alibabacloud-cas-ssl-common-tools

• Outcome: Review
• Latest audit: Jul 28, 2026 · 10:37 AM UTC
• Version: 0.0.1-beta.1

Overview

This Alibaba Cloud SSL certificate toolkit is mostly purpose-aligned, but it needs review because it directs broad cloud, DNS, plugin-update, IAM, and private-key handling actions.

Install only if you are comfortable giving the agent tightly scoped Alibaba Cloud CAS/DNS/RAM authority. Prefer a dedicated least-privilege RAM role, avoid the broad quick-trial system policies in production, do not allow automatic CLI/plugin updates without review, and treat all certificate private keys and PFX/JKS passwords as secrets that should not be pasted into logs or left unencrypted on disk.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The skill says vague requests must result in zero API calls until intent is clarified, but the Domain Pre-check section permits `aliyun cas list-instances --keyword` when a domain is provided and intent is unclear. That contradiction can cause unauthorized or privacy-impacting cloud queries against user-supplied domains before the user has explicitly approved an operation.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The file substantially broadens the skill from CAS SSL certificate tasks into general Alibaba Cloud CLI setup, multi-mode authentication, ECS verification, and plugin management. In an agent skill context, this scope creep is dangerous because it normalizes collection and configuration of broad cloud credentials and enables operations outside the declared certificate-management boundary, increasing the chance of privilege misuse or unintended cloud actions.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly tells users to install arbitrary product plugins such as ECS, VPC, and RDS, which are unrelated to SSL certificate management. In a skill meant for CAS certificate operations, encouraging expansion into unrelated cloud services widens operational capability and attack surface, making abuse or accidental overreach more likely.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill documentation expands from Alibaba Cloud CAS verification into generic SSH/SCP-based remote file upload on arbitrary servers. That creates a privileged side effect outside the declared cloud-certificate management scope and could lead an agent to write attacker-influenced content to remote infrastructure if user/server parameters are unsafe or insufficiently verified.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Introducing arbitrary remote server access via SSH/SCP is materially broader than querying CAS state or guiding domain verification. In an agent setting, this can become an unintended remote administration primitive that attackers may abuse to induce uploads to infrastructure the agent should never manage.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file documents IAM/RAM role creation and policy attachment workflows that materially expand the skill beyond simple certificate handling into identity and privilege-management operations. Because these commands create a trusted role for a service principal and attach powerful policies, a user following the instructions could grant broad account capabilities not clearly bounded by the skill’s advertised purpose.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The so-called least-privilege policy still includes DNS management permissions, which extend the skill into control over domain records. In certificate workflows this may be operationally relevant for DNS validation, but it is still security-sensitive and under-disclosed because DNS changes can affect domain ownership proofs, service routing, and trust relationships.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The trigger list includes broad everyday-language phrases like '是否匹配', '是不是一对', and 'check if they match', which can accidentally activate the skill in unrelated conversations. In a skill that can invoke cloud APIs and process private keys, overbroad activation increases the chance of unintended sensitive operations or data handling.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly describes API response fields that include private key material (`Key`, `EncryptPrivateKey`, `SignPrivateKey`) but provides no warning, access-control guidance, or safe-handling instructions. In a certificate-management skill, exposing or normalizing retrieval of private keys increases the risk that an agent or user will mishandle, log, persist, or disclose highly sensitive secrets, which could enable certificate impersonation if leaked.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documented workflow directly embeds PEM certificate and especially private key material into command-line arguments and extracts keys in plaintext, but provides no warning that these values are highly sensitive. Command-line arguments can be exposed through shell history, process listings, terminal logging, CI logs, or agent telemetry, increasing the risk of private key disclosure and certificate compromise.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation provides commands to automatically create live DNS TXT records without warning that this changes production DNS state. In an agent workflow, that omission increases the chance of silent or poorly understood infrastructure modification, potentially affecting validation flows or existing records.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The SSH/SCP example writes a file to a remote web root but does not clearly warn that it performs a remote filesystem modification. That is dangerous because users or downstream agents may treat it as a harmless verification step while it actually executes a privileged write on external infrastructure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The markdown provides copyable commands to create a role and attach broad system policies such as full CAS and DNS access, but does not present a strong, immediate warning about the privilege escalation and account-wide blast radius. This creates a social-engineering style risk where operators may execute sensitive IAM changes as routine setup for an SSL tool without appreciating the security consequences.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script extracts a private key from a PKCS#12 bundle using `-nodes`, which writes the key to disk unencrypted as `${PREFIX}.key`. In a certificate-management tool this is sensitive material, and the script provides no warning, safer default, or permission hardening, so users may unknowingly leave exposed private keys on disk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The JKS-to-PEM path converts the keystore to PKCS#12 and then extracts the private key with `openssl pkcs12 -nocerts -nodes`, producing an unencrypted `${PREFIX}.key` file on disk. Because this skill is specifically for SSL certificate handling, exposing private keys is especially risky: compromise of that file can enable server impersonation or TLS decryption where the key is used.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

> [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date.

**Local tools:**

| Tool | Required | Used By |
|------|----------|---------|

• Confidence: 95% confidence
• Finding: tools:*

Self-Modification

High

• Category: Rogue Agent

Content

**Pre-check: Aliyun CLI >= 3.3.3 required**
> [MUST] Verify: `aliyun version` — must be >= 3.3.3.
> - **First install or major upgrade:** Follow the verified steps in `references/cli-installation-guide.md` — download the installer first, review/verify its content, then execute the local copy. Never pipe remote content directly into a shell.
> - **Routine update (CLI >= 3.3.5):** `aliyun upgrade` — prefer this built-in self-update over re-running the install script.

**Pre-check: Aliyun CLI plugin update required**
> [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.

• Confidence: 97% confidence
• Finding: self-update

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.