alibabacloud-dns-resolve-diagnose-customer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:40 AM UTC
• Version: 0.0.1

Overview

The skill is a mostly coherent read-only DNS diagnostic tool, but it uses unsafe command templates, broad cloud credential guidance, external probing, and mutable CLI/plugin installation in ways users should review before installing.

Install only if you are comfortable with the agent running local diagnostic scripts, querying Alibaba Cloud read-only DNS/PrivateZone metadata, and sending target domains to boce.aliyun.com. Use a least-privilege read-only RAM role, avoid putting secrets on command lines, do not enable broad auto-updating plugins in sensitive environments, and sanitize/quote any domain values before running the documented shell workflow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:214

Finding

Shell Command Injection Through Unquoted Domain Substitution

Content

View full analysis

$PYTHON scripts/dns_quick_check.py --domain > /tmp/dns_diag_/quick.json $PYTHON scripts/dns_analyze.py quick --file /tmp/dns_diag_/quick.json ``` ```bash ( $PYTHON scripts/dns_openapi.py check --domain > /tmp/dns_diag_/openapi_check.json 2>&1 $PYTHON scripts/dns_openapi.py records --domain --rr > /tmp/dns_diag_/openapi_records.json 2>&1 $PYTHON scripts/dns_openapi.py domain-info --domain > /tmp/dns_diag_/openapi_domain_info.json 2>&1 ) & OPENAPI_PID=$! perl -e 'alarm 120; exec @ARGV' $PYTHON scripts/dns_boce.py dns --domain > /tmp/dns_diag_/dns_probe.json ``` ### Technical Analysis The documented workflow interpolates user-customizable domain values directly into shell commands without quoting or strict DNS-name validation. The domain is used both as a command argument and as part of a redirection path. Although the Python wrappers generally invoke subprocesses with argument arrays and without `shell=True`, that protection does not apply to the controlling shell commands in `SKILL.md`. If an agent replaces `` with a value containing shell metacharacters, command substitution, whitespace, redirection operators, or command separators, the shell can interpret those characters as executable syntax. The related ``, ``, and `` placeholders are also inserted without quoting and require equivalent validation. ### Attack Path 1. An attacker submits a diagnostic request with a crafted value presented as the target domain, such as a value containing a command separator or command substitution. 2. The agent follows the mandatory workflow and substitutes that value into one of the documented shel ...[truncated 848 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:214

Finding

Predictable Temporary Directory Enables Data Disclosure, Tampering, and File Clobbering

Content

View full analysis

$PYTHON scripts/dns_quick_check.py --domain > /tmp/dns_diag_/quick.json ``` ```bash ( $PYTHON scripts/dns_openapi.py check --domain > /tmp/dns_diag_/openapi_check.json 2>&1 $PYTHON scripts/dns_openapi.py records --domain --rr > /tmp/dns_diag_/openapi_records.json 2>&1 $PYTHON scripts/dns_openapi.py domain-info --domain > /tmp/dns_diag_/openapi_domain_info.json 2>&1 ) & perl -e 'alarm 120; exec @ARGV' $PYTHON scripts/dns_boce.py dns --domain > /tmp/dns_diag_/dns_probe.json ``` The workflow also mandates: ```text Data preservation — save all raw data to `/tmp/dns_diag_/` ``` ### Technical Analysis The workflow creates a predictable directory under the shared `/tmp` namespace. Its name is derived from untrusted input, and the directory is created using `mkdir -p` without: - Exclusive creation. - Ownership verification. - Symlink checks. - Restrictive permissions. - A restrictive process umask. - Cleanup after the diagnosis. An attacker with local access can pre-create the directory, create symbolic links at expected output filenames, or replace diagnostic files before analysis. Shell redirection follows symbolic links, so a predictable output file can target another file writable by the agent. The stored OpenAPI output can contain DNS records, PrivateZone records, GTM configuration, domain metadata, and VPC-binding information. Depending on the system umask, those files may also be readable by other local users. ### Attack Path 1. A local attacker predicts the diagnostic path from the requested domain. 2. Before the skill runs, the attacker creates `/tmp/dns_diag_` or one of its expected ou ...[truncated 922 chars]

Remediation

View remediation

"$DIAG_DIR/quick.json" ``` 6. Remove temporary files when processing completes, unless the user explicitly requests retention. 7. If retention is required, move results to a user-controlled secure location and clearly document the potentially sensitive content. 8. Validate JSON ownership and integrity before allowing it to influence final analysis. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/dns_openapi.py:76

Finding

Cloud Credentials and STS Tokens Are Exposed Through Command-Line Arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` ```bash aliyun configure set \ --mode StsToken \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --sts-token v1.0:XXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` ```bash aliyun configure set \ --mode RamRoleArn \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --ram-role-arn acs:ram::123456789012:role/AdminRole \ --role-session-name my-session \ --region cn-hangzhou ``` ### Technical Analysis Secrets supplied as command-line arguments may be exposed through: - Process listings and process-inspection interfaces. - Shell history. - CI/CD command logs. - Debug or telemetry output. - Agent transcripts and execution traces. - Crash reports. The Python implementation places the STS security token directly in the `aliyun` process argument vector. The installation guide repeatedly encourages command-line AK/SK configuration and explicitly describes non-interactive commands as appropriate for “agent-driven automation.” This guidance conflicts with the primary Skill rules in `SKILL.md`, which state that the skill must never handle AK/SK explicitly or use `aliyun configure set` with literal credential values. Users or agents following the referenced installation guide can therefore bypass the intend ...[truncated 1206 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:62

Finding

Unverified Mutable Downloads and Mandatory Automatic Plugin Updates

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (43)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The mismatch includes undeclared cross-account role usage via ALIBABA_CLOUD_ROLE_ARN, which expands access boundaries beyond a simple local DNS diagnostic workflow. Undeclared role assumption can cause the skill to operate against other accounts or resources without reviewers understanding that trust boundary, increasing the risk of unauthorized metadata access or confusing privilege use.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The mismatch includes undeclared cross-account role usage via ALIBABA_CLOUD_ROLE_ARN, which expands access boundaries beyond a simple local DNS diagnostic workflow. Undeclared role assumption can cause the skill to operate against other accounts or resources without reviewers understanding that trust boundary, increasing the risk of unauthorized metadata access or confusing privilege use.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The mismatch includes undeclared cross-account role usage via ALIBABA_CLOUD_ROLE_ARN, which expands access boundaries beyond a simple local DNS diagnostic workflow. Undeclared role assumption can cause the skill to operate against other accounts or resources without reviewers understanding that trust boundary, increasing the risk of unauthorized metadata access or confusing privilege use.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/verification-method.md (reported line 22)May include surrounding context.

Flush local DNS cache and verify

macOS

sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder

Linux

sudo systemd-resolve --flush-caches

text

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/dns_openapi.py (reported line 77)May include surrounding context.

python

cmd.extend([f"--{kebab_key}", str(value)])

    # If STS credentials available, pass via CLI args
    env = os.environ.copy()
    sts_creds = _get_sts_credentials()
    if sts_creds:
        cmd.extend(["--sts-token", sts_creds["SecurityToken"]])

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill invokes shell commands, reads environment variables, and references local files, but it does not declare any explicit tool scope such as allowed-tools or permissions. This makes the effective execution surface broader than what a reviewer or policy engine can easily verify, increasing the risk of unintended command execution or data exposure if the skill is auto-enabled.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The description says the skill 'automatically performs' multiple diagnostic actions, which encourages autonomous execution of shell, network, and cloud API operations. In a skill with external probing and cloud-context inspection, autonomy increases the risk of running against the wrong target, disclosing metadata, or surprising users with actions they did not explicitly approve.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: alibabacloud-dns-resolve-diagnose-customer
description: |
  Alicloud DNS Diagnostic Skill (Read-Only). Diagnostic tool for domain unreachable, DNS resolution failure, DNS record not taking effect, NXDOMAIN, unknownhost, and other DNS-layer issues.
  Automatically performs WHOIS lookup, recursive tracing, OpenAPI config verification, and nationwide probing via boce to generate diagnostic reports.
  Covers Alibaba Cloud DNS, GTM, PrivateZone, and third-party DNS.
  This skill is read-only and will NOT execute any Create, Update, Delete, or other write operations.
  Triggers: "DNS resolution failed", "domain unreachable", "DNS not working", "NXDOMAIN", "domain ping failed", "DNS diagnose", "quick check", "快速检查", "DNS record check", "记录解析", "DNS resolution status", "解析状态", "check A/CNAME/MX/TXT record"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list contains broad phrases like 'quick check' and '记录解析' that can match ordinary conversation and cause the skill to activate unexpectedly. Because the skill runs shell commands and network diagnostics, accidental invocation expands the chance of unintended command execution, external requests, or account-context probing without clear user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH (user-local, no root required)
mkdir -p ~/.local/bin && mv aliyun ~/.local/bin/
export PATH="$HOME/.local/bin:$PATH"  # Add to ~/.bashrc or ~/.zshrc for persistence

# Verify

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 31)May include surrounding context.

md

# Move to PATH (user-local, no root required)
mkdir -p ~/.local/bin && mv aliyun ~/.local/bin/
export PATH="$HOME/.local/bin:$PATH"  # Add to ~/.bashrc or ~/.zshrc for persistence

# Verify
aliyun version

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The quick-start section shows direct entry of access-key IDs and secrets into a CLI command without warning that the secret may be stored in shell history and persisted in plaintext config under the user's home directory. This creates a concrete secret-handling weakness that can expose cloud credentials to other users, malware, backups, or logs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide instructs users to create new AccessKey pairs and configure credentials, which introduces privileged authentication material into a skill advertised as read-only diagnostic tooling. In agent or shared-shell contexts, this can normalize over-privileged setup and increase the chance of secret exposure or later misuse beyond DNS diagnostics.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document states that AK/SK values should not be set manually, yet multiple nearby examples embed access-key IDs and secrets directly in commands. This contradiction encourages unsafe operator behavior, leading to credential leakage through shell history, logs, screenshots, or copied documentation snippets.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 400)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a read-only DNS diagnostic skill focused on resolution troubleshooting, but this guide instructs users to install arbitrary Alibaba Cloud product plugins and explore unrelated service command sets such as ECS and Function Compute. That materially broadens the apparent operational scope beyond DNS diagnostics and beyond the manifest's stated read-only purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented aliyun sts assume-role command enables acquisition of temporary cross-account credentials, which materially expands the skill’s access model beyond its stated read-only DNS diagnostic purpose. Even if only documented and not automatically executed, including this capability can encourage privilege escalation paths and account-boundary crossing during routine diagnostics, especially if operators over-trust the skill’s read-only framing.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/verification-method.md (reported line 22)May include surrounding context.

Flush local DNS cache and verify

macOS

sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder

Linux

sudo systemd-resolve --flush-caches

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/verification-method.md (reported line 24)May include surrounding context.

Flush local DNS cache and verify

macOS

sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder

Linux

sudo systemd-resolve --flush-caches

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

DNS probing sends user-supplied domains to boce.aliyun.com for external nationwide testing without an explicit user-facing disclosure. Even in a read-only diagnostic skill, this can expose confidential domains, internal naming schemes, or investigation targets to a third party and generate observable external traffic.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill metadata describes a DNS diagnostic tool, but the implementation also performs HTTP probing against user-supplied targets via a third-party service. This capability expansion changes the data exposure and network interaction profile, which can mislead users and calling systems about what external requests the skill will cause.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

HTTP probing submits user-provided URLs or domains to boce.aliyun.com, a third-party external service, without any explicit warning or consent mechanism in the code. This can leak sensitive internal hostnames, staging URLs, or confidential endpoints to an outside platform and may trigger unwanted scans from many remote probing nodes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dns_boce.py (reported line 613)May include surrounding context.

python

"--url", http_url,
                    "--timeout", str(args.timeout)] + visible_flag

        dns_proc = _sp.Popen(dns_cmd, stdout=_sp.PIPE, stderr=_sp.PIPE, text=True)
        http_proc = _sp.Popen(http_cmd, stdout=_sp.PIPE, stderr=_sp.PIPE, text=True)

        dns_stdout, dns_stderr = dns_proc.communicate(timeout=args.timeout + 30)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dns_boce.py (reported line 614)May include surrounding context.

python

"--timeout", str(args.timeout)] + visible_flag

        dns_proc = _sp.Popen(dns_cmd, stdout=_sp.PIPE, stderr=_sp.PIPE, text=True)
        http_proc = _sp.Popen(http_cmd, stdout=_sp.PIPE, stderr=_sp.PIPE, text=True)

        dns_stdout, dns_stderr = dns_proc.communicate(timeout=args.timeout + 30)
        http_stdout, http_stderr = http_proc.communicate(timeout=args.timeout + 30)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dns_common.py (reported line 15)May include surrounding context.

python

_alternatives = []
    for _cmd in ("python3.13", "python3.12", "python3.11", "python3.10", "python3.9", "python3.8"):
        try:
            _r = _sp.Popen([_cmd, "--version"], stdout=_sp.PIPE, stderr=_sp.PIPE)
            _out, _ = _r.communicate(timeout=5)
            if _r.returncode == 0:
                _alternatives.append("%s (%s)" % (_cmd, _out.decode().strip()))

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/dns_common.py (reported line 272)May include surrounding context.

python

TOOL_INSTALL_GUIDES = {
    "dig": {
        "darwin": "macOS has dig built-in. If issues: brew install bind",
        "linux": "Ubuntu/Debian: sudo apt install dnsutils\nCentOS/RHEL: sudo yum install bind-utils",
        "win32": "Windows: install BIND toolkit, or use nslookup instead",
    },
    "whois": {