Alibabacloud Dataworks Workspace Manage

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:46 AM UTC
• Version: 0.0.2

Overview

This skill is mostly aligned with Alibaba DataWorks workspace administration, but its install, credential, plugin, and permission guidance creates review-worthy risk for cloud accounts.

Install only after reviewing the permission and setup steps carefully. Prefer a verified, pinned Aliyun CLI install, keep automatic plugin installation disabled, avoid entering cloud secrets on command lines, use short-lived or narrowly scoped credentials, and remove dataworks:UpdateProject and FullAccess-style permissions unless separately approved outside this skill.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66

Finding

Remote installer is downloaded and executed directly through Bash

Content

View full analysis

= 3.3.1) aliyun version ``` ``` ### Technical Analysis The Linux installation command pipes mutable network content directly into Bash. The script is neither downloaded for inspection nor authenticated through a pinned checksum or digital signature. HTTPS protects the connection in transit under normal conditions, but it does not ensure that the script remains identical to the version reviewed with this Skill. A compromise of the hosting infrastructure, CDN, publishing account, DNS resolution, or certificate trust chain could change the effective payload after the Skill has passed review. Executing a remote installer is not inherently required for the declared DataWorks workspace-management functionality. The included installation guide already describes standalone binary installation, so direct remote shell execution exceeds the minimum execution channel necessary. ### Attack Path 1. An attacker compromises or gains publishing access to `aliyuncli.alicdn.com`, its CDN path, or the referenced `install.sh`. 2. The attacker replaces the installer with a modified shell payload. 3. A user or Agent follows the documented prerequisite command. 4. `curl` retrieves the attacker-controlled response and pipes it directly to Bash. 5. The payload executes with the privileges and environment of the invoking user. 6. The payload can inspect local cloud configuration, modify executable files, install persistence, or invoke cloud APIs using accessible credentials. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking account. The payload may access files readab ...[truncated 436 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:22

Finding

Unpinned executable archive is installed into the system command path without integrity verification

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:87

Finding

Automatic plugin installation permits future mutable code to run without per-plugin approval

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/ram-policies.md:185

Finding

Provided RAM policy grants a prohibited operation across all resources

Content

View full analysis

dataworks-workspace-policy.json << 'EOF' { "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "dataworks:CreateProject", "dataworks:UpdateProject", "dataworks:GetProject", "dataworks:ListProjects", "dataworks:CreateProjectMember", "dataworks:GrantMemberProjectRoles", "dataworks:GetProjectMember", "dataworks:ListProjectMembers", "dataworks:GetProjectRole", "dataworks:ListProjectRoles" ], "Resource": "*" } ] } EOF # Create RAM policy aliyun ram create-policy \ --policy-name DataWorksWorkspaceManage \ --policy-document "$(cat dataworks-workspace-policy.json)" \ --description "DataWorks workspace management permissions" # Attach policy to user aliyun ram attach-policy-to-user \ --policy-name DataWorksWorkspaceManage \ --policy-type Custom \ --user-name ``` ``` ### Technical Analysis The generated policy explicitly grants `dataworks:UpdateProject`, even though that operation is declared prohibited in `SKILL.md:17-29` and `references/ram-policies.md:5-13`. The policy therefore grants a capability that the Skill states it must never execute or generate. The policy also uses `"Resource": "*"`, extending every listed action to all resources to which the action semantics apply. This is broader than necessary for member and role operations on known workspaces. The same reference document additionally presents an `AliyunDataWorksFullAccess` attachment command at lines 149-161. Although described as a system-policy example, it creates a second path to privileges substantially beyond the Skill's declared operation set. Instruction-level prohibitions do ...[truncated 1348 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/cli-installation-guide.md:103

