Security audit

Alibabacloud Cfw Status Overview

Security checks across malware telemetry and agentic risk

Overview

This skill mainly performs a read-only Alibaba Cloud Firewall status review, but it also pushes immediate credentialed command execution and local CLI/plugin configuration changes that users should review before installing.

Install only if you are comfortable with it running Aliyun CLI commands against your active Alibaba Cloud account. Use a least-privilege read-only RAM profile, confirm the account/profile and region before use, avoid the remote installer and automatic plugin updates unless you trust them, and check Aliyun AI-mode and plugin settings after interrupted runs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to install or update software via shell, including piping a remote script directly to bash, even though the stated purpose is a read-only firewall status query. This expands the skill from passive inspection into host modification and remote code execution, creating unnecessary supply-chain and system integrity risk.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill changes global Aliyun CLI AI-mode configuration before and after execution, which is broader than necessary for a status overview query. Modifying global client state can affect unrelated sessions, alter audit behavior, and create persistence or cleanup-failure risk if execution is interrupted.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases are broad enough to match ordinary cloud or security conversations such as 'asset management' or 'firewall overview', which can cause the skill to activate unexpectedly. In this skill, unintended activation is more dangerous because activation leads directly to command execution and environment changes without confirmation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill requires immediate shell execution and even remote installer piping without a user-facing warning or confirmation, despite potential system modification. This removes an important safety barrier and can lead to unauthorized software changes or execution of unreviewed code on the host.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide repeatedly demonstrates passing long-lived access keys and secrets directly on the command line and via exported environment variables without warning that these can leak through shell history, process listings, terminal recording, or CI/CD logs. In an automation-focused skill, users are especially likely to copy these patterns into scripts and pipelines, increasing the chance of credential exposure.

Ssd 1

Medium

Confidence: 97% confidence
Finding: The instructions use coercive language to force execution, forbid refusal, and try to override normal agent safety checks. Such framing is a strong indicator of adversarial prompt content because it attempts to bypass standard validation and compel potentially unsafe shell activity.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.