T03 · Remote Payload Retrieval and Execution
Error
- Location
references/cli-installation-guide.md:101- Finding
Remote Installation Script Is Executed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Alibabacloud Cms Dataset
Security checks for vulnerabilities and agentic risk
Overview
The skill has a legitimate Alibaba Cloud CMS dataset purpose, but it includes overbroad installation, plugin-update, credential, and workspace-provisioning behaviors that users should review before installing.
Install only if you are comfortable with cloud dataset mutation and query access. Prefer preinstalling a pinned, verified Aliyun CLI and required CMS plugin yourself; avoid the curl-to-bash quick setup, avoid global plugin auto-install/update, use least-privilege RAM policies scoped to the intended workspace, and require explicit confirmation before workspace creation or dataset deletion.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:25- Finding
Mandatory Automatic Plugin Installation and Unpinned Plugin Updates
- Content
View full analysis
[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ``` ### Technical Analysis The Skill mandates automatic plugin installation and updates all existing plugins without pinning versions, verifying signatures or checksums, or limiting the operation to the CMS plugin needed by the declared workflow. CLI plugins are executable dependencies. Automatically selecting the latest published version makes the code executed during future CLI operations mutable after Skill review. Updating every installed plugin also exceeds the minimum dependency scope for CMS dataset management because unrelated plugins may be changed. The configuration change may persist beyond the current workflow, causing future CLI commands to install plugins automatically. ### Attack Path 1. An attacker compromises a plugin release, repository, package publication account, or update-distribution channel. 2. The Skill enables automatic plugin installation and runs a global plugin update. 3. The compromised plugin is downloaded without a pinned version or independent integrity check. 4. The plugin is loaded by the Aliyun CLI during the current or a subsequent command. 5. Attacker-controlled plugin code executes with the user's local privileges and in the context of the configured cloud identity. ### Impact Assessment A malicious plugin could execute arbitrary local code, read files accessible to the user, access CLI configuration, or misuse available cloud credentials. Because the command updates all existing plugins, the affected scope is not limited to CMS functionality. Persistently enabling automatic instal ...[truncated 55 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
references/cli-installation-guide.md:39- Finding
Mutable CLI Archives Are Installed Into Privileged Executable Paths Without Verification
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:211- Finding
User-Controlled Descriptions Are Interpolated Into Shell Commands Unsafely
- Content
View full analysis
--dataset-name # Update after user confirms aliyun cms update-dataset --api-version 2024-03-30 \ --workspace \ --dataset-name \ --description "" ``` A similar vulnerable description template appears at `SKILL.md:170-175` for dataset creation. ### Technical Analysis The Skill instructs the agent to substitute a user-controlled description into a shell command enclosed only by double quotes. In common shells, double quotes do not neutralize command substitution such as `$(command)` or backticks. A description containing a closing quote can also terminate the intended argument and introduce shell operators. For example, textual substitution of a value such as `$(malicious-command)` inside the documented double quotes can cause the shell to execute that command before launching the Aliyun CLI. The Skill does not require argument-array execution, a proven shell-escaping routine, or rejection of shell metacharacters. Confirmation of the displayed description does not prevent injection if the approved value is later passed through a shell parser. ### Attack Path 1. An attacker supplies a crafted dataset description containing shell command substitution or quote-breaking syntax. 2. The agent inserts the value into the documented command template. 3. The command is passed to a shell. 4. The shell evaluates the injected syntax before or alongside `aliyun cms update-dataset`. 5. The attacker's local command executes with the agent process's privileges. ### Impact Assessment Exploitation can provide arbitrary local command execution under the account running the Skill. The injected process may acce ...[truncated 194 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:128- Finding
Dataset Workflow Automatically Expands Into Workspace Provisioning
- Content
View full analysis
**[MUST]** Before executing any dataset operation, call `get-workspace` to verify the workspace exists. Do NOT skip this step or use ListDatasets to infer workspace existence. ```bash aliyun cms get-workspace --api-version 2024-03-30 \ --workspace ``` If the workspace does not exist (returns error), create it via `put-workspace`: ```bash aliyun cms put-workspace --api-version 2024-03-30 \ --workspace-name \ --sls-project ``` `--sls-project` is required. If the user does not specify one, use the same value as the workspace name. ``` ### Technical Analysis The declared purpose is CMS dataset lifecycle management, but the workflow automatically expands into CMS workspace creation or update when the requested workspace is absent. `put-workspace` mutates a separate cloud resource and associates it with an SLS project. The parameter table does not declare `sls-project`, while the instruction explicitly derives a default without user approval. This contradicts the Skill's own rule that all customizable parameters must be explicitly confirmed. The RAM policy lists only dataset actions and omits the workspace permissions required by `get-workspace` and `put-workspace`, making the documented privilege requirements incomplete. A generic error is also treated as evidence that the workspace does not exist. Permission, region, network, or service errors could therefore lead to an inappropriate provisioning attempt. ### Attack Path 1. A dataset operation references a workspace that is absent, inaccessible, in another region, or affected by a transient error. 2. The initial `get-workspace` call fails. 3. The workflow interprets the failure as nonexistence. 4. If the user omi ...[truncated 557 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/cli-installation-guide.md:108- Finding
Credential Examples Expose Long-Lived Access Keys Through Shell Interfaces