Finding

Long-lived cloud secrets are supplied through command-line arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` ``` The guide repeats this pattern for AK, STS token, role-assumption, credential-rotation, and troubleshooting examples. ### Technical Analysis Passing an Access Key secret or STS token as a command-line argument can expose it through shell history, CI/CD command logs, terminal recording, debugging output, audit systems, and process inspection facilities. This also contradicts `SKILL.md:101`, which states that explicitly handling AK/SK credentials is strictly prohibited and that the default credential chain must be used. The placeholders are not embedded real credentials, but the documented workflow instructs users to substitute actual secrets into an unsafe transport mechanism. Long-lived Access Keys create particularly severe exposure because they remain usable until revoked or rotated. ### Attack Path 1. A user replaces the placeholders with a real Access Key ID and secret. 2. The shell records the complete command in history, or an automation platform records it in job logs. 3. Another local user, administrator, log reader, compromised process, or CI operator obtains the recorded command. 4. The attacker extracts the credentials. 5. The attacker configures a separate Aliyun CLI profile or directly signs Alibaba Cloud API requests. 6. The attacker invokes any operation allowed by the compromised identity until the credentials expire or are revoked. ### Impact Assessment The attacker receives the effective cloud privileges assign ...[truncated 504 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (18)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs users to fetch a remote script over the network and pipe it directly into a shell, which creates a supply-chain and remote code execution risk. If the host, CDN, TLS path, or script content is compromised, arbitrary commands could run with the user's privileges before any review occurs.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

brew install aliyun-cli

# Linux
curl -fsSL --max-time 30 https://aliyuncli.alicdn.com/install.sh | bash

# Verify version (>= 3.3.1)
aliyun version

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping downloaded content directly into bash is a classic unsafe command-chaining pattern because it eliminates an inspection boundary between retrieval and execution. In a cloud administration skill, this is more dangerous because operators are likely to run commands on privileged machines that also hold valid Alibaba Cloud credentials.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

brew install aliyun-cli

# Linux
curl -fsSL --max-time 30 https://aliyuncli.alicdn.com/install.sh | bash

# Verify version (>= 3.3.1)
aliyun version

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Using a very broad trigger such as 'workspace' increases the chance that this skill activates in unrelated contexts and offers high-impact cloud management actions like workspace creation and member role assignment. In an agent environment, unintended invocation can lead to confusing tool routing or accidental privileged operations if the agent over-matches user intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly declares UpdateProject permanently forbidden and says the agent must never execute or even generate commands for it. However, later documentation describes using the UpdateProject API and its limitations, which conflicts with the absolute prohibition and creates intent ambiguity for the agent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This guide substantially expands the skill’s operational scope from DataWorks workspace lifecycle actions into general-purpose Alibaba Cloud CLI installation, plugin discovery, and multi-service usage. In an agent skill context, that broadens the available action surface and can enable use of unrelated cloud services beyond the declared purpose, increasing the chance of unauthorized or unsafe actions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The guide instructs users to create long-lived AccessKey pairs and save the secret, which promotes persistent credential use. In the context of an agent-oriented skill, persistent account credentials materially increase blast radius if the host, logs, shell history, or config files are exposed, especially because the document also describes storing them in config files and environment variables.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document explicitly marks dataworks:UpdateProject as a prohibited operation, but the CLI custom policy example later grants that permission. This contradiction can lead operators to create over-privileged RAM policies that enable workspace modification outside the stated safe workflow, undermining least-privilege controls and increasing the chance of unauthorized or accidental changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example silently includes a permission that the same document says must not be granted through this skill, without any warning or justification. In a workspace-management skill, permission examples are likely to be copied directly by users, so this inconsistency can cause privilege escalation from read/member-management tasks into workspace update capability.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file provides broad credential acquisition, storage, and authentication workflows for the entire Alibaba Cloud account rather than narrowly scoped DataWorks workspace-management instructions. In an automation or agent setting, teaching multiple powerful auth modes and account-wide credential handling increases the likelihood of over-privileged configurations and use outside the intended skill scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The sample configuration sets "language": "en" in the stored CLI profile, which is a natural-language locale choice presented as part of the default example. The document does not offer alternatives or indicate that users can choose another language, so it implicitly forces a specific locale without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Line L03 links specifically to a /zh/ Chinese-language documentation page as the official reference. This creates a locale-specific default in natural-language guidance without any user opt-in or alternative language option.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest says the skill is for creating workspaces, querying workspace information, and adding workspace members with role authorization. This reference file also documents ListProjects, GetProjectRole, and ListProjectRoles, which broaden behavior into inventorying all workspaces and inspecting role definitions beyond the stated description's narrow operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The official documentation URLs all hardcode the /zh/ locale, which steers users to Chinese-language resources without any opt-in or alternative locale. This is a natural-language locale policy issue because the file does not indicate that the skill is region- or language-specific.

Content

No source excerpt is available for this finding.