Alibabacloud Cfw Acl Diagnosis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:10 AM UTC
• Version: 0.0.1

Overview

The skill is mostly a read-only Alibaba Cloud firewall diagnostic helper, but it contains contradictory firewall guidance and repeated insecure testing advice that could lead to wrong manual security changes.

Install only if you are comfortable granting read-only Alibaba Cloud firewall, log, and ActionTrail query access. Use least-privilege RAM permissions, do not let the skill make configuration changes, verify source/destination semantics against authoritative Alibaba Cloud documentation before changing ACLs, and avoid curl -k except as a clearly understood TLS-bypass troubleshooting exception.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/diagnosis.md:68

Finding

Contradictory Internet Firewall Outbound Source Guidance

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:128-132
• references/configuration_guide.md:75-96
• references/diagnosis.md:68

Vulnerability Type: Inconsistent security-control configuration guidance
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:128-132:

markdown

**Protected asset identification**:
- Inbound (`in`) → Protected asset = **Destination**
- Outbound (`out`) → Protected asset = **Source** (public IP, not internal CIDR)

references/configuration_guide.md:75-96:

markdown

| Direction | Source Field | Destination Field | Example Use Case |
|-----------|--------------|-------------------|------------------|
| **Inbound** (external→internal) | External IP or 0.0.0.0/0 | Protected asset's public IP/EIP | Allow SSH from specific IP to server |
| **Outbound** (internal→external) | **Protected asset's public IP** | **Target domain/IP or 0.0.0.0/0** | Allow server to access specific external API |

**Common Outbound Configuration Examples**:

✅ **Example 1: Allow specific ECS public IP to access only huawei.com**
- Direction: Outbound
- Source: 114.55.95.82/32 (ECS public IP)
- Destination: www.huawei.com (domain)
- DestinationType: domain
- Port: 80/443
- Action: Allow

✅ **Example 2: Deny all other outbound traffic (fallback rule)**
- Direction: Outbound
- Source: 114.55.95.82/32 (same ECS public IP)
- Destination: 0.0.0.0/0
- DestinationType: net
- Port: 0/0
- Proto: ANY
- Action: Deny

references/diagnosis.md:68:

markdown

| **Outbound Source/Destination misconfigured** | **Source=public IP in outbound rule** | **Source should be internal CIDR, Destination should be public IP** |

Technical Analysis

The primary workflow and configuration guide state that an Internet Firewall outbound ACL must use the protected asset's public IP as its source. The diagnosis framework instead identifies a public-IP source as a mis ...[truncated 1948 chars]

Remediation

View remediation

Remediation Suggestions

1. Verify the authoritative Alibaba Cloud Internet Firewall packet-address semantics and establish one canonical outbound source/destination model.
2. Correct references/diagnosis.md:68 or the conflicting primary guidance so all files provide identical instructions.
3. Centralize protected-asset addressing rules in one reference and link to it instead of duplicating the rule.
4. Add automated documentation consistency tests that compare inbound and outbound addressing statements across SKILL.md, configuration_guide.md, and diagnosis.md.
5. Require diagnosis conclusions to cite the actual CLI source, destination, direction, and protected-asset values before recommending a manual ACL change.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli_traps.md:64

Finding

Contradictory NAT Firewall Source Address Guidance

Content

View full analysis

Vulnerability Details

File Locations:

• references/cli_traps.md:64-72
• references/configuration_guide.md:177-182
• references/cfw_acl_knowledge.md:129-141

Vulnerability Type: Inconsistent NAT security-policy addressing guidance
Risk Level: Medium

Vulnerable Code Snippets

references/cli_traps.md:64-72:

markdown

## 4. NAT Firewall SNAT Source IP Trap

### Trap: Rule source address does not match the actual traffic source IP

**Symptoms**:
- The NAT rule is configured with an internal IP range, but the rule hit count is 0.

**Root Cause**:
- NAT Firewall inspects the public IP **after SNAT translation**, not the internal private IP.
- The rule source address must be configured as the actual egress IP after SNAT.

