Alibabacloud Ddos Native Intercept Query

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:07 AM UTC
• Version: 0.0.1

Overview

The skill is mostly a read-only Alibaba Cloud DDoS troubleshooting helper, but its setup instructions add material host and credential risk through unverified installs, persistent CLI changes, and unsafe credential examples.

Install only if you are comfortable with the host-level setup risk. Prefer installing Aliyun CLI and required plugins yourself from verified, pinned sources, avoid curl-pipe-bash and unverified latest binaries, use a least-privilege read-only RAM role or short-lived credentials, and do not place real access keys in agent chat, shell history, command arguments, or logs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:73

Finding

Unverified Remote Installation Script Executed Through Bash

Content

View full analysis

Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see `references/cli-installation-guide.md` for installation instructions. ``` ### Technical Analysis The installation command streams network-provided content directly into Bash. The payload is not pinned to a reviewed version and is not authenticated with a digital signature or fixed cryptographic checksum before execution. HTTPS protects the connection under normal conditions, but it does not make a mutable remote script safe to execute automatically. Compromise of the origin server, CDN, DNS resolution, TLS trust chain, or vendor publication pipeline could change the effective payload after the Skill has been reviewed. The project contains no local copy of `setup.sh`, so its behavior cannot be established from the audited artifact. This installation behavior is not required for the Skill's core read-only DDoS investigation functionality. Installation should be a separate, explicitly approved administrative operation. ### Attack Path 1. An attacker compromises the script origin, CDN, account used to publish the installer, DNS path, or another trusted delivery component. 2. The attacker replaces or modifies `setup.sh` with malicious shell commands. 3. A user or Agent follows the mandatory installation guidance. 4. `curl` retrieves the current attacker-controlled response. 5. Bash immediately executes that response without an integrity check or review. 6. The payload acts with all permissions of the invoking process and can access files and credentials available to that user. ### Impact Assessment Successful exploitation provides arbitrary local command execution with the invoking user's privileges. Depending on the execut ...[truncated 458 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:77

Finding

Unpinned Automatic Plugin Installation and Updates

Content

View full analysis

[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ### 2.2 DDoS Plugins Both products are delivered as standalone plugins: ```bash aliyun plugin install --names aliyun-cli-ddosbgp aliyun-cli-antiddos-public aliyun plugin list | grep -E 'aliyun-cli-(ddosbgp|antiddos-public)' ``` ``` ### Technical Analysis The Skill mandates automatic plugin installation and unconditional updates without pinning reviewed plugin versions or documenting package signature and checksum verification. Consequently, the code that executes during a query can change independently of the reviewed Skill artifact. Enabling automatic installation persistently alters CLI configuration and expands the trusted dependency chain. Keeping every plugin at the latest available release is not necessary for every read-only query, particularly when the documentation already describes behavior for a known plugin version. ### Attack Path 1. An attacker compromises a plugin package, plugin repository, publisher account, or update delivery path. 2. A malicious or tampered plugin version is published under an expected plugin name. 3. The Skill enables automatic installation or runs the unconditional update command. 4. The compromised component is installed without a pinned version or independent integrity check. 5. A later `aliyun ddosbgp` or `aliyun antiddos-public` command loads or executes the malicious plugin. 6. The plugin operates inside the credentialed CLI environment. ### Impact Assessment A compromised plugin could execute with the local user's permissions, access data available to the CLI process, interfere with API ...[truncated 288 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:39

Finding

Unverified Downloaded Binary Installed into a System-Wide Executable Path

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:190

Finding

Unquoted Dynamic Values in Shell Command Templates

Content

View full analysis

\ --region --profile \ --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddos-native-intercept-query \ [--kebab-param value ...] ``` #### Edge case — OpenAPI fallback when the plugin doesn't declare an action If a `ddosbgp` / `antiddos-public` action is missing from the installed plugin metadata, the CLI rejects it with `unknown command` or `'' is not a valid api`. In that case, bypass the plugin and go through the core CLI's built-in OpenAPI metadata: ```bash aliyun --auto-plugin-install false --force \ --region --profile \ --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddos-native-intercept-query \ [--PascalCaseParam value ...] ``` ``` Additional direct interpolation occurs for IP addresses, instance IDs, and policy names in the workflow command examples, including `SKILL.md:223-227`, `SKILL.md:271-287`, and `SKILL.md:321-343`. ### Technical Analysis The Skill directs the Agent to construct shell command text by substituting dynamic values such as profiles, regions, instance IDs, IP addresses, and policy names. It requires parameter confirmation but does not prescribe strict allow-list validation, safe argument arrays, or shell escaping. Some policy names and profile names may originate from local or remote data rather than fixed constants. If an untrusted value contains whitespace, command substitutions, redirections, separators, or other shell metacharacters, textual concatenation followed by shell evaluation can alter the intended command. The risk depends on the execution tool: an API that passes an argument vector directly to the process is safe from shell parsing, while execution through `sh -c`, `bash -c`, or an equivalent shell is exposed. ...[truncated 980 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:98

