Alibabacloud Cloudbackup Ecs File Backup Essential Edition

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:25 AM UTC
• Version: 0.0.2

Overview

This Alibaba Cloud backup skill is mostly purpose-aligned, but it needs review because it directs broad cloud privileges and unsafe, persistent CLI/plugin installation changes.

Install only if you are comfortable reviewing installation steps first. Avoid the curl-to-bash path, do not enable persistent automatic plugin installation unless you intend that behavior, prefer the documented least-privilege RAM policy over full Cloud Backup access, and confirm destructive delete or overwrite operations carefully.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:100

Finding

Unverified Remote Installation Script Is Piped Directly into Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:100-103
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: Critical

Vulnerable Code:

markdown

> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions.

Technical Analysis

The installation instruction downloads a mutable shell script from an external URL and passes the response directly to Bash. The content is neither pinned to a reviewed release nor checked against a cryptographic signature or known digest before execution.

HTTPS provides transport authentication but does not establish payload immutability. If the hosting origin, CDN, DNS resolution, TLS trust chain, or upstream deployment process is compromised, the downloaded content can be replaced after the Skill has been reviewed. Piping the response directly into Bash also prevents meaningful inspection before execution.

This behavior is not necessary for the declared backup functionality. The included installation guide already documents package-manager and version-specific binary installation alternatives that avoid immediate execution of an arbitrary remote script.

Attack Path

1. The Skill determines that Aliyun CLI is absent or older than version 3.3.3.
2. The Agent invokes the documented curl | bash command.
3. An attacker with control over, or the ability to compromise, the remote delivery path supplies a modified setup.sh.
4. Bash executes the response immediately with the privileges of the Agent or invoking user.
5. The malicious script can access local files and credentials, modify executable files, or tamper with subsequent authenticated cloud operations.

Impact Assessment

Successful exploitation pro ...[truncated 734 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the direct curl | bash installation path.
• Pin installation to a specific reviewed CLI version rather than retrieving a mutable installer.
• Download the artifact to a local file without executing it.
• Verify a vendor-published cryptographic signature or SHA-256 digest obtained through an independently authenticated channel.
• Inspect and extract the verified archive before placing the executable in PATH.
• Prefer a trusted operating-system package manager where available.
• Require explicit user approval before installing or replacing local software.
• Run installation with ordinary user privileges whenever possible and request elevation only for the narrowly scoped file operation that requires it.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:107

Finding

Mandatory Global Plugin Updates and Persistent Automatic Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:107-134
Vulnerability Type: Unpinned dependency installation and excessive dependency modification
Risk Level: High

Vulnerable Code:

markdown

Then [MUST] run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

bash

aliyun configure set --auto-plugin-install true

bash

aliyun plugin list 2>/dev/null | grep aliyun-cli-hbr

bash

aliyun plugin install --names aliyun-cli-hbr

Technical Analysis

The Skill requires updating every existing Aliyun CLI plugin, including plugins unrelated to ECS file backup. It also persistently enables automatic plugin installation and installs or updates the HBR plugin without pinning it to the stated minimum version of 0.1.3.

No cryptographic digest or signature verification is documented for the plugin package. As a result, the exact component installed can change over time even though the Skill itself remains unchanged. Mandatory global updates also expand the supply-chain trust boundary beyond the single HBR plugin needed for the declared workflow.

Enabling --auto-plugin-install modifies persistent CLI configuration. The Skill explicitly restores AI mode at exit, but it does not similarly restore the previous automatic-plugin-installation setting. Consequently, future CLI activity outside this Skill may trigger dependency installation under a configuration changed by the Skill.

Attack Path

1. The Skill mandates aliyun plugin update, causing unrelated installed plugins to be replaced with current remote versions.
2. It permanently enables automatic plugin installation.
3. It installs the HBR plugin by name without a pinned version or documented integrity check.
4. A compromised plugin repository, publication account, delivery channel, or plugin release supplies malicious or tampered plugin code.
5. The CLI loads or ...[truncated 742 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the mandatory global aliyun plugin update operation.
• Install or update only aliyun-cli-hbr, since unrelated plugins are not required for this Skill.
• Pin the HBR plugin to a reviewed, known-compatible version where the CLI supports version selection.
• Verify plugin signatures or vendor-published cryptographic digests before use.
• Require explicit user consent before changing installed dependencies.
• Avoid enabling automatic plugin installation. If it is unavoidable, record the prior setting and restore it at every success, error, cancellation, and early-exit path.
• Execute a post-installation version check and fail closed if the resulting plugin does not match the approved version range.
• Document the trusted plugin repository and its integrity-verification mechanism.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:190

Finding

Full Cloud Backup Access Is Recommended Instead of the Available Least-Privilege Policies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:190-192 and references/ram-policies.md:90-93
Vulnerability Type: Excessive cloud-service permissions
Risk Level: Medium

Vulnerable Code:

markdown

## RAM Permissions

This Skill requires the permissions detailed in [references/ram-policies.md](references/ram-policies.md).

