T08 · Insecure Dependencies
Error
- Location
SKILL.md:18- Finding
Unpinned Alibaba Cloud CLI Plugin Update During Skill Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Alibabacloud Cms Alert Rule Create
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly aligned with managing Alibaba Cloud alerts, but it needs review because it updates CLI plugins at runtime and gives unsafe templates for authenticated cloud changes.
Install only if you intend to let an agent operate the Alibaba Cloud CLI against your account. Use a least-privileged RAM identity, review every generated command and JSON body before execution, avoid runtime plugin updates unless you can verify the plugin version, and be especially careful with delete/disable/update examples outside the core create/query flow.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
references/step5-preview-execute.md:56- Finding
Unsafe Textual Interpolation of User-Controlled Values into Shell and JSON Command Templates
- Content
View full analysis
" \ --rule-name "" \ --namespace "" \ --metric-name "" \ --resources '' \ --escalations--comparison-operator "" \ --escalations--statistics "Average" \ --escalations--threshold \ --escalations--times \ --contact-groups "" \ --silence-time 300 \ --effective-interval "00:00-23:59" \ --interval 60 \ --region "" ``` CMS 2.0 webhook query template: ```bash export ALIBABA_CLOUD_USER_AGENT="AlibabaCloud-Agent-Skills/alibabacloud-cms-alert-rule-create" aliyun cms list-alert-webhooks --page-size 50 --workspace "{user_provided_workspace}" --read-timeout 30 ``` CMS 2.0 alert creation template: ```bash export ALIBABA_CLOUD_USER_AGENT="AlibabaCloud-Agent-Skills/alibabacloud-cms-alert-rule-create" aliyun cms manage-alert-rules --body '{ "action": "CREATE", "workspace": "{user_provided_workspace}", "displayName": "", "contentTemplate": "", "enabled": true, "datasourceConfig": { "type": "", "instanceId": "", "regionId": "" }, "queryConfig": { "type": "", ... }, "conditionConfig": { "type": "", "severity": "", "operator": "", "threshold": , "durationSecs": }, "scheduleConfig": { "type": "FIXED", "intervalSecs": 60 }, "actionIntegrationConfig": { "enabled": false, "actions": [] }, "arm ...[truncated 3350 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (29)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description presents a full CLI skill for creating and querying alert rules across multiple Alibaba Cloud monitoring systems, including automatic routing by alert type. The actual code chunk is only a validation helper script. While it is related to alert-rule setup, it does not perform the core declared actions of creating, listing, or querying rules, nor does it show support for Prometheus/APM/UModel workflows. The only external access is a best-effort contact-group lookup through the Alibaba CLI, which is consistent with validation support. This is therefore a material description-to-behavior mismatch: the code is a supporting component, not the described end-user skill behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough that the skill may activate for generic monitoring or alert-related requests without clear user intent to manage Alibaba Cloud CMS rules. In an agent setting, overbroad routing can cause the wrong skill to collect parameters, query cloud resources, or prepare state-changing CLI commands in an unintended context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The mandatory confirmation example requires a Chinese-only confirmation block and explicitly says the agent "MUST output" that block before proceeding. This imposes a language choice on users without offering locale selection or documenting a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The document is written entirely in Chinese and presents itself as authoritative operational guidance without any note that language is selectable or limited to a specific audience. This can violate a language/locale policy when a skill effectively forces one language for all users without opt-in or justification.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md |------|------|----------| | `cms:DescribeProjectMeta` | 列出云产品 namespace | 步骤 1/2 | | `cms:DescribeMetricMetaList` | 查询 namespace 下的可用指标 | 步骤 2 | | `cms:DescribeContactGroupList` | 查询已有的联系人组 | 步骤 4 | | `cms:PutContact` | 创建新的告警联系人 | 步骤 4 | | `cms:PutContactGroup` | 创建新的联系人组 | 步骤 4 | | `cms:PutResourceMetricRule` | 创建告警规则 | 步骤 5 |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md |------|------|----------| | `cms:DescribeProjectMeta` | 列出云产品 namespace | 步骤 1/2 | | `cms:DescribeMetricMetaList` | 查询 namespace 下的可用指标 | 步骤 2 | | `cms:DescribeContactGroupList` | 查询已有的联系人组 | 步骤 4 | | `cms:PutContact` | 创建新的告警联系人 | 步骤 4 | | `cms:PutContactGroup` | 创建新的联系人组 | 步骤 4 | | `cms:PutResourceMetricRule` | 创建告警规则 | 步骤 5 |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md |------|------|----------| | `cms:DescribeProjectMeta` | 列出云产品 namespace | 步骤 1/2 | | `cms:DescribeMetricMetaList` | 查询 namespace 下的可用指标 | 步骤 2 | | `cms:DescribeContactGroupList` | 查询已有的联系人组 | 步骤 4 | | `cms:PutContact` | 创建新的告警联系人 | 步骤 4 | | `cms:PutContactGroup` | 创建新的联系人组 | 步骤 4 | | `cms:PutResourceMetricRule` | 创建告警规则 | 步骤 5 |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md |------|------|----------| | `cms:DescribeProjectMeta` | 列出云产品 namespace | 步骤 1/2 | | `cms:DescribeMetricMetaList` | 查询 namespace 下的可用指标 | 步骤 2 | | `cms:DescribeContactGroupList` | 查询已有的联系人组 | 步骤 4 | | `cms:PutContact` | 创建新的告警联系人 | 步骤 4 | | `cms:PutContactGroup` | 创建新的联系人组 | 步骤 4 | | `cms:PutResourceMetricRule` | 创建告警规则 | 步骤 5 |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md |------|------|----------| | `cms:DescribeProjectMeta` | 