remote upload itself: if an agent follows this pattern with user-supplied server, user, web_root, or file name inputs, it could write arbitrary files to unintended hosts or paths.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The skill documentation prescribes generic SSH/SCP access to arbitrary user servers, which is broader than what a certificate-management helper needs to do. In an agent setting, this kind of instruction can normalize collecting or using server credentials and performing remote writes, increasing the risk of lateral actions outside the declared CAS scope.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This documentation for an 'identity resolver' goes beyond passive identity configuration and explicitly includes commands to create a RAM role and attach permissions. In an agent skill context, that expands scope from reading identity to modifying account IAM state, which can enable privilege establishment or persistence if followed automatically or without strong user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The file recommends attaching broad system policies granting full CAS and DNS access 'for convenience,' which violates least-privilege principles. In a skill that handles certificates and DNS validation, these permissions are powerful enough to alter certificate assets and DNS records across the account, increasing blast radius if the skill is misused or compromised.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The cleanup section performs broad recursive deletion of fixed /tmp paths and globs, including `/tmp/cert-output`, `/tmp/cert-verify`, `/tmp/cert-upload`, and `/tmp/cert-*.pfx`. Even though these are temporary-looking paths, they are not all validated as uniquely created by the current session, so the skill could delete unrelated user files or attacker-planted symlink targets if executed in a shared or manipulated environment.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation explicitly indicates that the API response includes private key material (`Key`, `EncryptPrivateKey`, `SignPrivateKey`) but provides no warning, handling guidance, or safeguards for dealing with highly sensitive secrets. In a certificate-management skill, exposing or normalizing retrieval of private keys without strong cautions increases the risk of accidental disclosure in logs, chat transcripts, terminal history, or downstream tooling.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The file documents extracting an unencrypted private key from a PFX using `-nodes` and then uploading certificate and key material inline on the command line, but it provides no warning about secure handling, storage, shell history exposure, file permissions, or cleanup. In a certificate-management skill, this is especially sensitive because private keys are high-value secrets; weak operational guidance can lead to accidental disclosure or insecure retention even if the commands are functionally correct.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The documentation includes a live DNS modification command that creates TXT records but does not clearly warn that it changes an external production system. In an agent workflow, omission of an explicit mutation warning can cause users to approve or trigger infrastructure changes without understanding the side effects, especially when DNS changes affect availability or ownership validation.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The HTTP verification example writes a local file and copies it to a remote web root, but the text does not explicitly call out that it performs local filesystem writes and remote server changes. In an autonomous or semi-autonomous agent context, failing to label these side effects can lead to unsafe execution of commands that alter systems beyond the immediate certificate API workflow.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The markdown presents role creation and policy attachment commands as straightforward operational steps without prominent warning that they change account permissions and security posture. In an agent-operated workflow, users may treat these as routine setup and unknowingly authorize impactful IAM changes, making social-engineering-style misuse easier.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This reference documents commands that generate private keys with `-nodes` and export PKCS#12 contents with `-nodes`, which can leave private key material unencrypted on disk or in output files. In an SSL certificate toolkit, users are likely to copy these commands directly, so omission of any warning or safer defaults increases the chance of accidental key exposure, credential theft, and downstream certificate compromise.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The verification examples pass keystore or PKCS#12 passwords directly on the command line (`-passin pass:...`, `-storepass ...`). Command-line arguments are commonly exposed through shell history, process listings, audit logs, and CI job logs, which can leak sensitive certificate passwords to other local users or operators. In a certificate-management skill, those secrets protect exported private keys and keystores, so disclosure can enable unauthorized certificate or key access.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

> [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date.

**Local tools:**

| Tool | Required | Used By |
|------|----------|---------|

• Confidence: 88% confidence
• Finding: The skill requires enabling automatic plugin installation and updating all CLI plugins, which expands executable code trust to whatever the CLI plugin channel provides. This is effectively unrestricted extension loading at runtime and can introduce supply-chain risk, especially because later workflow behavior depends on local tools and plugins that may change without explicit review.

Self-Modification

High

• Category: Rogue Agent

Content

**Pre-check: Aliyun CLI >= 3.3.3 required**
> [MUST] Verify: `aliyun version` — must be >= 3.3.3.
> - **First install or major upgrade:** Follow the verified steps in `references/cli-installation-guide.md` — download the installer first, review/verify its content, then execute the local copy. Never pipe remote content directly into a shell.
> - **Routine update (CLI >= 3.3.5):** `aliyun upgrade` — prefer this built-in self-update over re-running the install script.

**Pre-check: Aliyun CLI plugin update required**
> [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.

• Confidence: 96% confidence
• Finding: The skill instructs the environment to self-update the Alibaba Cloud CLI and plugins (`aliyun upgrade`, plugin update), which modifies the local execution environment before or during use. Self-modifying prerequisites create a supply-chain and integrity risk because future commands may run with newly fetched code that was not part of the reviewed skill, and the user may not understand that executing the skill alters trusted tooling.

Static analysis

No suspicious patterns detected.