T08 · Insecure Dependencies
Error
- Location
SKILL.md:22- Finding
Automatic Installation of Unreviewed CLI Plugins and Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
Alibabacloud Dataworks Data Governance
Security checks for vulnerabilities and agentic risk
Overview
This skill is for legitimate Alibaba Cloud DataWorks tag management, but its setup guidance grants broad cloud access and installs mutable tools/plugins in ways users should review carefully.
Install only if you are comfortable giving the agent a narrowly scoped Alibaba Cloud profile for DataWorks tag operations. Prefer read-only permissions when possible, avoid auto plugin installation, verify CLI binaries before installing, do not paste AK/SK or STS tokens into commands or chats, and use a dedicated RAM role/user with minimal DataWorks permissions rather than a broad existing cloud profile.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Error
- Location
references/cli-installation-guide.md:41- Finding
Unverified Mutable CLI Binary Installed into a Privileged System Path
- Content
View full analysis
- Remediation
View remediation
aliyun-cli-linux-amd64.tgz" | sha256sum --check - ``` 3. Prefer cryptographic signature verification using a pinned vendor signing key. 4. Abort installation if checksum or signature validation fails. 5. Download into a newly created, permission-restricted temporary directory. 6. Inspect the archive file list before extraction and reject absolute paths, symbolic-link escapes, and parent-directory traversal entries. 7. Avoid machine-wide installation where possible; use a user-scoped, controlled directory. 8. If system-wide installation is necessary, confirm the verified file owner and permissions after installation. 9. Document the exact source, release number, checksum, and signing-key fingerprint used during review. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
references/cli-installation-guide.md:104- Finding
Alibaba Cloud Credentials Exposed Through Command-Line Arguments
- Content
View full analysis
\ --access-key-secret \ --region cn-hangzhou ``` The AK example reinforces the same pattern: ```bash aliyun configure set \ --mode AK \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` The STS example additionally places a session token on the command line: ```bash aliyun configure set \ --mode StsToken \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --sts-token v1.0:XXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` The key-rotation guidance repeats the insecure practice: ```bash aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET ``` ### Technical Analysis Command-line secrets may be retained in interactive shell history, terminal transcripts, CI/CD logs, automation logs, process-accounting systems, and Agent conversation or tool traces. Depending on the operating system and process isolation, arguments may also be visible to other local processes while the command is running. This guidance directly conflicts with the primary Skill’s security rules in `SKILL.md:27-31`, which state that the Skill must never ask for AK/SK values in the conversation or command line and must never use `aliyun configure set` with literal credentials. Placeholder values reduce immediate exposure in the repository itself, but users are explicitly expected to replace those placeholders with real secrets. The resulting operational behavior is therefore un ...[truncated 1554 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger list includes generic phrases such as 'tag management', 'query data assets', and 'list data assets' that can match ordinary user requests outside the narrow Alibaba Cloud DataWorks context. Over-broad activation can cause the agent to invoke this skill in unintended situations, leading to cross-domain actions against cloud resources or disclosure of metadata when the user did not explicitly intend to use this provider-specific skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file is a general-purpose Aliyun CLI installation and administration guide, not documentation narrowly scoped to the skill's declared DataWorks data-governance tag-management purpose. In an agent skill context, broadening users toward full-cloud CLI setup and administration increases the chance the skill is used as a pivot into unrelated services and privileges beyond the intended tag-management workflow.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/
text ### Windows
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The guide instructs users to place access-key material directly on the command line, which risks exposure through shell history, process listings, CI logs, and agent telemetry. Because the command also persists credentials via CLI configuration, disclosure can become both immediate and long-lived.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The recommendation for non-interactive configuration in scripts, CI/CD, and agent automation omits the key warning that credentials may be written to ~/.aliyun/config.json. In automation environments, that can silently create persistent local secret storage that is later harvested, copied into artifacts, or exposed to other processes.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once ### Configuration Modes
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation includes realistic-looking access-key IDs and secrets and shows secret material present in config output, which can normalize copying, logging, or echoing credentials in examples and agent responses. Even if placeholders are not live, this pattern encourages unsafe operator behavior and increases the chance that real secrets will later be handled similarly.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
These sections document elevated and cross-account authentication modes such as RamRoleArn and role-chaining from ECS, which materially expand access beyond simple tag management. In the context of an automation skill, such guidance can facilitate use of stronger credentials or cross-account privilege paths that are unnecessary for the advertised capability set.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The verification and next-step examples introduce ECS, Function Compute, and plugin-management behaviors that are outside the declared DataWorks tagging scope. This encourages exploration of unrelated cloud capabilities and may cause operators or agents to validate credentials against broader APIs than necessary, increasing attack surface and potential misuse.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Restrict permissions chmod 600 ~/.aliyun/config.jsonTroubleshooting
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document provides step-by-step instructions to attach RAM policies that grant write-capable DataWorks tag-management permissions over all resources using "Resource": "*", but it does not warn that these permissions take effect immediately and enable broad modification of tag metadata across the environment. In a governance context, tags can drive discovery, ownership, classification, and downstream automation, so overbroad write access can lead to unauthorized changes, operational disruption, or policy misclassification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The example JSON sets
"language": "en", which imposes a specific language in natural-language content. Because the guide does not present this as optional or explain that users may choose their preferred locale, it can conflict with a language/locale choice policy.- Content