列出云产品 namespace | 步骤 1/2 | | `cms:DescribeMetricMetaList` | 查询 namespace 下的可用指标 | 步骤 2 | | `cms:DescribeContactGroupList` | 查询已有的联系人组 | 步骤 4 | | `cms:PutContact` | 创建新的告警联系人 | 步骤 4 | | `cms:PutContactGroup` | 创建新的联系人组 | 步骤 4 | | `cms:PutResourceMetricRule` | 创建告警规则 | 步骤 5 |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md |------|------|----------| | `cms:DescribeProjectMeta` | 列出云产品 namespace | 步骤 1/2 | | `cms:DescribeMetricMetaList` | 查询 namespace 下的可用指标 | 步骤 2 | | `cms:DescribeContactGroupList` | 查询已有的联系人组 | 步骤 4 | | `cms:PutContact` | 创建新的告警联系人 | 步骤 4 | | `cms:PutContactGroup` | 创建新的联系人组 | 步骤 4 | | `cms:PutResourceMetricRule` | 创建告警规则 | 步骤 5 |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md |------|------|----------| | `cms:DescribeProjectMeta` | 列出云产品 namespace | 步骤 1/2 | | `cms:DescribeMetricMetaList` | 查询 namespace 下的可用指标 | 步骤 2 | | `cms:DescribeContactGroupList` | 查询已有的联系人组 | 步骤 4 | | `cms:PutContact` | 创建新的告警联系人 | 步骤 4 | | `cms:PutContactGroup` | 创建新的联系人组 | 步骤 4 | | `cms:PutResourceMetricRule` | 创建告警规则 | 步骤 5 |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill is written as Chinese-only operational guidance, including headings, workflow, and user-facing output instructions, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The routing instructions, clarification prompt, and unsupported-case response are all authored in Chinese, and the document does not state that language should follow the user's preference. This can amount to forcing a specific language/locale without opt-in, which violates the language-choice policy.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The routing logic sends generic query requests like '查看告警规则' or 'show alert rules' to CMS 1.0 by default even when the user has not identified the monitored product or whether they mean Prometheus/APM/UModel rules. In this skill, that can cause the agent to query the wrong backend, return incomplete or misleading results, and potentially expose unrelated cloud-resource alert metadata when the user intended a different scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file’s headings, instructions, and examples are all in Chinese, and there is no natural-language indication that users may choose another language or that the skill is intentionally limited to Chinese-speaking users. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file presents all user-facing instructions and examples exclusively in Chinese. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and no alternative language option or justification is provided here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill is written in Chinese and includes operational guidance and examples only in Chinese, with no indication that the user may choose another language or that the skill is restricted to a Chinese-speaking or region-specific audience. Under the policy, language constraints should be optional or explicitly justified rather than implicitly enforced.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire instruction set, confirmation template, warnings, and examples are written only in Chinese, including the user-facing confirmation prompt. This creates a natural-language locale constraint without any stated opt-in, alternative language support, or justification that the skill is intended only for a Chinese-speaking/regional context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is described as supporting alert-rule creation and querying, but the verification document also includes enable, disable, and delete operations. In an agent setting, documenting these commands broadens the effective action surface and can lead to unintended destructive changes if the agent treats reference material as executable guidance during a verification or management flow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The markdown lists destructive commands such as disable and delete without any warning, confirmation requirements, or rollback guidance. In agent-assisted environments, this increases the risk that operators or automation invoke harmful commands casually or by misinterpretation, causing loss of monitoring coverage or deletion of alert rules.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file contains user-facing instructional content only in Chinese, and nowhere indicates that the skill is intentionally limited to Chinese-speaking users or a China-specific audience. Under the language/locale policy rule, forcing a single language without opt-in or justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file presents all instructions, examples, and workflow text exclusively in Chinese. Under the policy rules, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file is written entirely in Chinese and presents the skill instructions in that language only. Under the policy, language constraints should either offer user choice or be clearly documented as a justified locale-specific constraint, which is not stated here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill file is written in Chinese and provides no indication that the user can choose another language or that the skill is restricted to a Chinese-speaking or China-only audience. The stated policy flags language or locale constraints when they are imposed without opt-in or clear justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains user-facing guidance only in Chinese, which can amount to a language/locale policy issue when no opt-in, alternative language, or justification is provided. The policy for this audit specifically calls out forced language constraints as reportable natural-language violations.
- Content