T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:46- Finding
Mandatory Execution of a Remotely Retrieved Installation Script
- Content
View full analysis
- Remediation
View remediation
Security audit
alibabacloud-devops
Security checks for vulnerabilities and agentic risk
Overview
The skill has a clear DevOps purpose, but it asks for broad Yunxiao authority and directs agents toward risky installer and runtime dependency paths.
Review before installing. Use a short-lived, least-privilege Yunxiao PAT for the specific task, avoid putting tokens in shell profiles or command-line arguments, prefer preinstalled and verified CLI/MCP components, and do not run the curl-to-bash, npx, or Docker paths unless you trust and can verify those supply-chain sources. Confirm every write, delete, pipeline run, or release action before allowing execution.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T08 · Insecure Dependencies
Error
- Location
scripts/mcporter-call.sh:10- Finding
Automatic Download and Execution of npm Packages Through npx
- Content
View full analysis
[key:\"value\" ...]" echo " $0 list — list all available tools" echo " $0 schema — show schema for a specific tool" exit 0 fi ACTION="$1" shift if [[ "$ACTION" == "list" ]]; then npx -y "$MCPORTER" list --stdio "npx -y $MCP_SERVER" elif [[ "$ACTION" == "schema" ]]; then TOOL="${1:-}" if [[ -z "$TOOL" ]]; then npx -y "$MCPORTER" list --stdio "npx -y $MCP_SERVER" --schema else npx -y "$MCPORTER" list --stdio "npx -y $MCP_SERVER" --schema 2>&1 | grep -A 30 "function $TOOL" fi else npx -y "$MCPORTER" call --no-coerce --stdio "npx -y $MCP_SERVER" "$ACTION" "$@" fi ``` Equivalent runtime commands are documented in `SKILL.md:306-316` and `references/mcp-setup.md:107-116`. ### Technical Analysis The wrapper uses `npx -y`, which can retrieve and execute npm packages automatically without interactive approval. Exact top-level versions are specified, which reduces version drift, but no package integrity hashes, lockfile, vendored dependency tree, provenance verification, or lifecycle-script restrictions are supplied. The nested execution model is especially sensitive: ```bash npx -y mcporter@0.11.1 ... "npx -y alibabacloud-devops-mcp-server@0.3.38" ``` Both the transport wrapper and the MCP server can therefore be obtained at runtime. Transitive dependencies can also change within the constraints of their package manifests. The MCP server is expected to inherit `YUNXIAO_ACCESS_TOKEN`, so compromised package code would run in a process with access to a credential capable of invoking Yunxiao APIs. ### Attack Path 1. The CLI channel is unavailable and the Skill s ...[truncated 1041 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
references/mcp-setup.md:46- Finding
Mutable Docker Image Receives a Privileged Yunxiao Token
- Content
View full analysis
" } } } } ``` ### Technical Analysis The configuration executes a container identified by the mutable `latest` tag. A mutable tag does not uniquely identify the reviewed image and may resolve to different content during later executions. No immutable digest, image signature, provenance check, or admission policy is specified. The same container is explicitly given `YUNXIAO_ACCESS_TOKEN`. Any code in the image can read that environment variable. The example also does not add hardening controls such as a read-only root filesystem, dropped Linux capabilities, a non-root user, resource limits, or constrained outbound networking. Using Docker provides some process isolation, but it does not protect a secret deliberately injected into the container from code running inside that container. ### Attack Path 1. The user configures the Docker-based MCP mode. 2. The registry tag `latest` is updated, compromised, or made to reference an unintended image. 3. Docker pulls and starts the new image. 4. The user's Yunxiao PAT is passed into the container through `YUNXIAO_ACCESS_TOKEN`. 5. Malicious container code reads the token. 6. The container transmits the token externally or directly invokes Yunxiao APIs. 7. The attacker performs any operations allowed by the token and the account's resource memberships. ### Impact Assessment The primary impact is disclosure and abuse of the Yunxiao PAT. Depending on granted scopes, an att ...[truncated 296 chars]- Remediation
View remediation