- Content
View full analysis
\ --access-key-secret \ --region cn-hangzhou ``` **Where to Get Access Keys**: https://ram.console.aliyun.com/manage/ak ### Environment Variables ```bash export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret export ALIBABA_CLOUD_REGION_ID=cn-hangzhou ``` ``` ### Technical Analysis The guide encourages users to place access-key material directly into command-line text or exported environment variables. Commands may be retained in shell history, terminal logs, session transcripts, or process-observation tooling. Exported secrets are inherited by child processes and are frequently copied into persistent shell profiles in plaintext. These instructions also conflict with `SKILL.md:51-65`, which prohibits asking users to enter access keys in the conversation or command line and requires credential configuration outside the session. Contradictory guidance makes accidental exposure more likely. ### Attack Path 1. A user follows the reference guide and substitutes a real access-key secret into the command or environment export. 2. The secret is retained in shell history, a profile file, terminal logging, process environment, or a child process. 3. Another local user, process, extension, backup system, or diagnostic collector obtains the exposed value. 4. The attacker uses the access key to authenticate to Alibaba Cloud. 5. The attacker performs any cloud operations allowed by the key's RAM policies. ### Impact Assessment The immediate impact is disclosure of Alibaba Cloud credentials. The cloud impact depends on the attached RAM polic ...[truncated 240 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (16)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
Using Binary
bash # Download wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz # Extract tar -xzf aliyun-cli-macosx-latest-amd64.tgz
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
Fetching and immediately executing
https://aliyuncli.alicdn.com/setup.shgives a remote party direct code execution on the user's machine with no opportunity for inspection or integrity validation. In installation documentation, this is especially dangerous because users are primed to trust and copy-paste the command exactly, making supply-chain compromise highly impactful.- Content
Quick Setup
bash curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash aliyun version
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The
| bashconstruct creates an execution chain from network input directly into a shell interpreter, eliminating inspection boundaries and making malicious content run immediately. In a CLI installation guide, this pattern materially raises exploitation risk because a compromised script source translates directly into code execution on end-user systems.- Content
Quick Setup
bash curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash aliyun version
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documented minimum permissions omit workspace actions even though the workflow later requires get-workspace and may perform put-workspace. This mismatch can mislead reviewers and operators about the actual privilege needed, undermining least-privilege review and making the skill's effective capability broader than advertised.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | `schema` | Required (CreateDataset) | Schema JSON object | — | | `description` | Optional | Dataset description | — | | `query` | Required (ExecuteQuery) | Query text | — | | `type` | Auto-filled (ExecuteQuery) | Query type placeholder. Always `SQL`, do not ask user | `SQL` | | `max-results` | Optional (ListDatasets) | Max results per page | — | | `next-token` | Optional (ListDatasets) | Pagination token for next page | — |
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented as dataset lifecycle/query management, but its workflow expands scope to creating or modifying CMS workspaces. That increases the authority and side effects of the skill beyond what a user would reasonably expect from a dataset-focused tool, creating a risk of unintended infrastructure changes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Automatically creating a workspace when a lookup fails is an unjustified write action for a dataset-management skill. A failed existence check could lead to provisioning new resources, binding them to an SLS project, and causing cost, governance, or configuration drift without the user explicitly requesting workspace creation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Cleanup section provides a ready-to-run destructive delete command without repeating the explicit confirmation and warning requirements stated elsewhere. In practice, operators or downstream agents may execute cleanup snippets directly, which raises the chance of accidental dataset deletion.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Before DeleteDataset: show dataset details and ask for explicit confirmation #### INCORRECT - Creating a dataset without checking for duplicates - Deleting a dataset without user confirmation - Updating description without showing the current value
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/
text ### Windows
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guide recommends executing a remotely fetched script directly with
bashand provides no integrity verification, review step, or warning. This creates a clear supply-chain execution risk: if the hosting endpoint, CDN, DNS, TLS trust chain, or script content is compromised, users may run attacker-controlled code immediately on their machine.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation tells users to place long-lived access keys in shell environment variables without any warning about shell history, process inspection, inherited environments, accidental logging, or persistence in profile files. While common, this practice increases the chance of credential exposure and account compromise if the workstation or session is inspected or misconfigured.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation includes a dataset deletion command but provides no warning that it is destructive, irreversible, or should be confirmed before use. In an agent skill context, terse command references can be copied directly into automation or suggested to users, increasing the chance of accidental data loss from routine use or prompt-driven execution.
- Content
Static analysis
No suspicious patterns detected.