ClawHub
Back to skill

Security audit

Alibabacloud Ddos Security Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill’s DDoS monitoring purpose is coherent, but its setup instructions create unnecessary local execution and persistent dependency-update risk.

Review before installing. Use a safer Aliyun CLI installation method such as a trusted package manager or a verified release artifact, avoid piping remote scripts into a shell, and do not let the skill permanently enable automatic plugin installation or update unrelated plugins. Use a least-privilege RAM sub-account with only the listed read-only DDoS permissions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/cli-installation-guide.md:5
Finding

Unverified Remote Installation Script Is Executed Directly by Bash

Content
View full analysis

Vulnerability Details

File Location: references/cli-installation-guide.md:5-10
Additional Locations: references/cli-installation-guide.md:15-18; references/cli-setup.md:5-8
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code:

bash
# Recommended: One-click install script
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

The same command is recommended for both macOS and Linux and is repeated in the credential setup guide.

Technical Analysis

The command streams an HTTPS response directly into bash. No fixed script version, cryptographic checksum, publisher signature, or content review separates retrieval from execution. Consequently, the code that runs can differ from the content assessed during this audit.

The hostname appears related to Alibaba Cloud, but the project contains no evidence that the response is immutable or independently authenticated. HTTPS protects data in transit under the normal certificate trust model; it does not prevent a compromised origin, compromised publishing pipeline, mistakenly replaced artifact, or malicious future update from serving different executable content.

This behavior is not required to perform DDoS monitoring. Installation can instead use a verified, version-pinned package or a download-verify-install workflow. Immediate execution therefore exceeds the minimum safe behavior needed for the Skill.

Attack Path

  1. An attacker compromises the script host, its publishing pipeline, or another component in the trusted delivery chain.
  2. The attacker modifies setup.sh to contain arbitrary shell commands.
  3. A user or agent follows the Skill's prerequisite instructions.
  4. curl downloads the current attacker-controlled response.
  5. The pipe sends that response directly to bash without verification or review.
  6. The payload executes with the privileges and environment of ...[truncated 707 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove every curl ... | bash recommendation.
  2. Prefer a trusted operating-system package manager where available.
  3. Otherwise, download a specific, version-pinned release artifact without executing it:
    bash
    curl --proto '=https' --tlsv1.2 -fL \
  -o aliyun-cli-package \
  'https://official.example/path/to/pinned/version'
  4. Publish and verify a cryptographic signature from a pinned publisher key, or at minimum verify a SHA-256 value obtained through a separately trusted channel:
    bash
    echo '<pinned-sha256>  aliyun-cli-package' | sha256sum -c -
  5. Abort installation if verification fails.
  6. Inspect or extract the verified artifact before installation rather than streaming it into a shell.
  7. Document the exact version, official source, expected digest, required filesystem changes, and privilege requirements.
  8. Do not instruct users to run the installer as root unless a narrowly defined installation step genuinely requires it.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:84
Finding

Global Automatic Plugin Installation and Unpinned Bulk Updates

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:84-86
Additional Locations: references/cli-installation-guide.md:31-38; references/cli-setup.md:12-16
Vulnerability Type: Unpinned executable dependencies and persistent automatic installation
Risk Level: Medium

Vulnerable Code:

bash
# 1.2 Set global timeout and enable auto plugin install
aliyun configure set --auto-plugin-install true --connect-timeout 10 --read-timeout 30
aliyun plugin update

The reference guides repeat the behavior:

bash
# Enable auto plugin install
aliyun configure set --auto-plugin-install true

# Update all installed plugins to latest version
aliyun plugin update

Technical Analysis

The Skill changes global Aliyun CLI configuration to permit automatic plugin installation and then updates all installed plugins to their latest available versions. It does not pin dependency versions, verify plugin signatures or checksums, constrain installation to the three required DDoS products, or restore the previous auto-install setting during cleanup.

This creates a mutable dependency boundary: executable components retrieved after the Skill audit may differ from those originally reviewed. The broad update command may also modify unrelated plugins that are not necessary for DDoS inspection.

Enabling automatic installation persistently is broader than the minimum privileges and state changes needed for the declared function. The monitoring workflow only needs known, verified versions of the antiddos-public, ddosbgp, and ddoscoo functionality. Cleanup disables AI-Mode but does not restore auto-plugin-install.