`. 2. Verify image signatures and build provenance before execution. 3. Use an enterprise registry with immutable tags, access controls, vulnerability scanning, and audit logs. 4. Run the container as a non-root user with: - `--read-only` - `--cap-drop=ALL` - `--security-opt=no-new-privileges` - Explicit CPU and memory limits 5. Restrict outbound network access to the required Yunxiao API endpoint. 6. Use a secret manager or short-lived secret injection mechanism rather than long-lived configuration values. 7. Issue a token containing only the scopes needed for the current operation. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:78- Finding
Recommendation to Persist a Personal Access Token in Shell Profiles
- Content
View full analysis
export ALIBABA_CLOUD_YUNXIAO_ORGANIZATION_ID= ``` **Region site — token + region API base URL:** ```bash export ALIBABA_CLOUD_YUNXIAO_ACCESS_TOKEN= export ALIBABA_CLOUD_YUNXIAO_API_BASE_URL= ``` > **[MUST] Never ask the user for an API base URL on the central site** — it defaults to `openapi-rdc.aliyuncs.com` (for both the CLI and the MCP Server). The base URL is a region-site-only setting. Recommend adding these to the user's shell profile (`~/.bashrc`, `~/.zshrc`, etc.) for persistence. ``` ### Technical Analysis Environment variables are a reasonable mechanism for passing a token to a process, but recommending that users add the export statement to `.bashrc` or `.zshrc` normally results in the PAT being stored in plaintext on disk. Shell profiles may be copied into backups, synchronized between devices, accidentally committed with dotfiles, included in support bundles, or read by other software running as the same user. Every child process launched from that shell can also inherit the token unless the environment is carefully restricted. The Skill includes useful rules against printing tokens, but those controls do not mitigate persistent plaintext storage or broad environment inheritance. ### Attack Path 1. The user follows the recommendation and writes the PAT into a shell profile. 2. The profile is stored in plaintext and loaded for future shell sessions. 3. A local process, malicious dependency, backup operator, synchronized dotfile repository, or diagnostic collection obtains the file or inherited environment. 4. The PAT is extracted. 5. The attac ...[truncated 477 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:27- Finding
Default Request for Broad Read and Write Access Across All Products
- Content
View full analysis
**Token Security Rules (applies to ALL channels):** > - **NEVER** ask users to paste plaintext tokens in conversation or command line > - **NEVER** read/print token values using `echo` or similar commands > - **ONLY** verify token existence via check (see steps below for channel-specific env var names) > - **If token is not configured, STOP** and guide user to Yunxiao Personal Access Token. Required scopes: Organization Management (R/W), Project Collaboration (R/W), Code Management (R/W), Pipeline (R/W), Packages (R/W), Application Delivery (R/W), Test Management (R/W). ``` ### Technical Analysis The Skill supports operations across several Yunxiao products, but a particular invocation generally needs access to only one product and often requires read-only permissions. Declaring all listed read/write scopes as required creates a standing credential with authority far beyond the minimum needed for most requests. This violates least-privilege principles and amplifies every other failure mode. A compromised CLI installer, npm dependency, Docker image, or accidentally selected write operation would receive access to unrelated products. The Skill later instructs users to add missing scopes after a `403`, which would support safer incremental authorization. That approach should replace the up-front all-products read/write requirement. ### Attack Path 1. A user follows the Skill's prerequisite instructions and creates a PAT with read/write access to every listed product. 2. The broad PAT is injected into the CLI, MCP server, or container. 3. A dependency is compromised, the token is exposed, or an erroneous operation is executed. 4. The actor uses unrelated product permissions that were not necessary for the user's original task. 5. The compromise spreads from a single requested ...