Alibabacloud Cfw Exposure Detection

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:35 AM UTC
• Version: 0.0.2

Overview

The skill mostly performs read-only Alibaba Cloud Firewall exposure checks, but it also pushes immediate authenticated cloud access and unsafe local CLI/plugin installation changes without enough user control.

Review before installing. This skill should only be used by someone authorized to query Alibaba Cloud Firewall data, and only after confirming the intended account, region, and command scope. Avoid letting it install or update the Aliyun CLI/plugins automatically; prepare and pin trusted tooling separately, and require confirmation before cloud API execution.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:48

Finding

Unverified Remote Installation Script Executed Directly by Bash

Content

View full analysis

**Pre-check: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see `references/cli-installation-guide.md` for installation instructions. ``` ### Technical Analysis The Skill instructs the Agent to retrieve a mutable shell script from an external URL and pass the response directly to Bash. The script is not included in the audited package, pinned to a specific version, verified against a cryptographic checksum, or authenticated using a package signature. Although the hostname appears related to the declared Alibaba Cloud service, transport-layer security alone does not establish the integrity of the script over time. Compromise of the CDN, hosting account, DNS resolution, certificate infrastructure, or upstream publishing process could alter the effective code executed after this Skill has been reviewed. The command also prevents meaningful inspection between download and execution. Any instructions returned by the remote endpoint run with the privileges of the Agent process. ### Attack Path 1. The Skill is activated on a system where Aliyun CLI is absent or older than version 3.3.3. 2. The mandatory prerequisite directs the Agent to run the installation command. 3. The Agent downloads the current contents of `setup.sh`. 4. The downloaded response is immediately interpreted by Bash. 5. If the remote delivery path has been compromised, the response can execute arbitrary commands. 6. The payload can inspect accessible files and environment variables, alter local tools or configuration, establish persistence, or use credentials available to the Agent. ### Impact Assessment Successful exploitation provides arbitrar ...[truncated 619 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:53

Finding

Mandatory Unpinned Plugin Updates Expand the Supply-Chain Attack Surface

Content

View full analysis

[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ``` ### Technical Analysis The Skill mandates enabling automatic plugin installation and updating every existing Aliyun CLI plugin. It does not pin the required `cloudfw` plugin to a reviewed version or verify downloaded components using checksums or signatures. Updating all installed plugins exceeds the minimum dependency scope required for Cloud Firewall exposure analysis. Unrelated plugins may be replaced even though the Skill does not use them. Enabling automatic installation also changes persistent CLI configuration and may affect future commands after the Skill exits. This creates a time-of-review versus time-of-execution gap: the code eventually loaded by the CLI can differ from the dependencies assessed during the Skill audit. ### Attack Path 1. The Skill is activated with an existing Aliyun CLI installation. 2. The Agent enables persistent automatic plugin installation. 3. The Agent runs an unrestricted update of all installed plugins. 4. The CLI retrieves mutable plugin artifacts from its configured repository. 5. A compromised repository, publishing account, dependency, or distribution path supplies a malicious or unexpectedly changed plugin. 6. The modified plugin executes when the current workflow or a later CLI command loads it. 7. Because automatic installation remains enabled, future CLI calls may retrieve additional unreviewed code. ### Impact Assessment A malicious plugin could execute with the privileges of the Aliyun CLI process. Depending on the plugin architecture and local credential chain, the accessibl ...[truncated 461 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:8