references/configuration_guide.md:177-182:

markdown

1. Click "Create Rule"
2. Configure match conditions:
   - **Source**: IP address / address book (must match actual source IP after SNAT)
   - **Destination**: IP address / domain / address book
   - **Port**: Single port or port range
   - **Protocol**: TCP / UDP / ICMP / ANY

references/cfw_acl_knowledge.md:129-141:

markdown

| Feature | Description |
|------|------|
| **Direction** | **No Direction parameter**, rules are unidirectional (Source → Destination) |
| **Strict mode** | **Supported**, controlled by the `StrictMode` field (`0`=loose, `1`=strict) |
| **Domain rules** | **Supported** (requires strict mode `StrictMode=1`) |
| **FirewallId** | Requires `NatFirewallId` parameter to locate the firewall instance |
| **Protected asset** | NAT Gateway / cloud resources behind NAT |
| **ACL engine mode** | **Firewall-level**, all rules under one instance share the same mode |

### Source/Destination Addresses

| Configuration Item | Supported Types |
|--------|-----------|
| Source address | VPC CIDR, address book (private IP behind NAT) |
| Destination address | IP/CIDR, ad
...[truncated 2264 chars]

Remediation

View remediation

Remediation Suggestions

1. Confirm and document the exact NAT Firewall enforcement point and whether ACL matching uses pre-SNAT or post-SNAT addresses for each supported traffic scenario.
2. Reconcile cli_traps.md, configuration_guide.md, and cfw_acl_knowledge.md so they use one authoritative model.
3. If semantics differ by SNAT, DNAT, or traffic path, provide an explicit decision table rather than a universal source-address statement.
4. Require the agent to verify the observed source address from read-only traffic logs before recommending a source-address change.
5. Add test cases for private backend CIDRs, translated public addresses, SNAT outbound traffic, and DNAT inbound traffic.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (14)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/configuration_guide.md (reported line 234)May include surrounding context.

text

**Solutions**:
- Test domain rules using `curl -k "https://domain"`, **NOT telnet**
- To block pure TCP/Unknown traffic: Use DNS resolution mode, or configure Layer 4 fallback rule
- Allow only HTTP/HTTPS outbound: Configure L7 domain rule + final Layer 4 deny 0.0.0.0/0 rule

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The guidance explicitly recommends curl -k, which disables TLS certificate verification. That can train users to test or diagnose connectivity in a way that ignores man-in-the-middle, certificate mismatch, or interception problems, producing misleading security conclusions and normalizing insecure command usage. In a firewall-diagnosis skill, this is more dangerous because users are already troubleshooting network security behavior and may copy the command into real environments.

Content

Scanner excerpt · references/diagnosis.md (reported line 141)May include surrounding context.

md

### Pre-Match Problem Solutions

1. **Testing domain policies**: Use `curl -k "https://domain"`, **do NOT use telnet**
2. **Block pure TCP/Unknown traffic**: Use DNS resolution mode, or configure Layer 4 fallback policy
3. **Allow only HTTP/HTTPS outbound**: Configure Layer 7 domain policy + final Layer 4 0.0.0.0/0 deny rule

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This table endorses curl -k as the canonical example for strict-mode domain-rule testing, again disabling server certificate validation. That weakens the trust model of HTTPS during diagnostics and can mask certificate and interception issues, which is especially problematic in a cloud firewall context where users may mistake successful insecure requests for healthy secure-path behavior.

