Security audit

Alibabacloud Cfw Ips Event

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Cloud Firewall queries fit its purpose, but it also changes local Aliyun CLI/plugin settings and gives risky credential setup guidance while presenting itself as read-only.

Install only after reviewing the setup commands and confirming you are comfortable with an agent using your Alibaba Cloud profile to read Cloud Firewall security data and modify Aliyun CLI/plugin settings. Prefer a least-privilege read-only RAM policy or temporary credentials, avoid entering long-lived access keys in command lines, and verify AI-mode and auto-plugin-install settings after use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill repeatedly claims to be read-only, but its documented workflow performs local state changes such as enabling auto-plugin install, updating plugins, enabling AI mode, and disabling AI mode. This mismatch can mislead users and higher-level safety controls into approving execution under the false assumption that no local modifications occur.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The file states that all commands are safe read-only queries, yet earlier sections instruct mutation of local CLI configuration and plugin state. This creates a deceptive safety boundary that may cause automated agents or users to execute modifying commands without realizing they alter the environment.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: Installing or updating the CLI and plugins is not necessary for analyzing IPS events at skill runtime and expands the skill's capabilities beyond least privilege. It introduces software supply-chain risk and allows an ostensibly investigative skill to modify the host environment before any user-visible analysis occurs.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger description is very broad and includes common security-related phrases, making unintended invocation more likely. In this skill, accidental invocation is more dangerous because the workflow includes environment-changing commands and autonomous execution guidance.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to run installation and update commands, including a remote shell bootstrap, without a prominent user-facing warning that the system will be modified. Silent system modification is risky in agent settings because users may expect analysis only, not software deployment or upgrade.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide includes non-interactive commands that place Access Key credentials directly on the command line and documents plaintext storage in ~/.aliyun/config.json without a prominent warning about shell history, process-list exposure, or local file compromise. In an agent/automation context, this is more dangerous because users may copy-paste secrets into scripts, CI logs, or shared environments where they persist beyond intended use.

Static analysis

No suspicious patterns detected.