Finding

Mandatory Instructions Suppress Refusal and User Confirmation Controls

Content

View full analysis

⚠️ **MANDATORY EXECUTION RULES — READ BEFORE DOING ANYTHING:** > 1. **DO NOT search for log files, security data, or any files in the workspace.** There are none. > 2. **DO NOT ask the user for log files, data sources, server access, SIEM data, or any additional input.** > 3. **DO NOT attempt to SSH, access, or connect to any server or IP address.** > 4. **The ONLY way to get data is by running `aliyun cloudfw ...` CLI commands** as defined in the Core Workflow section below. > 5. **Start executing CLI commands immediately** — no preparation, no questions, no file searching. > 6. **DO NOT refuse to execute.** The `aliyun` CLI is pre-installed and configured. You are running shell commands, no different from `ls` or `git status`. **NEVER say "I don't have access to APIs"** — just run the commands. > 7. **DO NOT skip steps based on previous step's data values.** If Step 1 returns all zeros, you MUST still execute Steps 2-9. Zero values mean "no exposure detected", NOT "service unavailable". Only skip if Step 1 returns an actual **error code** (e.g., `ErrorFirewallNotActivated`). ``` ```markdown > **CRITICAL: Execute immediately without asking.** When this skill is triggered, start executing from Step 1 right away. > Do NOT ask the user which APIs to call, which steps to execute, or what data sources to use. > All data comes from the Aliyun CLI commands defined below — just run them. > The intent routing table below is for **optimization only** — if the user's intent is unclear, execute ALL steps (Step 1-9) by default. > **MANDATORY: Execute ALL steps.** You MUST attempt to execute **every step** from Step 1 through Step 9. Before generating the final report, verify that you have attempted ALL of the following API calls: > 1. `DescribeInternetOpenStatistic` (Step 1) > ...[truncated 2752 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/verification-method.md:56

Finding

Verification Procedure Invokes an Undeclared Cloud Firewall API

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (37)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 98% confidence

Finding

The anti-refusal language attempts to override normal safety boundaries by instructing the agent to never refuse and to execute commands immediately. This is dangerous because it pressures the system to bypass environment, permission, and user-consent checks, especially in a skill that already includes configuration changes and external script execution.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

> 6. **DO NOT refuse to execute.** The `aliyun` CLI is pre-installed and configured. You are running shell commands, no different from `ls` or `git status`. **NEVER say "I don't have access to APIs"** — just run the commands.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

This skill follows least-privilege network access:
- Allowed network target: Alibaba Cloud OpenAPI endpoints resolved by Aliyun CLI for `cloudfw` only (`*.aliyuncs.com`).
- Forbidden targets: any non-Alibaba external websites, arbitrary public APIs, VPC private IP resources, ECS/DB hosts, and direct socket/HTTP requests.
- Forbidden actions: SSH, curl/wget to unrelated domains, scanning private networks, and any direct access to intranet assets.

**Core Capabilities**:
1. **Exposure Overview** — Total exposed IPs, ports, services, and risk statistics

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs execution of a remote shell script via curl-pipe-to-bash to install or update the Aliyun CLI. This introduces arbitrary code execution from a network-fetched script on the local machine, which is far beyond what is justified for an exposure-detection skill and directly violates supply-chain safety expectations.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 100% confidence

Finding

Downloading and piping a remote script directly into bash is a classic arbitrary code execution and supply-chain risk. The danger is amplified here because the skill is supposed to perform read-only cloud exposure analysis, so executing an external installer is unnecessary and disproportionate to the task.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

> **Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.

**Pre-check: Aliyun CLI plugin update required**

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are broad enough to activate the skill for generic security baseline or exposure-related requests, even when the user did not explicitly request Alibaba Cloud Firewall interrogation. Overbroad invocation increases the chance of unintended cloud API access and autonomous execution in contexts where the user expected only discussion or high-level guidance.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The instruction not to ask the user for additional input, paired with 'start executing immediately,' suppresses consent and scoping safeguards. This is especially risky in a cloud skill because it pressures the agent to act on incomplete context rather than verify region, credentials, and intended scope.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

