Alibabacloud Dms Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:38 AM UTC
• Version: 0.0.2

Overview

The skill is a real Alibaba Cloud DMS database tool, but it asks users to install/update unverified code and enables broad SQL execution with weak safety boundaries.

Review before installing. Use a verified, pinned Aliyun CLI installation path; do not enable global auto plugin installation or update unrelated plugins from inside an agent session; use a least-privilege RAM role scoped to approved databases and preferably read-only for routine use; avoid putting secrets in chat, command arguments, shell history, or persistent environment variables; and require explicit human review for every SQL statement, including SELECT queries.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:44

Finding

Remote Installer Is Downloaded and Executed Without Integrity Verification

Content

View full analysis

**Pre-check 0: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see `references/cli-installation-guide.md` for installation instructions. ``` ### Technical Analysis The installation command pipes content retrieved from an external URL directly into Bash. The script is not pinned to a specific version, saved for inspection, or validated using a repository-pinned checksum or trusted digital signature. Although the URL uses HTTPS and appears related to Alibaba Cloud, the repository provides no mechanism for establishing the integrity of the effective script. Its content can change after this Skill has been reviewed. Compromise of the remote host, CDN, publishing account, DNS resolution, certificate trust chain, or release process could therefore turn this prerequisite into arbitrary code execution. Executing a mutable remote installer is not required for the Skill's database-search and SQL-execution functionality. Installation should be a separate, explicitly controlled administrative operation. ### Attack Path 1. An attacker compromises the remote installer, its publishing process, or a relevant delivery component. 2. A user loads the Skill on a system where Aliyun CLI is absent or older than version 3.3.3. 3. The user or agent follows the documented prerequisite. 4. `curl` retrieves the attacker-controlled response. 5. Bash immediately executes that response without integrity verification or review. 6. The payload operates with all privileges available to the user running the command. ### Impact Assessment Successful exploitation provides arbitrary local command execution as the invoking user. The payload could ac ...[truncated 242 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:57

Finding

Mandatory Unpinned Plugin Updates Introduce a Supply-Chain Execution Path

Content

View full analysis

**Pre-check 3: Aliyun CLI plugin update required** > [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. > Plugin update MUST happen AFTER AI-Mode is enabled and the User-Agent is registered, so the plugin manager itself reports the correct identifier. ``` The same behavior is included in the required lifecycle: ```bash 3. aliyun configure set --auto-plugin-install true && aliyun plugin update # Plugin update ``` ### Technical Analysis The Skill requires global automatic plugin installation and updates every existing plugin before database operations. No plugin allowlist, audited version, checksum, or signature-verification requirement is specified. Updating all installed plugins exceeds what is necessary to invoke the DMS commands. It also causes the code that will execute during the session to change after the Skill itself was audited. A malicious or compromised plugin release could run in the context of an authenticated Aliyun CLI session. The risk is amplified because the Skill subsequently invokes cloud APIs using configured credentials and permits SQL execution. ### Attack Path 1. An attacker compromises a plugin publishing account, repository, update metadata, or distribution service. 2. A malicious plugin update is published. 3. The Skill requires the user to enable automatic installation and run a global plugin update. 4. The compromised component is installed without a version pin or repository-defined integrity check. 5. The affected plugin executes or influences subsequent authenticated CLI operations. 6. The malicious component accesses local data or performs unauthorized cloud API requests using the active identity. ## ...[truncated 407 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/execute_query.sh:154

Finding

Prefix-Based SQL Classification Allows Write and DDL Safety Checks to Be Bypassed

Content

View full analysis

&2 echo " 这些操作可能导致数据不可恢复丢失，请通过 DMS 控制台执行" >&2 exit 1 fi ``` The complete SQL input is later forwarded unchanged: ```bash # Build command arguments CMD_ARGS=( "dms-enterprise" "execute-script" "--tid" "$TID" "--db-id" "$DB_ID" "--script" "$SQL" "--logic" "$LOGIC" "--region" "$REGION" "--user-agent" "$USER_AGENT" "--read-timeout" "$READ_TIMEOUT" "--connect-timeout" "$CONNECT_TIMEOUT" ) EXEC_RESPONSE=$(aliyun "${CMD_ARGS[@]}" 2>&1) ``` ### Technical Analysis The protection examines only the beginning of the raw SQL string. It does not parse SQL statements or ensure that the input contains a single statement. Consequently, a script beginning with an apparently read-only statement can contain a later write or DDL statement. For example, if multiple statements are accepted by the DMS `ExecuteScript` operation, input such as the following is not classified as a write or blocked DDL operation: ```sql SELECT 1; DROP TABLE users; ``` Other possible bypass forms include leading SQL comments or dialect-specific common table expressions. The exact set of executable forms depends on the target da ...[truncated 1232 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:39

Finding

Mutable Latest Binaries Are Installed Into a Privileged System Path Without Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:101

Finding

Credential Configuration Guidance Exposes Secrets Through Process Arguments and Shell History

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` The guide repeats this pattern for access keys, STS tokens, role credentials, profile creation, rotation, and troubleshooting at `references/cli-installation-guide.md:128-165, 175-181, 258-271, 372-382, 449-452`. ### Technical Analysis Passing access keys, access-key secrets, and STS tokens as command-line arguments can disclose them through shell history, process inspection, terminal capture, CI/CD logs, agent transcripts, or debugging output. Calling non-interactive secret-bearing flags the recommended approach conflicts with `SKILL.md:69-78`, which explicitly prohibits asking for or setting literal credentials during the session. Similar command examples also appear in comments at `scripts/execute_query.sh:6` and `scripts/search_database.sh:6`. The examples use placeholders rather than actual embedded credentials, so the repository itself does not contain confirmed live secrets. The vulnerability is the unsafe operational guidance users are instructed to follow. ### Attack Path 1. A user follows the linked configuration instructions and substitutes real credentials. 2. The command containing the secret is recorded in shell history, CI logs, an agent transcript, or process metadata. 3. Another local user, log reader, support operator, or compromised process obtains the credential. 4. The attacker authenticates to Alibaba Cloud before the credential expires or is re ...[truncated 467 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/ram-policies.md:15

Finding

Default RAM Policy Grants SQL Execution Across All DMS Resources

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises a DMS database read/write skill that can both search databases and execute SQL queries/data modifications. The actual code only implements database discovery/search functionality. It interacts with Alibaba Cloud DMS metadata APIs (get-user-active-tenant and search-database) and returns database listings, but contains no SQL execution, query submission, result retrieval from SQL statements, or write/update/insert behavior. Therefore the description materially overstates the implemented capabilities, making it a mismatch.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: alibabacloud-dms-skill
description: |
  Alibaba Cloud DMS Database Read/Write Skill. Use this skill to search for target databases in DMS and execute SQL queries and data modifications.
  Triggers: "DMS query", "database query", "execute SQL", "search database", "DMS SQL", "insert data", "update data".
---

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The instruction to execute 'curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash' downloads and runs a remote script directly in the shell without integrity verification or review. If the remote host, transport path, or script content is compromised, this could lead to arbitrary code execution on the operator's machine.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

> **Pre-check 0: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.

> **Pre-check 1: Enable AI-Mode**

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad enough to activate on common database-related requests, increasing the chance that the skill is invoked in contexts where the user did not intend database execution. Because this skill can perform real SQL reads and writes, overbroad activation materially raises the risk of unintended data access or modification.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The examples state that read operations need no confirmation, which weakens user-consent safeguards for a capability that can access potentially sensitive production data. Even non-mutating SQL like SELECT or SHOW can expose confidential records, schema details, or operational metadata if executed automatically.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

Examples:

bash

# Read operations (no confirmation needed)
./scripts/execute_query.sh --db-id 78059000 --sql "SHOW TABLES"
./scripts/execute_query.sh --db-id 78059000 --sql "SELECT * FROM users LIMIT 10" --json

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide shows non-interactive commands that place long-lived access-key secrets directly on the command line. In shells and automation environments, command-line arguments can be captured in shell history, CI logs, audit trails, or process listings, which can expose credentials and enable unauthorized cloud access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide recommends storing access-key secrets in environment variables without warning that environment variables may propagate to child processes, be exposed in debug output, crash reports, CI job metadata, or shared runtime environments. In an agent or automation context, this increases the chance of credential leakage across tools and subprocess boundaries.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly promotes use of ExecuteScript for SELECT, DML, and DDL operations but does not include any safety guidance, confirmation requirements, or constraints around destructive statements. In the context of a database read/write skill, this can normalize arbitrary mutation of production databases and increases the likelihood of accidental or unsafe execution of DELETE, UPDATE, DROP, or schema-altering commands.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/related-apis.md (reported line 164)May include surrounding context.

md

## API Documentation Links

- [DMS OpenAPI Overview](https://api.aliyun.com/product/dms-enterprise)
- [API Reference](https://help.aliyun.com/zh/dms/developer-reference/)
- [SDK Downloads](https://help.aliyun.com/zh/dms/developer-reference/sdk-download)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/execute_query.sh (reported line 38)May include surrounding context.

sh

echo "  --logic           Use logic database mode"
    echo "  --json            Output results in JSON format"
    echo "  --region <region> Aliyun region (default: cn-hangzhou)"
    echo "  --force           Skip confirmation for write operations (INSERT/UPDATE/DELETE)"
    echo "  --dry-run         Preview write operations without executing"
    echo "  -h, --help        Show this help message"
    echo ""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends authenticated requests to Alibaba Cloud DMS that include tenant/account context and the user-supplied database search keyword, but it provides no explicit notice, confirmation, or privacy warning before transmitting that data. In an agent-skill context, users may invoke database discovery through natural-language triggers without realizing their query terms and cloud account metadata are being sent to a remote service, creating a real privacy and information-disclosure risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This shell script presents several user-facing errors and warnings in Chinese while other help and status output is in English. That imposes a language/locale choice on users without opt-in or clear justification, which fits the policy-violation category for language constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Several user-visible messages are presented in Chinese, while other help text is in English, and the script does not state that it is intended only for Chinese-speaking users or a China-specific locale. This can violate language/locale policy because it forces a specific language experience without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.