ClawHub
Back to skill

Security audit

Alibabacloud Cfw Ips Event

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a read-only Alibaba Cloud Firewall alert analyzer, but its setup instructions can execute remote installer code and persistently change local CLI/plugin behavior.

Install only after reviewing the setup steps. Prefer installing Aliyun CLI through a trusted package manager or verified pinned download, avoid curl-to-bash, do not enable automatic plugin installation globally unless you accept that persistent change, and use a dedicated read-only RAM profile for Cloud Firewall queries. Do not paste real access keys into agent-visible command lines or transcripts.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:36
Finding

Mutable Remote Installation Script Executed Directly by Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:36-39
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: Critical

bash
> **Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.

Technical Analysis

The instruction pipes content retrieved from an external URL directly into Bash. The script is not version-pinned, saved for inspection, or validated with a cryptographic checksum or digital signature before execution. Consequently, the effective code can change after the Skill package has been reviewed.

HTTPS protects the connection but does not establish that every future version of the mutable script is safe. Compromise of the distribution infrastructure, publishing credentials, DNS resolution, certificate trust path, or upstream installer could turn this command into an arbitrary code-execution mechanism.

Direct remote script execution is not required for the declared read-only IPS analysis. Installation can be performed separately through a verified package manager or a pinned and integrity-checked artifact.

Attack Path

  1. A user invokes the Skill on a host where the Aliyun CLI is absent or older than the required version.
  2. The Agent follows the prerequisite and requests the mutable setup.sh resource.
  3. The remote response is streamed directly to Bash without local review or integrity validation.
  4. A compromised or malicious response executes with the privileges of the Agent process.
  5. The payload can access files and credentials available to that account, modify local configuration, download further payloads, or attempt persistence or privilege escalation.

Impact Assessment

Successful exploitation provides arbitr ...[truncated 321 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash instruction from the automated workflow.
  • Require CLI installation to occur separately and only after explicit user approval.
  • Prefer a trusted operating-system package manager whose packages are signed and versioned.
  • If direct download is unavoidable, use an explicit versioned URL rather than a mutable installer.
  • Download the artifact without executing it, validate a vendor-published SHA-256 checksum or digital signature obtained through a separate trusted channel, and inspect it before installation.
  • Run installation with the lowest practical operating-system privileges.
  • Document the expected version and checksum so installation remains reproducible and auditable.

T08 · Insecure Dependencies

Error
Location
SKILL.md:41
Finding

Mandatory Unpinned Plugin Installation and Update

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:41-44
Vulnerability Type: Unpinned dependency retrieval and persistent automatic installation configuration
Risk Level: High

bash
> **Pre-check: Aliyun CLI plugin update required**
> [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date.

Technical Analysis

The Skill unconditionally enables automatic plugin installation and updates installed plugins to the latest available versions. No compatible version is pinned, and no independent checksum, signature, or provenance verification is specified.

This allows plugin code published after the Skill audit to become part of the execution path. Enabling automatic installation also changes persistent CLI configuration beyond the needs of the current read-only query operation. Future CLI commands may retrieve or load additional plugin code without a separate approval decision.

Checking for a compatible Cloud Firewall plugin may be necessary, but globally enabling automatic installation and forcing every existing plugin to update exceeds the minimum behavior required for IPS analysis.

Attack Path

  1. A user invokes the Skill with an existing authenticated Aliyun CLI profile.
  2. The Skill persistently enables automatic plugin installation.
  3. It requests the latest available plugin updates without pinning versions.
  4. A compromised repository, publishing account, distribution channel, or malicious upstream release supplies altered plugin code.
  5. A subsequent aliyun cloudfw invocation loads or executes the retrieved component in the authenticated user context.
  6. The component can access local data available to the CLI process and make cloud requests using the configured credential chain.

Impact Assessment

Exploitation can yield code execution under the ...[truncated 356 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not enable global automatic plugin installation as a mandatory prerequisite.
  • Detect whether the specific cloudfw plugin and a known-compatible version are already present.
  • Pin the plugin to an explicitly reviewed version.
  • Verify package signatures, checksums, and repository provenance before installation.
  • Obtain explicit user approval before downloading or updating executable components.
  • Avoid updating unrelated installed plugins.
  • If automatic installation must be enabled temporarily, record the prior setting and restore it at every exit path.
  • Execute cloud queries with a dedicated credential profile containing only the seven documented read-only permissions.

