ClawHub
Back to skill

Security audit

alibabacloud-cfw-nat-firewall-protect

Security checks for vulnerabilities and agentic risk

Overview

The skill’s firewall-management behavior is mostly coherent, but it recommends running an unverified remote installer before using powerful cloud permissions.

Install only after reviewing the Alibaba Cloud CLI installation source through an official, verifiable channel. Use least-privilege RAM policies, run dry-runs and assessments first, and be careful with enable/disable or create operations because they can change firewall routing and cloud network resources.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

External Script Fetching

High
Category
Supply Chain
Content
=== Alibaba Cloud CLI Installation & Setup Guide ===

1. Install CLI (>= 3.3.3):
   curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash

2. Verify installation:
   aliyun version
Confidence
98% confidence
Finding
The install guide instructs users to execute a remote script directly via `curl ... | bash`, which creates a supply-chain and command-execution risk: if the remote host, CDN path, TLS trust chain, or downloaded script is compromised, arbitrary code will run immediately on the user's machine. In a security-focused skill that manages firewall infrastructure, this context increases risk because users are likely to run the command in privileged operational environments.

External Script Fetching

High
Category
Supply Chain
Content
CLI_VERSION_OK="true"
    else
      CLI_VERSION_OK="false"
      log_warn "CLI version ${CLI_VERSION} is below minimum ${MIN_CLI_VERSION}. Run: curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash"
    fi
  fi
else
Confidence
97% confidence
Finding
This warning message recommends updating the CLI by piping a fetched remote script directly into `bash`, exposing users to arbitrary code execution if the installer source is tampered with. Because this suggestion is surfaced during normal validation flow, it may condition operators to run an unsafe command in environments that hold cloud credentials and administrative access.

External Script Fetching

High
Category
Supply Chain
Content
fi
  fi
else
  log_warn "Alibaba Cloud CLI not installed. Install with: curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash"
fi

# --- Check auto plugin install ---
Confidence
97% confidence
Finding
When the CLI is missing, the script tells users to install it with `curl ... | bash`, again encouraging direct execution of unverified remote content. This is a classic supply-chain pattern that can lead to full host compromise, especially dangerous for administrators preparing firewall and network-security tooling.

Chaining Abuse

High
Category
Tool Misuse
Content
=== Alibaba Cloud CLI Installation & Setup Guide ===

1. Install CLI (>= 3.3.3):
   curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash

2. Verify installation:
   aliyun version
Confidence
99% confidence
Finding
The `| bash` construct is the dangerous execution step that turns a network fetch into immediate shell execution without an opportunity for integrity verification or review. In this skill's context, users may be operators with elevated privileges and cloud credentials, so compromise of the fetched script could quickly cascade into infrastructure takeover or credential theft.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/nat-fw-lifecycle.sh:1129