ClawHub
Back to skill

Security audit

alibabacloud-cfw-nat-firewall-protect

Security checks for vulnerabilities and agentic risk

Overview

The skill’s firewall-management behavior is mostly coherent, but it recommends running an unverified remote installer before using powerful cloud permissions.

Install only after reviewing the Alibaba Cloud CLI installation source through an official, verifiable channel. Use least-privilege RAM policies, run dry-runs and assessments first, and be careful with enable/disable or create operations because they can change firewall routing and cloud network resources.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The install guide instructs users to execute a remote script directly via curl ... | bash, which creates a supply-chain and command-execution risk: if the remote host, CDN path, TLS trust chain, or downloaded script is compromised, arbitrary code will run immediately on the user's machine. In a security-focused skill that manages firewall infrastructure, this context increases risk because users are likely to run the command in privileged operational environments.

Content

Scanner excerpt · scripts/validate-cli.sh (reported line 71)May include surrounding context.

sh
=== Alibaba Cloud CLI Installation & Setup Guide ===

1. Install CLI (>= 3.3.3):
   curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash

2. Verify installation:
   aliyun version

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

This warning message recommends updating the CLI by piping a fetched remote script directly into bash, exposing users to arbitrary code execution if the installer source is tampered with. Because this suggestion is surfaced during normal validation flow, it may condition operators to run an unsafe command in environments that hold cloud credentials and administrative access.

Content

Scanner excerpt · scripts/validate-cli.sh (reported line 131)May include surrounding context.

sh
CLI_VERSION_OK="true"
    else
      CLI_VERSION_OK="false"
      log_warn "CLI version ${CLI_VERSION} is below minimum ${MIN_CLI_VERSION}. Run: curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash"
    fi
  fi
else

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

When the CLI is missing, the script tells users to install it with curl ... | bash, again encouraging direct execution of unverified remote content. This is a classic supply-chain pattern that can lead to full host compromise, especially dangerous for administrators preparing firewall and network-security tooling.

Content

Scanner excerpt · scripts/validate-cli.sh (reported line 135)May include surrounding context.

sh
fi
  fi
else
  log_warn "Alibaba Cloud CLI not installed. Install with: curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash"
fi

# --- Check auto plugin install ---

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The | bash construct is the dangerous execution step that turns a network fetch into immediate shell execution without an opportunity for integrity verification or review. In this skill's context, users may be operators with elevated privileges and cloud credentials, so compromise of the fetched script could quickly cascade into infrastructure takeover or credential theft.

Content

Scanner excerpt · scripts/validate-cli.sh (reported line 71)May include surrounding context.

sh
=== Alibaba Cloud CLI Installation & Setup Guide ===

1. Install CLI (>= 3.3.3):
   curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash

2. Verify installation:
   aliyun version