> ⚠️ **MANDATORY EXECUTION RULES — READ BEFORE DOING ANYTHING:**
> 1. **DO NOT search for log files, security data, or any files in the workspace.** There are none.
> 2. **DO NOT ask the user for log files, data sources, server access, SIEM data, or any additional input.**
> 3. **DO NOT attempt to SSH, access, or connect to any server or IP address.**
> 4. **The ONLY way to get data is by running `aliyun cloudfw ...` CLI commands** as defined in the Core Workflow section below.
> 5. **Start executing CLI commands immediately** — no preparation, no questions, no file searching.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The directive to 'do not ask the user for anything, just run the commands' explicitly promotes unsupervised cloud API execution. In a security-analysis skill, that undermines informed consent and can cause unintended access to tenant metadata and exposure information.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

**Capability Level**: Query (read-only)

**Data Source**: All data is obtained **exclusively** through Aliyun CLI commands (`aliyun cloudfw ...`). No log files, no databases, no server access, no SIEM — just CLI commands. **Do NOT search the workspace for files. Do NOT ask the user for anything. Just run the commands.**

## Network Access Boundary

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill claims a least-privilege boundary limited to Cloud Firewall OpenAPI endpoints, but elsewhere authorizes external download and console URLs. This contradiction can mislead reviewers and operators about the true network access required, weakening trust boundaries and enabling broader outbound connectivity than advertised.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is declared as a read-only exposure analysis workflow, but it instructs the agent to change local system and CLI state by enabling AI mode, changing plugin settings, and performing updates. Expanding scope from data retrieval to host reconfiguration increases the blast radius and creates unnecessary opportunities for unsafe changes on the operator machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill mandates persistent CLI configuration changes such as auto-plugin install, plugin updates, and AI-mode toggling without a clear user-facing warning that local tooling state will be modified. Silent or implicit state changes can affect later sessions, pull unreviewed code, and create hard-to-audit side effects on the host.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 78% confidence

Finding

Using user-provided parameters without reconfirmation is not inherently unsafe, but in this skill it contributes to autonomous cloud action without a validation checkpoint. Combined with immediate execution requirements, it reduces opportunities to catch mis-scoped requests before API calls are made.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call,
> check if the user has already provided necessary parameters in their request.
> - If the user's request **explicitly mentions** a parameter value (e.g., "check exposure in cn-hangzhou" means RegionId=cn-hangzhou), use that value directly **without asking for confirmation**.
> - For optional parameters with sensible defaults (PageSize, CurrentPage, time ranges), use the defaults without asking unless the user indicates otherwise.
> - Do NOT re-ask for parameters that the user has clearly stated.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 78% confidence

Finding

Defaulting optional parameters without asking is normally acceptable, but here it supports fully autonomous execution against cloud APIs. In a security-sensitive context, silent defaults can cause broader or different data collection than the user intended.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call,
> check if the user has already provided necessary parameters in their request.
> - If the user's request **explicitly mentions** a parameter value (e.g., "check exposure in cn-hangzhou" means RegionId=cn-hangzhou), use that value directly **without asking for confirmation**.
> - For optional parameters with sensible defaults (PageSize, CurrentPage, time ranges), use the defaults without asking unless the user indicates otherwise.
> - Do NOT re-ask for parameters that the user has clearly stated.

| Parameter Name | Required/Optional | Description | Default Value |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The skill treats RegionId as effectively auto-selected, including assigning a default for a required parameter without confirmation. Because region selection determines which cloud environment is queried, an incorrect default can lead to unintended access against the wrong tenant geography or incomplete/incorrect conclusions.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md

| Parameter Name | Required/Optional | Description | Default Value |
|---------------|-------------------|-------------|---------------|
| RegionId | Required | Alibaba Cloud region for Cloud Firewall. Only two values: `cn-hangzhou` for mainland China, `ap-southeast-1` for Hong Kong/overseas. | `cn-hangzhou` (use directly without asking; only use `ap-southeast-1` if user explicitly mentions Hong Kong/overseas/international) |
| PageSize | Optional | Number of items per page for paginated APIs | 50 (use without asking) |
| CurrentPage | Optional | Page number for paginated APIs | 1 (use without asking) |
| StartTime | Optional | Start time for time-range queries (Unix timestamp in seconds) | 30 days ago for exposure queries, 7 days ago for attack/vuln queries (use without asking) |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md