[truncated 547 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (59)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md > - **NEVER** ask users to paste plaintext tokens in conversation or command line > - **NEVER** read/print token values using `echo` or similar commands > - **ONLY** verify token existence via check (see steps below for channel-specific env var names) > - **If token is not configured, STOP** and guide user to [Yunxiao Personal Access Token](https://help.aliyun.com/zh/yunxiao/developer-reference/obtain-personal-access-token). Required scopes: Organization Management (R/W), Project Collaboration (R/W), Code Management (R/W), Pipeline (R/W), Packages (R/W), Application Delivery (R/W), Test Management (R/W). ### 2.1 CLI Channel Setup (Primary — MUST complete first)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md > - **NEVER** ask users to paste plaintext tokens in conversation or command line > - **NEVER** read/print token values using `echo` or similar commands > - **ONLY** verify token existence via check (see steps below for channel-specific env var names) > - **If token is not configured, STOP** and guide user to [Yunxiao Personal Access Token](https://help.aliyun.com/zh/yunxiao/developer-reference/obtain-personal-access-token). Required scopes: Organization Management (R/W), Project Collaboration (R/W), Code Management (R/W), Pipeline (R/W), Packages (R/W), Application Delivery (R/W), Test Management (R/W). ### 2.1 CLI Channel Setup (Primary — MUST complete first)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md > - **NEVER** ask users to paste plaintext tokens in conversation or command line > - **NEVER** read/print token values using `echo` or similar commands > - **ONLY** verify token existence via check (see steps below for channel-specific env var names) > - **If token is not configured, STOP** and guide user to [Yunxiao Personal Access Token](https://help.aliyun.com/zh/yunxiao/developer-reference/obtain-personal-access-token). Required scopes: Organization Management (R/W), Project Collaboration (R/W), Code Management (R/W), Pipeline (R/W), Packages (R/W), Application Delivery (R/W), Test Management (R/W). ### 2.1 CLI Channel Setup (Primary — MUST complete first)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md > - **NEVER** ask users to paste plaintext tokens in conversation or command line > - **NEVER** read/print token values using `echo` or similar commands > - **ONLY** verify token existence via check (see steps below for channel-specific env var names) > - **If token is not configured, STOP** and guide user to [Yunxiao Personal Access Token](https://help.aliyun.com/zh/yunxiao/developer-reference/obtain-personal-access-token). Required scopes: Organization Management (R/W), Project Collaboration (R/W), Code Management (R/W), Pipeline (R/W), Packages (R/W), Application Delivery (R/W), Test Management (R/W). ### 2.1 CLI Channel Setup (Primary — MUST complete first)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh > - **NEVER** ask users to paste plaintext tokens in conversation or command line > - **NEVER** read/print token values using `echo` or similar commands > - **ONLY** verify token existence via check (see steps below for channel-specific env var names) > - **If token is not configured, STOP** and guide user to [Yunxiao Personal Access Token](https://help.aliyun.com/zh/yunxiao/developer-reference/obtain-personal-access-token). Required scopes: Organization Management (R/W), Project Collaboration (R/W), Code Management (R/W), Pipeline (R/W), Packages (R/W), Application Delivery (R/W), Test Management (R/W). ### 2.1 CLI Channel Setup (Primary — MUST complete first)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh > - **NEVER** ask users to paste plaintext tokens in conversation or command line > - **NEVER** read/print token values using `echo` or similar commands > - **ONLY** verify token existence via check (see steps below for channel-specific env var names) > - **If token is not configured, STOP** and guide user to [Yunxiao Personal Access Token](https://help.aliyun.com/zh/yunxiao/developer-reference/obtain-personal-access-token). Required scopes: Organization Management (R/W), Project Collaboration (R/W), Code Management (R/W), Pipeline (R/W), Packages (R/W), Application Delivery (R/W), Test Management (R/W). ### 2.1 CLI Channel Setup (Primary — MUST complete first)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > **Known API limitations**: Some fields may differ between write and read-back — see [references/verification-method.md](references/verification-method.md).
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > **Known API limitations**: Some fields may differ between write and read-back — see [references/verification-method.md](references/verification-method.md).