Content

Scanner excerpt · references/diagnosis.md (reported line 154)May include surrounding context.

md

| Engine Mode | Testing Tool | Why | Example |
|-------------|-------------|-----|---------|
| **Loose mode** (Internet: EngineMode=loose, NAT: StrictMode=0) | `telnet`, `nc`, `curl` | Only 4-tuple matching, any TCP/UDP traffic works | `telnet example.com 443` |
| **Strict mode** (Internet: EngineMode=strict, NAT: StrictMode=1) + **Domain rules** | `curl`, `wget` **ONLY** | Requires HTTP/HTTPS request to trigger domain recognition | `curl -k "https://example.com"` |
| **Strict mode** + **IP rules** (no domain) | `telnet`, `nc`, `curl` | 4-tuple matching works normally | `telnet 203.0.113.10 443` |

### Common Testing Mistakes

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The 'Correct' example presents curl -k as the proper way to test HTTPS domain recognition, which is insecure because it suppresses certificate checks. Users may internalize this as recommended operational practice and accidentally bypass genuine certificate failures, leading to unsafe troubleshooting habits and false assurance about the security of the tested service.

Content

Scanner excerpt · references/diagnosis.md (reported line 168)May include surrounding context.

✅ Correct: Using curl to test domain rules in strict mode

bash

curl -k "https://example.com"
# Correct: curl sends HTTP request with Host header
# Result: Domain recognized, Layer 7 rule matched correctly

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented standards transform the skill from a passive diagnostic advisor into an active CLI-driven operator by requiring command execution, output collection, and conclusions based on live responses. Even if the commands are nominally read-only, this still increases access to sensitive operational metadata and violates least-privilege and user-consent expectations for the skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file explicitly mandates real CLI execution for every diagnostic step, which directly conflicts with the skill’s declared text-only, read-only console guidance. This creates a capability expansion risk: an agent using this reference could be induced to perform live environment actions and process real cloud data when the user and platform expect advisory-only behavior.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

### 2. NO Script Generation

- ❌ NEVER generate configuration scripts (bash, python, etc.)
- ❌ NEVER output rule JSON examples
- ❌ NEVER write executable CLI commands for configuration
- ❌ NEVER save files to outputs directory or any location

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/security_rules.md (reported line 18)May include surrounding context.

md

### 2. NO Script Generation

- ❌ NEVER generate configuration scripts (bash, python, etc.)
- ❌ NEVER output rule JSON examples
- ❌ NEVER write executable CLI commands for configuration
- ❌ NEVER save files to outputs directory or any location

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

**Install plugin if missing** (requires explicit user confirmation before execution): `aliyun plugin install cloudfw`  
**Credentials**: `ALIBABA_CLOUD_ACCESS_KEY_ID` / `ALIBABA_CLOUD_ACCESS_KEY_SECRET` env vars. See `references/ram-policies.md`.  
**Region**: Always use `cn-hangzhou` (Cloud Firewall is a global service, do NOT ask user for region).

---

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/cli_traps.md (reported line 16)May include surrounding context.

md

**Facts**:
- Cloud Firewall is a **global service**. Rule configuration is independent of Region.
- Any Region (e.g., `cn-hangzhou`) can be used to call the API.
- **Do NOT ask the user for the Region where assets are located.**

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/ram-policies.md (reported line 3)May include surrounding context.

md

# RAM Permission List

The RAM permissions required by this skill are read-only only; no write permissions are needed.

## Cloud Firewall Query Permissions

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/security_rules.md (reported line 9)May include surrounding context.

md

## ❌ Forbidden Actions (Zero Tolerance)

### 1. NO Write Operations

- ❌ NEVER call Create*/Update*/Delete* APIs
- ❌ NEVER modify Cloud Firewall rules, policies, or configurations

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction says to 'Always use cn-hangzhou' and explicitly says not to ask the user for region. This imposes a fixed locale/region choice in natural language without offering user selection or documenting a clear policy/compliance justification in this file.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest limits the skill to text-only diagnostic guidance and queries with no configuration changes. While most commands are read-only Cloud Firewall queries, the guidance to run aliyun plugin install --names aliyun-cli-cloudfw introduces local environment modification/setup behavior that is not directly part of ACL diagnosis itself.

Content

No source excerpt is available for this finding.