T08 · Insecure Dependencies

Error
Location
references/cli-installation-guide.md:39
Finding

Unverified Mutable CLI Binaries Installed into a System-Wide Executable Path

Content
View full analysis

Vulnerability Details

File Location: references/cli-installation-guide.md:39-45
Vulnerability Type: Unverified binary installation from a mutable dependency URL
Risk Level: High

bash
**Debian/Ubuntu**
```bash
# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

Equivalent unverified installation patterns also appear for macOS and other Linux architectures at references/cli-installation-guide.md:22-30, 52-58, and 65-71.

Technical Analysis

The guide retrieves a mutable latest archive, extracts an executable from it, and moves that executable into /usr/local/bin with sudo. It does not pin a release version or validate a vendor signature or cryptographic checksum.

A malicious archive can therefore replace the expected CLI with attacker-controlled executable code. Installing it in a system-wide path increases trust and exposure because future shell sessions, users, scripts, and automation may resolve aliyun to the altered binary.

The use of sudo does not necessarily execute the binary during installation, but it authorizes modification of a privileged executable directory. This is broader than required to perform a user-scoped, read-only cloud query.

Attack Path

  1. A user follows the referenced installation guide.
  2. The mutable latest URL returns a compromised or malicious archive.
  3. The archive is extracted without checksum or signature verification.
  4. The user moves the attacker-controlled aliyun executable into /usr/local/bin using sudo.
  5. The Skill or another user later invokes aliyun.
  6. The malicious executable runs, potentially capturing CLI arguments and credentials, altering API results, or executing additional local commands.

Impact Assessment

The malicious binary executes with the privileges of each user who i ...[truncated 297 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace every mutable latest URL with an explicit, reviewed version.
  • Publish and verify a SHA-256 or stronger digest through a separate trusted channel.
  • Prefer vendor-signed packages and verify their digital signatures.
  • Use a trusted package manager when available.
  • Avoid sudo and system-wide installation when a user-local executable directory is sufficient.
  • Extract archives into a newly created restricted directory and verify expected filenames before moving files.
  • Prevent archive traversal and symlink attacks during extraction.
  • Record the installed version and verified digest for reproducibility.

T09 · Insecure Skill Coding Practices

Warning
Location
references/cli-installation-guide.md:103
Finding

Cloud Credentials Recommended as Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: references/cli-installation-guide.md:103-111
Vulnerability Type: Sensitive credentials exposed through command arguments and automation logs
Risk Level: Medium

bash
### Quick Start

```bash
aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

text

Related examples containing access keys or STS tokens occur at `references/cli-installation-guide.md:129-165` and `232-242`.

### Technical Analysis

The guide recommends passing long-lived access keys and temporary tokens as command-line arguments for scripts, CI/CD pipelines, and Agent-driven automation. Real values supplied this way may be exposed through shell history, process inspection, terminal capture, CI logs, debugging output, or Agent transcripts.

This guidance contradicts the main Skill’s security rule prohibiting literal credentials in `aliyun configure set` commands. Environment variables shown elsewhere in the guide can also expose credentials to child processes and accidental environment logging, although they generally avoid shell argument history.

### Attack Path

1. A user or automation system copies the documented configuration command.
2. Real Access Key ID, Access Key Secret, or STS token values are substituted into the command.
3. The command is recorded in shell history, CI job output, process telemetry, terminal logs, or an Agent transcript.
4. Another local user, compromised process, log reader, or CI administrator retrieves the credentials.
5. The attacker authenticates to Alibaba Cloud and performs operations permitted by the associated RAM identity until the credentials expir
...[truncated 454 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the recommendation to provide secrets through command-line flags.
  • Keep credential configuration outside Agent sessions and captured automation transcripts.
  • Prefer workload identity, ECS RAM roles, or short-lived role-based credentials that do not require static secrets.
  • Where supported, use a secure credential helper or an interactive no-echo input mechanism.
  • Store CI credentials in the platform’s protected secret store and inject them only into the minimum required process.
  • Disable command tracing and ensure secrets are masked in logs.
  • Use dedicated RAM identities with only the seven documented read-only Cloud Firewall permissions.
  • Rotate and revoke credentials immediately if they may have appeared in history or logs.
  • Ensure ~/.aliyun/config.json is permission-restricted and never committed to source control.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (26)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill instructs piping a remotely fetched script directly into bash to install or update the CLI. This is dangerous because it executes unreviewed remote code in the user's environment, creating a direct path to arbitrary code execution if the upstream server, network path, or distribution mechanism is compromised.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

Fetching a remote script and piping it directly to bash is a classic arbitrary code execution pattern. In an agent skill, this is especially dangerous because users may expect cloud log analysis, not unaudited code execution on the local machine, making compromise of the host or developer workstation plausible.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
> **Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.