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > **Known API limitations**: Some fields may differ between write and read-back — see [references/verification-method.md](references/verification-method.md).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
This parameter table explicitly documents
--yunxiao-access-tokenas a normal way to provide credentials, normalizing insecure secret handling on the command line. In a DevOps administration context, such exposure can leak tokens with access to source code, pipeline execution, release workflows, and artifacts, increasing the blast radius of compromise.- Content
md | Parameter | Description | Required (Central) | Required (Region) | | --- | --- | --- | --- | | `--yunxiao-access-token` | Yunxiao Personal Access Token | Yes | Yes | | `--api-base-url` | API base URL | No (default access point) | Yes | | `--organization-id` | Organization ID | Yes | No |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Variable | Required | Description | Example | |----------|----------|-------------|---------| | `YUNXIAO_ACCESS_TOKEN` | Yes | Yunxiao personal access token | `pt-xxx` | | `YUNXIAO_API_BASE_URL` | No | OpenAPI base URL — omit for the central site (defaults to `https://openapi-rdc.aliyuncs.com`); set only for a region site | `https://openapi-rdc.aliyuncs.com` | | `MCP_TRANSPORT` | No | Transport mode (set to `sse` for SSE mode) | `sse` | | `PORT` | No | Port for SSE mode | `3000` |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Yunxiao Personal Access Token Authorization Scopes All MCP calls in this Skill authenticate using `YUNXIAO_ACCESS_TOKEN`. Different toolsets correspond to different authorization scopes. If the Token's authorization is insufficient, you will receive a `401` (unauthenticated) or `403` (insufficient permissions) error.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Yunxiao Personal Access Token Authorization Scopes All MCP calls in this Skill authenticate using `YUNXIAO_ACCESS_TOKEN`. Different toolsets correspond to different authorization scopes. If the Token's authorization is insufficient, you will receive a `401` (unauthenticated) or `403` (insufficient permissions) error.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Yunxiao Personal Access Token Authorization Scopes All MCP calls in this Skill authenticate using `YUNXIAO_ACCESS_TOKEN`. Different toolsets correspond to different authorization scopes. If the Token's authorization is insufficient, you will receive a `401` (unauthenticated) or `403` (insufficient permissions) error.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Yunxiao Personal Access Token Authorization Scopes All MCP calls in this Skill authenticate using `YUNXIAO_ACCESS_TOKEN`. Different toolsets correspond to different authorization scopes. If the Token's authorization is insufficient, you will receive a `401` (unauthenticated) or `403` (insufficient permissions) error.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Yunxiao Personal Access Token Authorization Scopes All MCP calls in this Skill authenticate using `YUNXIAO_ACCESS_TOKEN`. Different toolsets correspond to different authorization scopes. If the Token's authorization is insufficient, you will receive a `401` (unauthenticated) or `403` (insufficient permissions) error.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Yunxiao Personal Access Token Authorization Scopes All MCP calls in this Skill authenticate using `YUNXIAO_ACCESS_TOKEN`. Different toolsets correspond to different authorization scopes. If the Token's authorization is insufficient, you will receive a `401` (unauthenticated) or `403` (insufficient permissions) error.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Yunxiao Personal Access Token Authorization Scopes All MCP calls in this Skill authenticate using `YUNXIAO_ACCESS_TOKEN`. Different toolsets correspond to different authorization scopes. If the Token's authorization is insufficient, you will receive a `401` (unauthenticated) or `403` (insufficient permissions) error.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Yunxiao Personal Access Token Authorization Scopes All MCP calls in this Skill authenticate using `YUNXIAO_ACCESS_TOKEN`. Different toolsets correspond to different authorization scopes. If the Token's authorization is insufficient, you will receive a `401` (unauthenticated) or `403` (insufficient permissions) error.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Yunxiao Personal Access Token Authorization Scopes All MCP calls in this Skill authenticate using `YUNXIAO_ACCESS_TOKEN`. Different toolsets correspond to different authorization scopes. If the Token's authorization is insufficient, you will receive a `401` (unauthenticated) or `403` (insufficient permissions) error.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Yunxiao Personal Access Token Authorization Scopes All MCP calls in this Skill authenticate using `YUNXIAO_ACCESS_TOKEN`. Different toolsets correspond to different authorization scopes. If the Token's authorization is insufficient, you will receive a `401` (unauthenticated) or `403` (insufficient permissions) error.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Yunxiao Personal Access Token Authorization Scopes All MCP calls in this Skill authenticate using `YUNXIAO_ACCESS_TOKEN`. Different toolsets correspond to different authorization scopes. If the Token's authorization is insufficient, you will receive a `401` (unauthenticated) or `403` (insufficient permissions) error.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Yunxiao Personal Access Token Authorization Scopes All MCP calls in this Skill authenticate using `YUNXIAO_ACCESS_TOKEN`. Different toolsets correspond to different authorization scopes. If the Token's authorization is insufficient, you will receive a `401` (unauthenticated) or `403` (insufficient permissions) error.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Yunxiao Personal Access Token Authorization Scopes All MCP calls in this Skill authenticate using `YUNXIAO_ACCESS_TOKEN`. Different toolsets correspond to different authorization scopes. If the Token's authorization is insufficient, you will receive a `401` (unauthenticated) or `403` (insufficient permissions) error.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Yunxiao Personal Access Token Authorization Scopes All MCP calls in this Skill authenticate using `YUNXIAO_ACCESS_TOKEN`. Different toolsets correspond to different authorization scopes. If the Token's authorization is insufficient, you will receive a `401` (unauthenticated) or `403` (insufficient permissions) error.
Static analysis
No suspicious patterns detected.