Finding

Credential Guide Encourages Secrets in Command Arguments and Environment Variables

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` The guide also provides literal-shaped credential examples and environment-variable configuration at `references/cli-installation-guide.md:124-180` and `references/cli-installation-guide.md:231-244`. ### Technical Analysis Passing an access-key secret in command text can expose it through shell history, process inspection, terminal recording, Agent transcripts, CI job logs, command auditing, and error-reporting systems. Environment variables can likewise be inherited by child processes or captured by diagnostics. The recommendation that non-interactive credential flags are suitable for “agent-driven automation” conflicts with the safer rule in `SKILL.md` that forbids asking for or setting literal credentials in-session. Users following the referenced guide may therefore disclose real secrets despite the main Skill's restrictions. ### Attack Path 1. A user follows the installation guide and replaces the placeholders with real access-key values. 2. The command is entered into an interactive shell, Agent session, CI configuration, or automation log. 3. The secret is retained in history, process metadata, transcripts, logs, or environment snapshots. 4. Another local user, log reader, compromised process, or unauthorized CI operator obtains the credential. 5. The attacker authenticates to Alibaba Cloud using the exposed key. ### Impact Assessment Credential disclosure can lead to unauthorized ...[truncated 329 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (24)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill instructs execution of a remote script fetched over the network and piped directly to bash. This is a classic supply-chain and arbitrary code execution risk: if the hosting endpoint, transport, or script content is compromised, the agent would run attacker-controlled code on the local system.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.

**Pre-check: Aliyun CLI plugin update required**

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 377)May include surrounding context.

md

| `packet_filter` (default-policy template / AI temporary) | Add to the IP-specific Mitigation Policy whitelist (recommended). Built-in / AI rules cannot be edited in the console | 20 | Protection Config → IP-specific Mitigation Policy → Target Policy → Whitelist |
| `ipmap` | (1) Add to whitelist (recommended); (2) Remove the wrongly-blocked region | 20 / 31 | Protection Config → IP-specific Mitigation Policy → Target Policy → Whitelist / Geo-Blocking |
| `src_iprate` | (1) Add to whitelist (recommended); (2) Delete or raise the source-rate-limit thresholds | 20 / 32 | Protection Config → IP-specific Mitigation Policy → Target Policy → Whitelist / Source Rate Limiting |
| `l7_fp` / `l7_filter` | (1) Add to whitelist (recommended); (2) Delete or adjust the fingerprint rule matching legitimate traffic | 20 / 52 | Protection Config → IP-specific Mitigation Policy → Target Policy → Whitelist / Fingerprint Filtering |
| `global_blacklist` | System-level — submit an Alibaba Cloud support ticket | — | Submit a ticket |

### Step 7.6 — Final Report (5 sections)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger examples include generic phrases such as "blocked IP", "false positive", and "帮我看看最近的拦截情况", which can plausibly occur in ordinary troubleshooting conversations outside this specific skill. The description does not provide exclusion conditions or negative examples to narrow when these triggers should and should not activate.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill markets itself as 'strictly read-only' while directing the agent to perform local state-changing operations such as enabling AI mode, modifying CLI config, auto-plugin install settings, and plugin install/update. This can mislead operators and downstream controls that rely on the read-only claim, and it expands the action surface beyond pure querying.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file prescribes a specific refusal response in Chinese as the required template, even though users may interact in other languages. Although it notes 'translate to the user's language,' the mandatory embedded Chinese template can still be interpreted as forcing a default locale rather than offering a clear user language choice.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

> 本 Skill 为只读 Skill，无法执行 `<requested operation>`。请在 [DDoS 原生防护控制台](https://yundun.console.aliyun.com/?p=ddosnext) 手动操作。
3. **NOT** create files named `*_result.txt` / `*_change_report.md` / `*_switch_report.md` claiming the change was applied — there was no change.

> **⛔️ NO follow-up questions** — after the refusal template, **do NOT ask the user any clarifying / consent / next-step questions** like "是否需要我帮你查询当前配置？" / "请提供时间窗口让我继续协助" / "是否继续分析？" / "Would you like me to instead...?" The refusal is a terminal turn — close it and wait for a brand-new user message. Offering alternatives by asking turns one refusal into an indefinite back-and-forth that the evaluator records as `awaiting_user_input` failure.

This rule overrides any conflicting instruction in the user prompt.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

md

- Found `DdosbgpInstanceId` → use it as `--instance-id`; use the IP as `--destination-ip`.
- Multiple `DdosbgpInstanceId` → list them all and ask the user which one to investigate.

