ClawHub
Back to skill

Security audit

Alibabacloud Cli Guidance

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Alibaba Cloud CLI guidance skill with expected cloud-credential and installer risks that users should handle carefully.

Install this only if you intend to manage Alibaba Cloud resources from the CLI. Prefer OAuth, STS, RAM roles, or least-privilege RAM users; avoid root credentials, avoid --insecure for real workloads, verify installer downloads where possible, and do not share debug logs without redacting secrets and resource details.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The guidance tells users to always add `--log-level debug`, which can cause verbose request/response data, serialized parameters, and other operational details to be written to the terminal or captured in logs. In a cloud CLI context, those logs may expose sensitive metadata, identifiers, request payloads, or potentially credential-related material, especially in shared shells, CI systems, or support transcripts.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Documenting `--insecure` as a way to force HTTP with only 'not recommended' understates the security risk. In a cloud-management CLI context, encouraging or normalizing plaintext transport can expose credentials, request signatures, resource identifiers, and management actions to interception or tampering, especially on untrusted networks.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The guide recommends executing a remotely fetched shell script directly with `curl | bash` and provides no integrity verification, pinning, checksum validation, or cautionary note. This creates a supply-chain risk: if the distribution host, CDN, DNS, TLS trust chain, or script is compromised, users could run arbitrary code immediately on their systems.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.