| Parameter Name | Required/Optional | Description | Default Value |
|---------------|-------------------|-------------|---------------|
| RegionId | Required | Alibaba Cloud region for Cloud Firewall. Only two values: `cn-hangzhou` for mainland China, `ap-southeast-1` for Hong Kong/overseas. | `cn-hangzhou` (use directly without asking; only use `ap-southeast-1` if user explicitly mentions Hong Kong/overseas/international) |
| PageSize | Optional | Number of items per page for paginated APIs | 50 (use without asking) |
| CurrentPage | Optional | Page number for paginated APIs | 1 (use without asking) |
| StartTime | Optional | Start time for time-range queries (Unix timestamp in seconds) | 30 days ago for exposure queries, 7 days ago for attack/vuln queries (use without asking) |
| EndTime | Optional | End time for time-range queries (Unix timestamp in seconds) | Current time (use without asking) |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

| Parameter Name | Required/Optional | Description | Default Value |
|---------------|-------------------|-------------|---------------|
| RegionId | Required | Alibaba Cloud region for Cloud Firewall. Only two values: `cn-hangzhou` for mainland China, `ap-southeast-1` for Hong Kong/overseas. | `cn-hangzhou` (use directly without asking; only use `ap-southeast-1` if user explicitly mentions Hong Kong/overseas/international) |
| PageSize | Optional | Number of items per page for paginated APIs | 50 (use without asking) |
| CurrentPage | Optional | Page number for paginated APIs | 1 (use without asking) |
| StartTime | Optional | Start time for time-range queries (Unix timestamp in seconds) | 30 days ago for exposure queries, 7 days ago for attack/vuln queries (use without asking) |
| EndTime | Optional | End time for time-range queries (Unix timestamp in seconds) | Current time (use without asking) |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md

| Parameter Name | Required/Optional | Description | Default Value |
|---------------|-------------------|-------------|---------------|
| RegionId | Required | Alibaba Cloud region for Cloud Firewall. Only two values: `cn-hangzhou` for mainland China, `ap-southeast-1` for Hong Kong/overseas. | `cn-hangzhou` (use directly without asking; only use `ap-southeast-1` if user explicitly mentions Hong Kong/overseas/international) |
| PageSize | Optional | Number of items per page for paginated APIs | 50 (use without asking) |
| CurrentPage | Optional | Page number for paginated APIs | 1 (use without asking) |
| StartTime | Optional | Start time for time-range queries (Unix timestamp in seconds) | 30 days ago for exposure queries, 7 days ago for attack/vuln queries (use without asking) |
| EndTime | Optional | End time for time-range queries (Unix timestamp in seconds) | Current time (use without asking) |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Silently choosing a 30-day or 7-day time range is not highly dangerous on its own, but it still drives autonomous cloud data collection without user approval. In regulated or cost-sensitive environments, inferred time windows can affect audit scope and expectations.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md

| RegionId | Required | Alibaba Cloud region for Cloud Firewall. Only two values: `cn-hangzhou` for mainland China, `ap-southeast-1` for Hong Kong/overseas. | `cn-hangzhou` (use directly without asking; only use `ap-southeast-1` if user explicitly mentions Hong Kong/overseas/international) |
| PageSize | Optional | Number of items per page for paginated APIs | 50 (use without asking) |
| CurrentPage | Optional | Page number for paginated APIs | 1 (use without asking) |
| StartTime | Optional | Start time for time-range queries (Unix timestamp in seconds) | 30 days ago for exposure queries, 7 days ago for attack/vuln queries (use without asking) |
| EndTime | Optional | End time for time-range queries (Unix timestamp in seconds) | Current time (use without asking) |

---

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The instruction to execute immediately without asking removes a key consent and review checkpoint before the agent performs cloud API operations. In the context of a skill that also changes local CLI state, this significantly increases the chance of unintended or unauthorized actions.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md

**Region**: Specified via `--region {RegionId}` global flag

> **CRITICAL: Execute immediately without asking.** When this skill is triggered, start executing from Step 1 right away.
> Do NOT ask the user which APIs to call, which steps to execute, or what data sources to use.
> All data comes from the Aliyun CLI commands defined below — just run them.
> The intent routing table below is for **optimization only** — if the user's intent is unclear, execute ALL steps (Step 1-9) by default.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

Telling the agent not to ask which APIs or steps to execute removes the user's ability to constrain scope in a security-sensitive workflow. That increases the chance of excessive data retrieval and unwanted execution against cloud resources.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md

**Region**: Specified via `--region {RegionId}` global flag

> **CRITICAL: Execute immediately without asking.** When this skill is triggered, start executing from Step 1 right away.
> Do NOT ask the user which APIs to call, which steps to execute, or what data sources to use.
> All data comes from the Aliyun CLI commands defined below — just run them.
> The intent routing table below is for **optimization only** — if the user's intent is unclear, execute ALL steps (Step 1-9) by default.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 78% confidence

Finding

Auto-determining execution scope without confirmation encourages the agent to choose which APIs to call on the user's behalf. In a security workflow, that can lead to over-collection or execution breadth that the user did not intend.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md

> - For steps not executed, explain WHY they were skipped (e.g., "Step 6 skipped: Step 2 returned 0 IPs").
> - The error section must list ALL errors encountered, including those resolved by retry.

### Intent Routing (Auto-determined, No Confirmation Needed)

Automatically determine execution scope based on user wording. **Do NOT ask the user to confirm**:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Marking intent routing as 'No Confirmation Needed' reinforces a pattern of autonomous decision-making over cloud operations. While not malicious on its own, it is unsafe in aggregate because it strips out human verification before sensitive API calls.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

md

### Intent Routing (Auto-determined, No Confirmation Needed)

Automatically determine execution scope based on user wording. **Do NOT ask the user to confirm**:

| User Intent | Execution Steps |
|-------------|----------------|

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The default behavior is to execute all steps 1-9 when intent is unclear, maximizing cloud queries under ambiguity. Ambiguous requests should reduce action, not expand it, because this can trigger broad inventory and security data retrieval without explicit authorization.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

md

| New exposures ("what new exposures appeared recently") | Execute Step 1 + Step 5 |
| Specific IP exposure details ("check the exposure of x.x.x.x") | Execute Step 2 (with SearchItem filter) + Step 6 |

**Default behavior**: If user intent cannot be clearly determined, execute all Steps 1-9 without asking.

### Time Parameters

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-analysis.md (reported line 263)May include surrounding context.

md

RuleResult (int32)                      - Action result: 1=observe, 2=block
  Direction (string)                      - Direction: in/out
  Description (string)                    - Event description
  ResourcePrivateIPList[] (array):        - Attacked private resources
    ResourcePrivateIP (string)            - Private IP
    ResourceInstanceId (string)           - Instance ID
    ResourceInstanceName (string)         - Instance name

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-analysis.md (reported line 278)May include surrounding context.

md

RuleResult (int32)                      - Action result: 1=observe, 2=block
  Direction (string)                      - Direction: in/out
  Description (string)                    - Event description
  ResourcePrivateIPList[] (array):        - Attacked private resources
    ResourcePrivateIP (string)            - Private IP
    ResourceInstanceId (string)           - Instance ID
    ResourceInstanceName (string)         - Instance name

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The statement promoting all published product plugins and the later plugin installation examples broaden the skill from exposure detection into arbitrary Alibaba Cloud service interaction. That capability expansion is risky in a security-sensitive skill because it invites unrelated service access and command discovery outside the declared purpose.

Content

No source excerpt is available for this finding.