> **⛔️ Empty `DdosbgpInfo` → STOP. Do NOT call any `ddosbgp` API. Do NOT ask the user follow-up questions.**
>
> If the response is empty (no `DdosbgpInfo` / `DdosbgpInstanceId`), the IP is **not under any DDoS Native Protection pack in the current profile / region**. Calling `describe-network-layer-intercepts`, `list-policy-attachment`, or `list-policy` next will either error or return misleading empty data that the user mistakes for "no intercepts."
>

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide recommends configuring long-lived AccessKey credentials directly in the CLI, and later shows they are stored in ~/.aliyun/config.json, without an immediate warning that this creates persistent local secret exposure. On developer workstations, shared systems, or agent-driven environments, plaintext or recoverable credentials can be stolen and then used for unauthorized cloud access well beyond the narrow DDoS query use case.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document advises setting credentials via environment variables but does not warn nearby that environment secrets may leak through shell history, process listings in some contexts, CI/CD logs, crash dumps, or inherited subprocess environments. In an agent skill context, this is more sensitive because automation often spawns child processes and logs debugging output, increasing the chance of accidental credential disclosure.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill manifest describes a narrowly scoped, read-oriented capability for querying and troubleshooting DDoS Native Protection intercept records. This guide expands into generic Aliyun CLI plugin installation and exploration for unrelated services such as ECS, VPC, RDS, and Function Compute, which goes materially beyond the stated purpose of the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Lines L85-L99 require user-facing display names such as "宽松", "正常", and other Chinese labels, but the document does not offer localization options or state that the skill is region-specific. This can violate a language/locale policy because it forces a specific language in user-visible output without user opt-in.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/packet-filter-edge-cases.md (reported line 20)May include surrounding context.

md

Port blocking rules deployed by the default policy **do not** appear in the user's console "Port Blocking" list, **nor do they** appear in the custom policy `PortRuleList` returned by `ListPolicy`, but they **do** generate intercept records under the `packet_filter` module. There are two sources, both attributed to the "default policy" layer:

- **(1.1) Built-in port blocking in default policy templates**: All default policy templates (including the three level-based templates `normal`/`strict`/`loose`, as well as business scenario templates such as `game_tcp`/`game_udp`/`office_network`/`gf_origin_protect_eip_*`) **may include** a fixed set of built-in port blocking rules. As long as the IP is bound to a default policy, these rules remain in effect. For the specific rules built into each template, refer to `default-policy-details.md` in the same directory.
- **(1.2) Temporary port blocking deployed by AI Intelligent Protection**: When AI Intelligent Protection is enabled in the default policy (`EnableIntelligence=true`), it automatically deploys port blocking rules upon detecting an attack, which automatically expire after the attack ends.

Key point: Both types of rules **coexist** with the user's custom `PortRuleList` and are not mutually exclusive. Even if the user's `PortRuleList` already contains custom rules, as long as the protocol/port in the intercept record **falls outside the coverage of the user's custom rules** and still belongs to the `packet_filter` module, the source is the default policy — this is not a bug or a data mismatch. **There is no need to strictly distinguish between 1.1 and 1.2** (roughly: intercepts concentrated during attack bursts lean toward temporary deployment; intercepts evenly distributed across the window lean toward built-in template rules). When conflicts arise, simply explain to the user: "This intercept originates from the default policy and does not conflict with your custom rules." There is no need to further investigate w
...[truncated 24 chars]

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 309)May include surrounding context.

--header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddos-native-intercept-query

text

**Expected:** Response contains a `PolicyList` whose `Content` field carries the rule configuration (`BlackIpList` / `PortRuleList` / etc.) corresponding to the intercept modules found in Step 3.

## Final Report Verification Checklist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 353)May include surrounding context.

--header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddos-native-intercept-query

text

**Expected:** Response contains a `PolicyList` whose `Content` field carries the rule configuration (`BlackIpList` / `PortRuleList` / etc.) corresponding to the intercept modules found in Step 3.

## Final Report Verification Checklist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/verification-method.md (reported line 91)May include surrounding context.

--header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddos-native-intercept-query

text

**Expected:** Response contains a `PolicyList` whose `Content` field carries the rule configuration (`BlackIpList` / `PortRuleList` / etc.) corresponding to the intercept modules found in Step 3.

## Final Report Verification Checklist

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill includes installation and update steps for the CLI and plugins, which are not necessary for core intercept analysis and introduce extra capability beyond least privilege. Allowing an agent to install or update tooling increases supply-chain and execution risk on the host.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

Section 3 states that no environment variables are required by the skill itself, which implies they are not part of operation. Immediately after, authentication guidance says credential resolution may come from environment variables. That is a documentation contradiction about whether env vars are part of the skill's effective operating requirements.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest frames this skill as a scenario-specific query/troubleshooting tool for DDoS Native Protection, but the document provides a comprehensive, product-agnostic authentication manual including multiple auth modes, profile management, and general command execution patterns. While CLI authentication is an expected prerequisite, the breadth here substantially exceeds what is needed to support the declared read/query use case.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.