Recommended system policy: `AliyunHBRFullAccess`

markdown

| Policy Name | Description |
|-------------|-------------|
| `AliyunHBRFullAccess` | Full access to Cloud Backup |
| `AliyunHBRReadOnlyAccess` | Read-only access to Cloud Backup |

Technical Analysis

The primary Skill recommends AliyunHBRFullAccess, although references/ram-policies.md already provides narrower custom policies for the documented workflows. Full service access grants permissions beyond operations such as viewing status, checking quota, or inspecting restore jobs.

The risk is especially significant because the same Skill installs and executes mutable CLI plugins. If the local CLI environment or credentials are compromised, a full-access identity provides a larger cloud impact than a task-specific or read-only identity.

The documented custom write policy also omits hbr:UpdateBackupPlan, even though the Skill includes workflows that invoke update-backup-plan. This inconsistency may encourage users to adopt the full-access policy simply to avoid authorization failures rather than adding the single required action for approved update workflows.

Attack Path

1. A user follows the primary recommendation and assigns AliyunHBRFullAccess to the CLI identity.
2. The identity receives authority beyond the specific operation or ECS backup resource requested by the user.
3. A compromised dependency, stolen credential, erroneous Agent instruction, or unintended command uses that broader authority.
4. Unrelated Cloud Backup resources can be queried or modified within the scope allowed ...[truncated 772 chars]

Remediation

View remediation

Remediation Suggestions

• Make the documented least-privilege custom policy the default recommendation.
• Use the read-only policy for status, capacity, client, snapshot, and restore-job queries.
• Grant write actions only for the specific requested operation and only for the required duration.
• Add hbr:UpdateBackupPlan to the custom write policy only when schedule, retention, or priority modification workflows are required.
• Separate destructive permissions such as hbr:DeleteBackupPlan from routine backup-management permissions.
• Require explicit approval before attaching policies that permit deletion or overwrite-related recovery actions.
• Scope permissions to particular resources, regions, accounts, or conditions wherever Alibaba Cloud HBR authorization supports it.
• Treat AliyunHBRFullAccess as an exceptional troubleshooting option rather than the recommended default.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill explicitly includes a remote script fetch-and-execute command, which is a classic unsafe installation pattern. This creates a strong supply-chain and remote code execution risk because the fetched content is executed immediately without pinning, signature verification, or human review.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low, run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to update, or see references/cli-installation-guide.md for installation instructions.

bash

aliyun version

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file establishes a hard gate requiring the agent to stop and not continue when a request matches not-recommended scenarios, including custom backup policy requests. Later, the skill documents an operation to modify scheduled backup time, which contradicts the earlier mandatory halt logic and the statement that custom backup policy is unsupported.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Piping a remotely fetched script directly into bash executes internet-delivered code without verification, review, or integrity checking. If the distribution endpoint, network path, or hosting supply chain is compromised, the local machine could run arbitrary attacker-controlled commands with the user's privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to change local CLI configuration to enable automatic plugin installation without explicit user consent or warning. This alters system behavior and permits future network-fetched code/plugins to be installed implicitly, expanding the trust boundary and increasing the chance of unintended code execution or supply-chain exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest and scenario description repeatedly frame this skill as the Essential Edition with fixed once-daily backup and 30-day retention, and the documentation explicitly says custom backup policy is not supported. However, the workflows include updating the backup schedule and toggling keep-last-snapshot behavior, which are configuration-changing capabilities not aligned with the advertised zero-configuration/fixed-policy scope.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 465)May include surrounding context.

--read-timeout 60
--user-agent AlibabaCloud-Agent-Skills/alibabacloud-cloudbackup-ecs-file-backup-essential-edition

text

> `1` = keep the last backup version (recommended); `0` = do not keep; all backup points older than 30 days will be automatically deleted.

---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-3.3.3-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-3.3.3-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-3.3.3-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The permission descriptions include Chinese text inline alongside English across multiple rows, but the document does not state that it is intentionally bilingual or limited to a Chinese-speaking audience. Under the policy, forcing or assuming a specific language/locale without user opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file contains bilingual descriptions and linked documentation in Chinese throughout the reference, but it does not tell users that the skill is intended for Chinese-speaking users or offer an alternative language/localization choice. Under the language/locale policy rule, forcing or assuming a specific language context without opt-in can be a policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.