alibabacloud-devops

• Outcome: Review
• Latest audit: Aug 17, 2026 · 6:23 AM UTC
• Version: 0.0.3

Overview

This appears to be a legitimate Alibaba Cloud Yunxiao DevOps skill, but it needs review because it can automatically install tooling and perform broad live CI/CD, repository, membership, and release changes.

Install only in a controlled environment. Do not let the agent run installers, curl-piped scripts, npx downloads, or live DevOps write actions unless you explicitly approve the exact command and target. Use a least-privilege Yunxiao personal access token, avoid passing tokens on the command line, and confirm organization, project, repository, pipeline, app, environment, and deletion/release targets before any mutation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes broad terms such as "pipeline," "sprint," "artifact repository," and "DevOps," which are common in ordinary engineering conversations and can cause the skill to activate outside clearly intended Yunxiao workflows. Because this skill can guide installation, authentication, and execution of operational commands, accidental invocation increases the chance of unintended high-impact actions or confusing users into following risky setup steps.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The setup flow instructs the agent to attempt installation automatically, including executing a remote shell script via curl-piped-to-bash, without an explicit upfront warning about the risks of running installation commands or remote scripts. In a DevOps skill, this is especially dangerous because users may follow the instructions in privileged environments, turning an accidental invocation into arbitrary code execution or supply-chain exposure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs users to execute a remotely fetched shell script directly via curl piped into bash and also to move binaries into a directory on PATH, but it provides no warning about verifying the source, inspecting the script, or understanding privilege implications. If the remote host, CDN, or network path were compromised, users could execute arbitrary code immediately with their local privileges, potentially escalated via subsequent sudo steps.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Windows instructions tell users to run PowerShell with ExecutionPolicy Bypass and the included script downloads an executable and modifies the user's PATH, yet the documentation gives no caution about the security tradeoffs. ExecutionPolicy Bypass lowers a built-in safeguard against script execution, and combined with remote download/install behavior it increases the risk of silent execution of tampered code or persistent environment changes.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation explicitly recommends supplying a personal access token via a command-line flag, which can expose the secret through shell history, process listings, audit logs, and CI job output. In a DevOps skill context this is more dangerous because commands are likely to be automated, logged, copied into tickets, or executed on shared build agents where command-line arguments are often retained.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The scenario documents `flow-delete-pipeline` as a cleanup step that permanently deletes a pipeline, but it does not include an explicit warning to obtain user confirmation or explain the destructive impact. In an agent skill, users may interpret documented cleanup as routine post-verification behavior, which increases the chance of unintended deletion of production CI/CD assets.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The application release example invokes `app-stack-execute-change-request-release-stage` to promote an application to staging without an explicit warning that this changes deployment state and may trigger real rollout actions. In a DevOps automation skill, omission of a safety warning can cause an agent to execute an environment-changing action too eagerly, especially if the user request is ambiguous or the wrong workflow/stage is selected.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This catalog documents repository tools that can create, update, delete, and comment on code artifacts, but it provides no user-facing caution that some actions are write-capable and destructive. In an agent skill, listing such tools without prominent safety guidance increases the chance that an agent or user triggers irreversible repository changes or executes workflow-affecting actions unintentionally.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The section includes actions that add, update, delete members and transfer resource ownership, but it omits warnings about authorization and privilege implications. In a DevOps/org-management context, undocumented access-control sensitivity can lead to accidental privilege grants, lockouts, or unauthorized ownership transfer if an agent exposes these tools too casually.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This section describes pipeline runs, manual job execution, deploy-order operations, retries, skips, and log access without warning that these can trigger live builds, deployments, or environment changes. In a DevOps skill, execution-capable operations are especially dangerous because they can affect production systems, CI/CD state, service availability, and release integrity.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The application delivery section includes creation and modification of applications, variables, orchestrations, change orders, release stages, approvals, and execution actions, but it lacks warnings about deployment, secret/configuration, and production workflow risks. Because these tools can directly modify release state and operational configuration, an agent using them without strong warnings may cause outages, misconfiguration, or unauthorized releases.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The test management section documents deletion of test cases and updating of test results without cautioning that these actions can alter auditability and test-data integrity. While lower impact than deployment actions, they can still corrupt QA records, misstate quality status, or remove important testing artifacts if invoked accidentally.

Static analysis

No suspicious patterns detected.