Alibabacloud Ddoscoo Domain Configuration Backup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:02 AM UTC
• Version: 0.0.1

Overview

The skill has a coherent backup/import purpose, but its setup guidance exposes cloud credentials in commands and recommends unverified privileged CLI/plugin installation.

Before installing, use a verified or package-manager Aliyun CLI install, avoid automatic plugin updates unless reviewed, never place AK/SK or STS tokens on the command line or in chat, and use separate least-privilege identities for export and import. Run imports only after explicit region selection, dry-run diff review, and confirmation of destructive changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:24

Finding

Unverified and Unpinned CLI Binary Installation into a Privileged PATH

Content

View full analysis

Remediation

View remediation

' "${archive}" | sha256sum --check - ``` 4. Prefer a vendor-signed package or release signature and validate it using a pinned, independently distributed public key. 5. Inspect archive member paths before extraction and extract into a newly created, non-privileged temporary directory. 6. Avoid directly overwriting a system-wide executable. Stage and verify the binary first, then use an operating-system package manager or a controlled administrative deployment process. 7. Pin plugin versions and disable automatic plugin installation by default. Require explicit review before installing or updating a plugin. 8. Record the installed CLI and plugin versions and validated artifact digests in audit logs. 9. Run the CLI with a least-privileged RAM identity so that compromise does not automatically expose full import capabilities. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/cli-installation-guide.md:101

Finding

Cloud Credentials Are Passed as Command-Line Arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` The AK and STS examples at lines 129-166 repeat the pattern with credential-shaped values: ```bash aliyun configure set \ --mode AK \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` ```bash aliyun configure set \ --mode StsToken \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --sts-token v1.0:XXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` The key-rotation and temporary-token guidance at lines 370-382 also instructs users to place secrets directly in arguments: ```bash aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET ``` ```bash aliyun configure set --mode StsToken \ --access-key-id XXXX --access-key-secret XXXX \ --sts-token XXXX --region cn-hangzhou ``` This guidance conflicts with the security rules in `SKILL.md:81-85`: ```text - NEVER read, echo, or print AK/SK values - NEVER ask the user to input AK/SK directly in the conversation or command line - NEVER use aliyun configure set with literal credential values - ONLY use aliyun configure list to check credential status ``` ### Technical Analysis Command-line arguments are not an appropriate channel for long-lived secrets. Depending on the operating system and execution environment, they may be retained in shell history, terminal session recordings, process-monitoring telemetry, CI/CD logs, command auditing ...[truncated 2430 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill supports import and rollback of production DDoS domain settings, but the scenario description does not prominently warn that import operations modify live configuration and may overwrite existing protections, origins, certificates, or routing-related settings. In this context, inadequate upfront warning increases the chance of unsafe operator use, accidental disruption, or unintended policy rollback in a security-sensitive service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This rule tells the agent to infer region from user wording, which conflicts with earlier stricter guidance that region must be explicitly confirmed and never guessed. In a system where cn-hangzhou and ap-southeast-1 are isolated and imports can alter live configurations, inference can lead to exporting the wrong environment or importing into the wrong region, causing incomplete backups or misapplied changes.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guide shows secrets passed directly on the command line via --access-key-secret, which can be exposed through shell history, process listings, terminal logging, and CI job logs. In a cloud-admin context, leaked Alibaba Cloud access keys can enable unauthorized API access and compromise of protected services, including configuration export/import actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Recommending non-interactive credential configuration for automation without warning about secure secret storage increases the risk that users hard-code long-lived credentials in scripts, CI variables, build logs, or plaintext config. In this skill's disaster-recovery and import/export context, those credentials may have write access to production DDoS website configurations, making credential leakage operationally significant.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately -- it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

At L171, the document says only non-default global protection rules should be exported, retaining customized differences only. But at L226, the YAML assembly rules state 'Global protection rules full export: all rules are recorded without incremental filtering,' which directly conflicts with the earlier export strategy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document provides a broad write-capable RAM policy for import operations, including actions that create domains, modify TLS/cert settings, alter CC protection, access rules, cache behavior, and other live Layer 7 controls, but it does not clearly warn that assigning this policy grants the ability to change production traffic-handling and security posture. In the context of a backup/import skill, operators may treat the policy as routine setup and overgrant it to automation or users, increasing the chance of accidental misconfiguration or abuse of compromised credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This section enumerates many state-changing import and modification commands that can create domains, overwrite existing website rules, alter certificates, and change security controls, but it does not visibly warn the operator that these actions are mutating and may cause outage, lockout, or weakened protection if applied to the wrong target. In a backup/restore skill, such commands are expected, but the absence of explicit safeguards or impact warnings increases the chance of accidental misuse during automation or copy-paste execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill establishes a mandatory per-session observability format using a unique session ID in the user-agent, but this example later uses only a generic AlibabaCloud-Agent-Skills value. That inconsistency can cause operators or downstream agents to omit the session-specific identifier, degrading auditability, correlation, and incident investigation for configuration-changing cloud operations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The post-import verification command contradicts the earlier MUST-level requirement to include the full session-specific user-agent string. In a skill that performs live configuration imports, inconsistent telemetry instructions weaken traceability of both write actions and verification steps, making troubleshooting and accountability harder.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The sample configuration sets "language": "en" even though the guide does not state that English is required or optional. Under the policy, forcing a specific language without opt-in is a natural-language locale issue, even in an example config value.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The documentation explicitly recommends RamRoleArn for elevated or cross-account access and describes use cases involving temporary elevated privileges. While authentication setup is relevant, promoting elevated and cross-account access exceeds what is obviously necessary for a narrowly scoped domain configuration export/import tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is described as focused on DDoS Pro domain-level configuration export/import, but this guide instructs users to install arbitrary Alibaba Cloud product plugins (ecs, vpc, rds) and explore unrelated service commands such as ecs and fc. Those capabilities are not justified by the narrow disaster-recovery and audit purpose stated in the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file explicitly directs the skill to generate per-domain YAML files and save them with the Write tool, but it does not warn the user that local files will be created on disk or clarify overwrite behavior. Because markdown files should disclose behaviors affecting user data or system state, this file write operation needs a brief warning.

Content

No source excerpt is available for this finding.