> **Pre-check: Aliyun CLI plugin update required**

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are extremely broad and overlap with ordinary security discussions such as 'any attacks' or 'security incidents'. This increases the chance the skill auto-activates in contexts where the user did not intend host/network actions, causing unexpected command execution or environment changes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The instruction 'Do NOT ask the user for anything. Just run the commands' promotes fully autonomous execution of networked CLI commands. In this skill's context, that is dangerous because it suppresses user consent despite credential use, host changes elsewhere in the workflow, and external cloud queries.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
**Capability Level**: Query (read-only)

**Data Source**: All data is obtained **exclusively** through Aliyun CLI commands (`aliyun cloudfw ...`). No log files, no databases, no server access, no SIEM — just CLI commands. **Do NOT search the workspace for files. Do NOT ask the user for anything. Just run the commands.**

**Core Capabilities**:
1. **Alert Overview** — IPS alert statistics including attack counts, block counts, and severity distribution

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly says 'Do NOT ask the user for anything. Just run the commands,' which encourages immediate system and network actions without informed user approval. In this context, that is risky because the workflow includes credential checks, plugin operations, and cloud API calls that should require transparent notice and consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes an IPS event analysis capability, but the workflow also performs local installation, plugin maintenance, and CLI configuration management. This scope expansion is risky because a user invoking a read/query skill may unknowingly authorize software changes on the host, increasing attack surface and violating least privilege.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md
> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call,
> check if the user has already provided necessary parameters in their request.
> - If the user's request **explicitly mentions** a parameter value (e.g., "check IPS alerts for the last 7 days" means use 7-day time range), use that value directly **without asking for confirmation**.
> - For optional parameters with sensible defaults (PageSize, CurrentPage, time ranges), use the defaults without asking unless the user indicates otherwise.
> - Do NOT re-ask for parameters that the user has clearly stated.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md
> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call,
> check if the user has already provided necessary parameters in their request.
> - If the user's request **explicitly mentions** a parameter value (e.g., "check IPS alerts for the last 7 days" means use 7-day time range), use that value directly **without asking for confirmation**.
> - For optional parameters with sensible defaults (PageSize, CurrentPage, time ranges), use the defaults without asking unless the user indicates otherwise.
> - Do NOT re-ask for parameters that the user has clearly stated.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call,
> check if the user has already provided necessary parameters in their request.
> - If the user's request **explicitly mentions** a parameter value (e.g., "check IPS alerts for the last 7 days" means use 7-day time range), use that value directly **without asking for confirmation**.
> - For optional parameters with sensible defaults (PageSize, CurrentPage, time ranges), use the defaults without asking unless the user indicates otherwise.
> - Do NOT re-ask for parameters that the user has clearly stated.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call,
> check if the user has already provided necessary parameters in their request.
> - If the user's request **explicitly mentions** a parameter value (e.g., "check IPS alerts for the last 7 days" means use 7-day time range), use that value directly **without asking for confirmation**.
> - For optional parameters with sensible defaults (PageSize, CurrentPage, time ranges), use the defaults without asking unless the user indicates otherwise.
> - Do NOT re-ask for parameters that the user has clearly stated.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
78% confidence
Finding

Automatically applying defaults for time ranges and pagination without user confirmation can cause the agent to initiate cloud queries the user did not explicitly scope. In a skill that also instructs immediate command execution, this increases the risk of unintended data access and operational actions.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md
> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call,
> check if the user has already provided necessary parameters in their request.
> - If the user's request **explicitly mentions** a parameter value (e.g., "check IPS alerts for the last 7 days" means use 7-day time range), use that value directly **without asking for confirmation**.
> - For optional parameters with sensible defaults (PageSize, CurrentPage, time ranges), use the defaults without asking unless the user indicates otherwise.
> - Do NOT re-ask for parameters that the user has clearly stated.