Attack Path

  1. An attacker compromises an upstream plugin, plugin repository, publishing account, or update-delivery channel.
  2. The Skill persistently enables automatic plugin installation.
  3. aliyun plugin update retrieves mutable latest versions, potentially including unrelated inst ...[truncated 1142 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove aliyun plugin update from routine inspection execution.
  2. Do not persistently enable global automatic plugin installation.
  3. Explicitly install only the plugins required by this Skill.
  4. Pin each required plugin and CLI release to a tested version.
  5. Verify publisher signatures or documented cryptographic checksums before installation.
  6. Record and validate installed versions before executing authenticated API calls.
  7. If a temporary configuration change is unavoidable, capture the prior auto-plugin-install value and restore it on every success, failure, timeout, and cancellation path.
  8. Require explicit user approval before installing or updating executable dependencies.
  9. Separate dependency installation from the monitoring run so the inspection can operate with preinstalled, previously verified components.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

This command fetches a shell script from an external URL and pipes it directly into bash, creating a direct remote-code-execution path. In an agent skill context, including copy-pasteable commands like this increases risk because users may run them without scrutiny, and a compromised upstream source would execute attacker-controlled code immediately.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 7)May include surrounding context.

bash
# Recommended: One-click install script
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

# Or use Homebrew
brew install aliyun-cli

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The | bash pipeline is the dangerous execution primitive that turns an HTTP response into immediately executed shell commands. This bypasses normal user review and magnifies the impact of any upstream compromise into full command execution under the user's privileges.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 7)May include surrounding context.

bash
# Recommended: One-click install script
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

# Or use Homebrew
brew install aliyun-cli

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The Linux installation section repeats the same external-script-to-shell pattern, which allows arbitrary code execution if the remote script or delivery channel is tampered with. Repetition in multiple OS sections makes the unsafe pattern more likely to be used broadly by readers.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 17)May include surrounding context.

bash
# One-click install script
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

Windows

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

This use of | bash in the Linux section creates the same direct execution chain, making the guide an enabler for unsafe command execution habits. In a security-focused skill, this is especially misaligned because users may trust the guidance as vetted and lower their guard.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 17)May include surrounding context.

bash
# One-click install script
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

Windows

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

Fetching an external script over the network and executing it as part of setup creates a direct supply-chain execution risk. Even when served over HTTPS from a legitimate vendor domain, compromise of the origin, CDN, DNS, TLS termination, or published script contents would let an attacker run arbitrary commands in the user's environment.

Content

Scanner excerpt · references/cli-setup.md (reported line 7)May include surrounding context.

bash
# One-click install script (recommended)
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

# Verify version (requires >= 3.3.3)
aliyun version

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The | bash chaining pattern is dangerous because it suppresses meaningful review of downloaded content and turns a network response directly into command execution. In a security-focused skill, this is especially risky because users may trust the instructions more readily and run them in privileged or sensitive environments used for cloud administration.

Content

Scanner excerpt · references/cli-setup.md (reported line 7)May include surrounding context.

bash
# One-click install script (recommended)
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

# Verify version (requires >= 3.3.3)
aliyun version

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrase "security check" is overly generic and can cause this skill to activate for many unrelated security-oriented requests. Because the skill is capable of driving broad Alibaba Cloud CLI inspection flows across an account, accidental invocation could lead to unnecessary credentialed enumeration, noisy API activity, and user confusion about what action is being taken.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide recommends executing a remotely fetched shell script with curl ... | bash and does so without any adjacent warning, integrity verification, or review step. This is dangerous because any compromise of the hosting endpoint, CDN, DNS/TLS trust chain, or script supply chain would result in immediate arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation recommends executing a remotely fetched installer script directly in a shell, which gives the remote content immediate code execution on the user's machine without prior inspection or integrity verification. If the hosting endpoint, CDN path, or delivery chain is compromised, users could run arbitrary malicious code simply by following the instructions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/ram-policies.md (reported line 33)May include surrounding context.

md
"Effect": "Allow",
      "Action": [
        "ddosbgp:DescribeInstanceList",
        "ddosbgp:DescribePackIpList",
        "ddosbgp:DescribeDdosEvent",
        "ddosbgp:DescribeTraffic"
      ],

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
7% confidence
Finding

I do not identify a genuine natural-language policy violation in this file. The content is technical API reference material and does not force a human language or locale choice on the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.