Alibabacloud Cli Guidance

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:06 AM UTC
• Version: 0.0.2

Overview

The skill is coherent Alibaba Cloud CLI guidance, but it asks users or agents to run unverified installers, enable persistent automatic plugin installation, and handle cloud credentials in ways that deserve careful review.

Install only after reviewing the setup commands. Prefer a package manager or pinned, checksum-verified downloads; avoid running curl-to-bash in a shell that already has cloud credentials; do not let an agent bulk-update plugins unless you approve the exact change; use OAuth, RAM roles, or short-lived STS credentials when possible; keep RAM permissions least-privilege; and redact debug output before sharing it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:68

Finding

Unverified Remote Installation Script Is Executed Directly by Bash

Content

View full analysis

= 3.3.3 required** — Run `aliyun version`. If too low: `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` or see `references/installation-guide.md`. ``` ```bash # Install or update (macOS / Linux — one command) /bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh)" ``` From `references/installation-guide.md`: ```bash /bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh)" ``` ### Technical Analysis The installation instructions retrieve shell code from an external URL and execute it immediately. The script is neither pinned to a specific version nor validated with a cryptographic signature or checksum before execution. HTTPS helps protect transport integrity but does not protect against compromise of the vendor origin, CDN, DNS infrastructure, release pipeline, or signing account. It also does not ensure that the script reviewed today is the same payload that will be executed later. Consequently, the effective executable behavior can change independently of the audited Skill package. The behavior is relevant to initial CLI installation, but direct `curl | bash` execution is not the minimum-risk method required to install the CLI. A staged, version-pinned, cryptographically verified installation would provide the same functionality with substantially less supply-chain exposure. ### Attack Path 1. An attacker compromises the distribution origin, CDN, DNS path, or upstream release pipeline serving `setup.sh`. 2. The attacker modifies the remotely hosted script to include arbitrary shell commands. 3. A user or agent follows the Skill's required version pre-check or reco ...[truncated 1063 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/installation-guide.md:31

Finding

Mutable CLI Archives Are Streamed into Extraction and Installed System-Wide

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:70

Finding

Mandatory Automatic Plugin Installation and Bulk Updates Expand the Supply-Chain Surface

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/installation-guide.md:73

Finding

Cloud Access Secrets Are Supplied Through Observable Command-Line Arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` The same pattern is also used for temporary tokens and role-based configuration: ```bash aliyun configure set \ --mode StsToken \ --access-key-id \ --access-key-secret \ --sts-token \ --region cn-hangzhou ``` The guide documents that AK configuration is persisted in plaintext form: ```json { "current": "default", "profiles": [ { "name": "default", "mode": "AK", "access_key_id": "", "access_key_secret": "", "region_id": "cn-hangzhou", "output_format": "json", "language": "en" } ] } ``` ### Technical Analysis Passing secrets through command-line flags exposes them to multiple observation channels, including: - Shell command history. - Process listings and process-monitoring tools. - CI/CD logs. - Shell tracing such as `set -x`. - Terminal recording. - Agent transcripts and execution telemetry. - Error-reporting systems that capture the executed command. The configuration command also writes long-lived credentials into `~/.aliyun/config.json`. Although the guide later recommends `chmod 600`, it does not ensure restrictive permissions before the credential file is created, nor does it eliminate exposure to processes running as the same user. Environment variables suggested elsewhere in the guide avoid some proces ...[truncated 1600 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The pre-check explicitly tells users to run a curl-to-bash command from an external URL, creating a direct remote code execution path. In the context of a cloud-management skill, this is especially sensitive because the same environment may also hold powerful cloud credentials, so a compromised installer could exfiltrate secrets or take follow-on actions in the user's account.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

Root **`--user-agent`** is path B semantics too — do not combine with path A for the same token. **Non-agent** copy-paste: path B is often enough; **agent** sessions: path A + disable on exit. Examples below use path A or B only, never both.

**Pre-check: Aliyun CLI >= 3.3.3 required** — Run `aliyun version`. If too low: `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` or see `references/installation-guide.md`.

**Pre-check: Aliyun CLI plugin update required** — [MUST] `aliyun configure set --auto-plugin-install true`; [MUST] `aliyun plugin update`.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The skill recommends executing a remote installer script via curl piped to bash, which is a classic arbitrary code execution pattern. If the remote host, network path, or distribution channel is compromised, users or agents could execute attacker-controlled code with the current user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

/bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh)"

text

After the CLI is at **3.3.5 or newer**, routine self-updates can use **`aliyun upgrade`** instead of the curl installer (the installer remains appropriate for first-time install or when `upgrade` is not available):

```bash
aliyun version   # confirm >= 3.3.5 before relying on upgrade

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation guidance says to use this skill whenever the user wants to operate Alibaba Cloud services from the terminal, including 'any other Alibaba Cloud product,' and also when the user mentions broad phrases like 'aliyun' or '命令行'. This scope is so expansive that it lacks clear boundaries for when the skill should not activate, increasing the risk of unintended invocation for generic cloud or command-line discussions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to export AccessKey credentials into shell environment variables without an explicit warning about secret handling, shell history exposure, process inheritance, or safer alternatives. In an agent context, this is dangerous because credentials may leak via logs, debug output, subprocesses, shared shells, or persisted session state, increasing the chance of cloud account compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide instructs users to always add --log-level debug when troubleshooting, but does not warn that debug output can capture sensitive request/response details, resource metadata, and potentially authentication-related material. In a cloud CLI context, users often run commands on shared terminals, CI systems, or persist shell output to logs, so this can lead to unintended credential or infrastructure data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide recommends executing a remote shell script directly via curl piped to bash, which bypasses inspection and integrity verification of downloaded code. In an agent skill context, users may copy-paste this command verbatim, so compromise of the hosting endpoint, CDN, or script supply chain could result in arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/installation-guide.md (reported line 37)May include surrounding context.

x86_64

bash

wget --connect-timeout=10 --read-timeout=120 --tries=3 -qO- https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz
sudo mv aliyun /usr/local/bin/

ARM64

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/installation-guide.md (reported line 43)May include surrounding context.

x86_64

bash

wget --connect-timeout=10 --read-timeout=120 --tries=3 -qO- https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz
sudo mv aliyun /usr/local/bin/

ARM64

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The guide instructs users to create long-lived AccessKey pairs and store secrets for CLI use, which increases credential persistence risk if copied into config files, shells, CI logs, or agent-managed environments. Although the document later mentions OAuth and temporary credentials, the quick-start flow still normalizes persistent secrets, which is riskier in automation-focused contexts.

Content

Scanner excerpt · references/installation-guide.md (reported line 90)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/installation-guide.md (reported line 383)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting