ClawHub
Back to skill

Security audit

Alibabacloud Dataworks Data Quality

Security checks for vulnerabilities and agentic risk

Overview

The skill's cloud queries are read-only, but its setup instructions expand local executable and plugin trust enough that users should review it before installing.

Install only if you are comfortable with its Aliyun CLI setup changing your local environment. Prefer a preinstalled, admin-approved Aliyun CLI and pinned/verified plugin versions; avoid running the curl-to-bash installer or mutable latest binaries, and use a least-privileged Alibaba Cloud identity limited to the documented read/list actions. Treat alert receivers and run logs as sensitive and redact them before sharing outputs.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:43
Finding

Unverified Remote Script Is Downloaded and Executed by a Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:43
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

Technical Analysis

The installation instruction pipes content retrieved from an external URL directly into bash. The script is not pinned to a reviewed version, saved for inspection, or validated using a cryptographic checksum or signature.

HTTPS authenticates the connection under the normal certificate-authority model, but it does not establish that the mutable script still contains the same code that was present when the Skill was audited. Compromise of the hosting service, CDN, publishing account, DNS/TLS trust path, or upstream release process could change the effective payload without modifying this repository.

This behavior is not required for the Skill's core read-only DataWorks queries. Installation can be handled through a verified package or a separately reviewed, version-pinned artifact.

Attack Path

  1. An attacker compromises the hosted script, its publishing process, or another part of its delivery chain.
  2. A user or Agent follows the mandatory prerequisite in SKILL.md.
  3. curl retrieves the attacker's current script content.
  4. The pipe passes that content directly to bash without an inspection or integrity-verification boundary.
  5. The script executes arbitrary commands with the privileges of the user running the Agent.
  6. The payload could read accessible files and cloud credential configuration, alter local tools, download additional payloads, or establish persistence.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking account. The affected scope includes all files and processes accessible to that account, the Agent workspace, Aliyun CLI configuration, and cloud credentials available to loca ...[truncated 358 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash instruction entirely.
  2. Prefer an authenticated official package repository whose package metadata and signatures are verified by the package manager.
  3. If direct installation is unavoidable:
    • Pin an exact release version and platform artifact.
    • Download the artifact to a local file rather than piping it into a shell.
    • Obtain the expected digest through a separately authenticated vendor channel.
    • Verify a strong checksum such as SHA-256 and, preferably, a vendor signature.
    • Abort installation on any verification failure.
    • Allow the user to inspect the installer before execution.
  4. Do not run the installer with elevated privileges unless installation genuinely requires it and the user explicitly approves the elevation.
  5. Document the expected filename, version, digest, signing identity, and destination path.

T08 · Insecure Dependencies

Error
Location
references/cli-installation-guide.md:16
Finding

Mutable “Latest” CLI Binaries Are Installed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: references/cli-installation-guide.md:16-30
Vulnerability Type: Unpinned and unverified executable dependency installation
Risk Level: High

Vulnerable Code

bash
### macOS (Binary)

```bash
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz
tar -xzf aliyun-cli-macosx-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/
aliyun version

Linux

bash
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/
aliyun version

The Windows instructions at references/cli-installation-guide.md:34-39 similarly retrieve a mutable latest archive without checksum or signature verification:

powershell
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli
$env:Path += ";C:\aliyun-cli"
aliyun version

Technical Analysis

The archive names point to mutable latest releases rather than immutable, versioned artifacts. The instructions do not validate a cryptographic digest or trusted publisher signature before extracting and installing the executable.

On macOS and Linux, sudo mv places the downloaded executable in /usr/local/bin, a system-wide command location commonly trusted by users and automation. Merely invoking aliyun version after installation confirms that a binary runs; it does not establish its authenticity or integrity.

A compromised archive could impersonate the expected CLI while intercepting credentials and API data. Because the Skill relies on Aliyun CLI for authenticated operations, the downloaded binary occupies a particularly sensitive trust position.

Attack Path

  1. An attacker compromises the artifact host, CDN, release account, or upstream build and publishing pipeline. 2 ...[truncated 1252 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace all latest URLs with exact, immutable release versions.
  2. Publish the expected SHA-256 digest and trusted signing identity in the guide.
  3. Verify both checksum and vendor signature before extraction or execution.
  4. Abort immediately when verification fails.
  5. Prefer Homebrew or another authenticated official package repository where package verification and controlled upgrades are available.
  6. Avoid system-wide installation by default. Use a user-owned directory with restricted permissions where practical.
  7. If /usr/local/bin installation is required, request explicit user approval only after artifact verification.
  8. On Windows, validate an Authenticode signature or an equivalent vendor signature before adding the executable directory to PATH.
  9. Avoid extracting untrusted archives into sensitive directories; extract into a newly created restricted directory and verify the expected file layout first.

T08 · Insecure Dependencies

Error
Location
SKILL.md:44
Finding

Automatic Plugin Installation and Mandatory Unpinned Updates Expand the Executable Supply Chain

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:44-45
Vulnerability Type: Automatic installation and update of mutable executable dependencies
Risk Level: High

Vulnerable Code

text
2. **First-time use**: `aliyun configure set --auto-plugin-install true`
3. **Plugin update**: [MUST] run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

The automatic-install setting is repeated in references/cli-installation-guide.md:55-58:

bash
## Enable Auto Plugin Install

```bash
aliyun configure set --auto-plugin-install true
text

### Technical Analysis

The Skill persistently enables automatic plugin installation and mandates updating existing plugins without identifying the precise plugins required, pinning reviewed versions, or documenting an independent integrity-verification process.