| Parameter Name | Required/Optional | Description | Default Value |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Defaulting the region automatically can direct queries to a production or mainland environment without explicit user intent. In cloud environments, implicit region selection can lead to querying the wrong tenant scope, privacy issues, or misleading analysis.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md
| Parameter Name | Required/Optional | Description | Default Value |
|---------------|-------------------|-------------|---------------|
| RegionId | Required | Alibaba Cloud region for Cloud Firewall. Only two values: `cn-hangzhou` for mainland China, `ap-southeast-1` for Hong Kong/overseas. | `cn-hangzhou` (use directly without asking; only use `ap-southeast-1` if user explicitly mentions Hong Kong/overseas/international) |
| StartTime | Required for most APIs | Start time for alert queries (Unix timestamp in seconds) | 24 hours ago for "today", 7 days ago for "recently"/"this week" (use without asking) |
| EndTime | Required for most APIs | End time for alert queries (Unix timestamp in seconds) | Current time (use without asking) |
| PageSize | Optional | Number of items per page for paginated APIs | 50 (use without asking) |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
77% confidence
Finding

Silently choosing default start and end times can cause unanticipated data retrieval from cloud security logs. While lower risk than code execution, it still removes user control over query scope and may expose more information than intended.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
| Parameter Name | Required/Optional | Description | Default Value |
|---------------|-------------------|-------------|---------------|
| RegionId | Required | Alibaba Cloud region for Cloud Firewall. Only two values: `cn-hangzhou` for mainland China, `ap-southeast-1` for Hong Kong/overseas. | `cn-hangzhou` (use directly without asking; only use `ap-southeast-1` if user explicitly mentions Hong Kong/overseas/international) |
| StartTime | Required for most APIs | Start time for alert queries (Unix timestamp in seconds) | 24 hours ago for "today", 7 days ago for "recently"/"this week" (use without asking) |
| EndTime | Required for most APIs | End time for alert queries (Unix timestamp in seconds) | Current time (use without asking) |
| PageSize | Optional | Number of items per page for paginated APIs | 50 (use without asking) |
| CurrentPage | Optional | Page number for paginated APIs | 1 (use without asking) |

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill claims to be read-only, but it also instructs the agent to modify local CLI state by enabling/disabling AI mode and updating configuration elsewhere in the workflow. This is dangerous because it expands the skill's authority beyond passive querying, can alter the operator's environment, and may mislead users into consenting to changes they would not expect from a read-only analysis skill.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md
> **CRITICAL: This skill is read-only (query only).** All commands below are safe, read-only queries that do not modify any cloud resources.
> Before executing, confirm the execution plan with the user: briefly list which steps will be executed and the target region. Proceed only after user confirmation.
> Do NOT ask the user which specific APIs to call or what data sources to use — those are determined by the workflow below.
> The intent routing table below is for **optimization only** — if the user's intent is unclear, plan to execute ALL steps (Step 1-7) by default.

### Intent Routing (Auto-determined, Confirm Before Execution)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
84% confidence
Finding

The skill authorizes auto-adding sensitive filters such as source and destination IPs with 'no confirmation needed'. That can cause targeted investigation of specific assets or private IPs without explicit user approval, which is more sensitive than generic summary queries.

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event

text

Optional filter parameters (auto-added based on user intent, no confirmation needed):
- By direction: `--Direction in` or `--Direction out`
- By source IP: `--SrcIP x.x.x.x` (query "attacks initiated by a specific IP")
- By target IP: `--DstIP x.x.x.x` (query "attacks on a specific server/IP", **supports private IPs like 10.x.x.x**)

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-analysis.md (reported line 86)May include surrounding context.

md
"CountryName": String,      // Country name
        "CityName": String          // City name
      },
      "ResourcePrivateIPList": [    // Array of targeted private resources
        {
          "ResourceInstanceName": String,  // Resource instance name
          "ResourcePrivateIP": String,     // Private IP address

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-analysis.md (reported line 199)May include surrounding context.

text
{
  "RequestId": String,              // Request ID
  "AttackApps": [                   // Array of top attacked apps (NOTE: not "AppList")
    {
      "App": String,                // Application name (NOTE: not "AttackApp")
      "AttackCnt": Integer,         // Attack count

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide instructs users to pass access keys directly on the command line when configuring the CLI, which can expose secrets through shell history, process listings, CI logs, and persistent local config storage. While the document later mentions general security best practices, the lack of an inline warning at the exact credential-entry step makes accidental credential leakage materially more likely.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md
1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash
# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting