Alibabacloud Csas User Device Ops

• Outcome: Review
• Latest audit: Jun 1, 2026 · 5:44 PM UTC
• Version: 0.0.1

Overview

The skill is not obviously malicious, but it requests sensitive Alibaba Cloud authority and includes broader device-state and CLI setup powers than its inactive-device workflow clearly needs.

Install only if you intend to let the agent operate against Alibaba Cloud SASE. Prefer a custom least-privilege RAM policy, use read-only permissions unless device locking is needed, avoid putting access-key secrets directly in commands, and review the exact target devices before any lock or status-change operation. Be aware that the validation/setup steps can change Aliyun CLI plugin behavior and update plugins.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The reference enumerates APIs outside the manifest’s declared scope, including single-device detail retrieval, active IDP configuration lookup, and user-group queries. This creates a scope-expansion risk: an agent or future prompt flow may invoke undocumented-sensitive capabilities that operators and users would not reasonably expect from a terminal-device management skill.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Access to active IDP configuration is not necessary for the stated use cases of device inventory, inactive-device analysis, user lookup, or device locking. Exposing identity-provider metadata broadens access into identity infrastructure and may leak internal authentication architecture, which increases reconnaissance value and violates least privilege.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This reference file materially expands the skill from CSAS user/device operations into general Alibaba Cloud CLI installation, authentication, plugin management, and cross-service usage. In an agent skill context, overly broad operational guidance increases capability creep and can enable actions outside the declared scope, which raises the risk of misuse, overprivileged credential setup, and accidental operation against unrelated cloud services.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The plugin installation and exploration section explicitly encourages installation and use of unrelated services such as ECS, VPC, RDS, and FC, despite the skill being for CSAS device/user operations. In a tool-using agent environment, this broadens the reachable command surface and can facilitate unauthorized or unintended interactions with other Alibaba Cloud resources.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The reference documentation advertises `update-user-devices-status` as supporting lock, unlock, and generic marking actions, while the manifest says the skill supports locking inactive devices only and does not mention broader state-changing operations. This scope drift is dangerous because agents or operators may rely on the broader docs and invoke unsupported write actions, expanding the skill's effective authority beyond what users and reviewers expect.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The unlock example demonstrates a concrete write operation that is not declared in the skill description, which creates a mismatch between reviewed capability and actual operator guidance. In an agent setting, actionable examples materially increase the chance that the undeclared operation is executed, undermining least privilege and informed user consent.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: Although presented as a validation script, it performs state-changing actions by enabling auto-plugin-install and attempting a plugin update. In a security-sensitive CLI environment, a validator that mutates configuration or fetches updates can surprise users, alter trust boundaries, and introduce supply-chain or environment-drift risk during what appears to be a read-only check.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documented `update-user-devices-status` operation is state-changing and includes impactful actions beyond locking, such as `Lost`, `Unbound`, `Unlocked`, and `Found`. Presenting this API without explicit warnings, action scoping, or confirmation requirements increases the chance an agent could perform harmful device state changes through prompt confusion, misuse, or overbroad automation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide tells users to export long-lived access keys and tokens as environment variables without warning about exposure through CI logs, debug output, crash reports, inherited process environments, or shell/session leakage. In automation and agent contexts, environment-based secret injection is common but must be paired with explicit handling guidance; otherwise credentials may be unintentionally disclosed.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The quick-start example places the access key secret directly on the command line, which can be captured in shell history, process listings, audit logs, and agent execution traces. Because this is presented as the recommended non-interactive approach, it normalizes an unsafe credential handling pattern that can directly leak cloud credentials.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly recommends attaching the broad `AliyunCSASFullAccess` system policy as the quickest setup, even though the skill includes a write-capable operation (`csas:UpdateUserDevicesStatus`) that can change device state. Presenting full access as the default path without a prominent warning or stronger least-privilege guidance increases the chance operators will overprovision credentials, expanding blast radius if the skill, account, or session is misused.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The write-command section presents lock/unlock operations with no cautionary text, approval requirement, or indication that these actions can disrupt user access. For an agent skill that may translate natural-language requests into commands, omission of safety guardrails increases the risk of accidental or unauthorized device state changes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The concrete lock/unlock examples are copy-paste ready and lack any caution about business impact, target validation, or approval workflow. In practice, such examples lower the barrier to disruptive actions and can cause broad access interruptions if the wrong device tags are supplied or generated by an agent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script silently changes the user's Aliyun CLI configuration with `aliyun configure set --auto-plugin-install true` and only emits a generic success-style log after the fact. Hidden configuration mutation is risky because it changes future CLI behavior, may allow automatic plugin retrieval in later commands, and can weaken user control over what code is installed or executed.

Static analysis

No suspicious patterns detected.