Plugins are executable dependencies loaded into the Aliyun CLI trust boundary. Automatic installation allows later commands to retrieve and run components that were not included in this repository and therefore were not part of this audit. Mandatory updating can also replace previously reviewed plugin versions with newly published code.

These global CLI configuration changes exceed the minimum privilege and dependency scope needed for a narrowly defined read-only DataWorks Skill. Only a specific DataWorks plugin or API surface should be installed, and only when it is actually required.

### Attack Path

1. The Skill directs the user or Agent to enable automatic plugin installation globally.
2. An attacker compromises a plugin package, plugin index, distribution channel, publisher account, or update mechanism.
3. A later Aliyun CLI invocation detects a missing plugin or the mandatory update command retrieves a replacement version.
4. The compromised plugin is installed without explicit per-plugin review or version approval.
5. The plugin executes wit
...[truncated 839 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not enable global automatic plugin installation as a mandatory prerequisite.
  2. Determine whether a plugin is actually necessary for the documented DataWorks commands.
  3. If required, name the exact plugin and pin an approved version.
  4. Verify package integrity and publisher authenticity before installation.
  5. Require explicit user confirmation before installing or updating executable components.
  6. Do not update unrelated existing plugins as part of this Skill's workflow.
  7. Restore the user's prior auto-install configuration after execution if a temporary change is unavoidable.
  8. Record the approved plugin version and digest so future changes require a new security review.
  9. Run the CLI and plugins using a least-privileged cloud identity limited to the documented Get/List actions and, where supported, the intended workspaces or resources.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

Fetching and piping an external script to bash is an explicit arbitrary-code execution sink. This violates the stated read-only nature of the skill and materially increases risk to the host running the agent or to the user's workstation through compromise of the download source, DNS/TLS trust chain, or script contents.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
### Prerequisites

1. **Aliyun CLI >= 3.3.3**: `aliyun version` (If not installed or version too low, run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update. See [references/cli-installation-guide.md](references/cli-installation-guide.md))
2. **First-time use**: `aliyun configure set --auto-plugin-install true`
3. **Plugin update**: [MUST] run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.
4. **AI-Mode Configuration**: [MUST] Before using aliyun CLI commands, configure AI-Mode:

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The instruction curl ... | bash executes downloaded code directly from the network, which is a classic code-execution and supply-chain risk. In a supposedly read-only cloud query skill, this is especially dangerous because it normalizes arbitrary local code execution unrelated to the business task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The prerequisite tells users to execute a remote shell script without warning or integrity verification, creating a direct path to arbitrary command execution if the source is compromised or intercepted. Because the skill is framed as read-only, users may be less cautious, making this instruction more hazardous in context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Requiring aliyun plugin update introduces a local package-management action unrelated to the stated read-only Data Quality purpose. Even if benign in intent, it expands the skill from remote API reads into modifying the user's local toolchain, increasing supply-chain and environment-tampering risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill directs the agent/user to modify local CLI AI-mode configuration and user-agent settings, which is outside the narrow read-only query function. Persistent local configuration changes can affect other sessions and tools, creating unintended state changes and possible telemetry or policy side effects.

Content

No source excerpt is available for this finding.

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
75% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md
1. **Environment check** — Confirm CLI and credentials per Prerequisites. After completion, proactively suggest the workspace confirmation step.
2. **Confirm workspace** — Confirm `ProjectId` and `region`. If either is missing, use Module 0. After completion, proactively suggest listing monitors.
3. **List monitors** — Call `ListDataQualityScans`, present a table, and let the user choose a monitor. After completion, proactively suggest monitor detail.
4. **Check monitor detail** — Call `GetDataQualityScan`, summarize rules, monitored object, and trigger mode. After completion, proactively suggest recent runs.
5. **Check run history** — Call `ListDataQualityScanRuns`, default to the most recent 10 rows, and highlight abnormal status. After completion, proactively suggest drilling into one run.
6. **Drill into failed or warned runs** — For `Fail` / `Error` / `Warn`, call `GetDataQualityScanRun` and summarize per-rule results. After completion, proactively suggest log inspection.
7. **Fetch execution logs** — If `Results` shows failed rules or runtime errors, call `GetDataQualityScanRunLog` to locate root cause. After completion, proactively suggest whether further analysis is needed.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 20)May include surrounding context.

bash
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz
tar -xzf aliyun-cli-macosx-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 29)May include surrounding context.

bash
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz
tar -xzf aliyun-cli-macosx-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/
aliyun version

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation directs users to modify persistent local aliyun CLI state by enabling auto-plugin installation and AI mode, then changing the user-agent configuration. For a read-only querying skill, these environmental changes are broader than necessary and can alter future CLI behavior outside the task, increasing supply-chain and configuration-drift risk on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The examples and described APIs can retrieve sensitive operational data such as credential/profile state, alert recipients, webhook-style receiver targets, scan configuration snapshots, and raw execution logs, but the document presents them without privacy or data-handling warnings. In a security-sensitive enterprise environment, this can lead users or downstream agents to over-collect or disclose internal metadata and monitoring outputs unnecessarily.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest and coverage section frame the skill as limited to 9 read-only Data Quality APIs. However, Module 0 introduces aliyun dataworks-public list-projects as an operational fallback for workspace lookup, which is outside the enumerated Data Quality API set and broader than the declared coverage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

All referenced documentation URLs are hard-coded under the /zh/ locale, which imposes a specific language choice in the skill content. The file does not offer an alternative language option or explain that the Chinese locale is required for a region-specific reason.

Content

No source excerpt is available for this finding.