Alibabacloud Dns Resolve Diagnose

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:22 AM UTC
• Version: 0.0.1-beta.1

Overview

This DNS diagnostic skill is purpose-aligned overall, but it needs review because it can modify local Aliyun CLI/plugin state and gives unsafe installation and credential-handling guidance.

Install only after reviewing the scripts and using a least-privilege Alibaba Cloud identity. Avoid curl-to-bash and unpinned dependency installs, do not place cloud secrets in command lines or chats, and require explicit approval before any CLI configuration, plugin installation, sudo command, browser install, STS role assumption, or write to /tmp.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:31

Finding

Unverified Remote Installer Executed Directly by a Shell

Content

View full analysis

Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see `references/cli-installation-guide.md` for installation instructions. ``` ### Technical Analysis The installation command sends mutable network content directly to `bash`. It does not pin an installer version, verify a cryptographic checksum or signature, save the script for inspection, or constrain the installer in a sandbox. The hostname appears related to Alibaba Cloud, but reliance on a recognizable hostname is not an adequate integrity control. The effective code executed by the Skill can change after the Skill package has been audited. Compromise of the hosting infrastructure, its deployment process, DNS resolution, or the TLS trust path could therefore turn this instruction into arbitrary code execution. Installing the Aliyun CLI is only necessary for the optional OpenAPI configuration checks. Basic DNS and WHOIS diagnosis does not require executing a remote installer, so this behavior exceeds the minimum privileges necessary for the Skill's core functionality. ### Attack Path 1. An attacker compromises or alters the remotely hosted `setup.sh`, or compromises a relevant network trust component. 2. A user invokes the Skill on a machine where the required Aliyun CLI version is absent. 3. The agent follows the documented installation command. 4. `curl` retrieves the current attacker-controlled response. 5. The response is immediately interpreted by `bash` without any integrity verification. 6. The payload executes with all privileges available to the agent or user and can access their files, credentials, and network resources. ### Impact Assessment Successful exploitation provides arbitrary co ...[truncated 354 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/dns_openapi.py:24

Finding

Automatic Unpinned Plugin Installation During Module Import

Content

View full analysis

/dev/null", shell=True, capture_output=True, text=True, timeout=60, ) except (subprocess.TimeoutExpired, FileNotFoundError, OSError): pass ``` ### Technical Analysis Importing `dns_openapi.py` automatically changes persistent Aliyun CLI configuration and installs executable plugins from a remote plugin source. The operation has no user confirmation, version pinning, integrity verification, or repository allowlist implemented by the Skill. Import-time package installation is especially risky because callers may reasonably expect an import to define functions without changing local configuration or downloading executable components. The behavior also contradicts the statement in `SKILL.md` that all operations are read-only: although the cloud API operations may be read-only, the local CLI configuration and plugin installation are mutating operations. The use of `shell=True` is unnecessary for these static commands. No direct user-controlled command injection was identified in these two specific strings, but shell invocation increases the execution surface and relies on command resolution through the current environment. ### Attack Path 1. A diagnostic command imports `dns_openapi.py`. 2. The module detects an `aliyun` executable in `PATH`. 3. Automatic plugin installation is persistently enabled. 4. The CLI contacts its configured plugin source and download ...[truncated 698 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned Playwright and Browser Binary Installation

Content

View full analysis

= 3.7) | Run diagnostic scripts | macOS: `brew install python@3.11`; Debian/Ubuntu: `sudo apt install python3` | | `dig` | DNS queries and tracing | macOS: built-in; Debian/Ubuntu: `sudo apt install dnsutils` | | `whois` | Domain registration info | macOS: built-in; Debian/Ubuntu: `sudo apt install whois` | | `playwright` | Nationwide probing | `pip install playwright && playwright install chromium` | ``` The corresponding dependency declaration is also open-ended: ```text playwright>=1.40.0 ``` ### Technical Analysis The installation command resolves the latest package version accepted by the package index and then downloads a browser binary selected by that package. The requirement `playwright>=1.40.0` does not provide an upper bound or an exact version, and no package hashes or browser artifact checksums are supplied. Consequently, a future release can become part of the Skill's execution environment without review. The package and its downloaded Chromium binary both add executable supply-chain components. Nationwide probing is useful but optional, and the Skill already documents a degradation path, so automatic or loosely controlled installation is not the minimum-risk approach. ### Attack Path 1. Playwright is missing when nationwide probing is requested. 2. The agent follows the documented `pip install playwright` command. 3. The package manager resolves the newest release satisfying the open-ended constraint. 4. Playwright downloads a corresponding Chromium binary. 5. A compromised package-index account, dependency artifact, browser distribution channel, or future malicious release supplies executable content. 6. The dependency or browser runs with the agent user's loc ...[truncated 406 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:143

Finding

Unvalidated Domain Substitution in Shell Commands and Predictable Temporary Paths

Content

View full analysis

$PYTHON scripts/dns_quick_check.py --domain > /tmp/dns_diag_/quick.json $PYTHON scripts/dns_analyze.py quick --file /tmp/dns_diag_/quick.json ``` ``` ### Technical Analysis The instructions direct the agent to replace `` inside shell commands and pathnames without quoting or specifying strict domain validation. User confirmation is not equivalent to syntactic validation. If an agent performs direct textual substitution, shell metacharacters, whitespace, redirection operators, or command substitutions in a crafted value may be interpreted by the shell. The directory name is also deterministic and located in the shared `/tmp` namespace. Another local process could pre-create the directory or place symbolic links at expected output paths. Redirection to `quick.json` could then overwrite another file writable by the user. The Python subprocess calls reviewed elsewhere generally use argument arrays, but the documented orchestration commands reintroduce shell interpretation before input reaches those scripts. ### Attack Path **Command-injection path:** 1. An attacker supplies a domain-like value containing shell syntax. 2. The agent confirms or directly substitutes that value into the documented template. 3. The shell parses the substituted metacharacters rather than treating the entire value as one domain argument. 4. The injected command executes with the privileges of the agent process. **Temporary-path attack path:** 1. A local attacker predicts `/tmp/dns_diag_`. 2. The attacker pre-creates the directory and places a symbolic link at `quick.json`. 3. The Skill executes output redirection to the predictable path. 4. The shell follows the symbo ...[truncated 414 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/cli-installation-guide.md:102

Finding

Cloud Access Secrets Encouraged in Command-Line Arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` ### Technical Analysis The guide recommends supplying long-lived Access Key credentials as literal command-line arguments. Depending on the operating system and execution environment, command arguments may be visible in process listings, shell history, terminal recording, audit logs, CI/CD logs, or agent transcripts. This guidance conflicts with `SKILL.md`, which states that the Skill must never ask for AK/SK values directly or use `aliyun configure set` with literal credential values. Because `SKILL.md` explicitly links users to this guide for installation and configuration, users may follow the less secure instructions despite the top-level warning. The guide also describes non-interactive flags as the recommended approach for scripts and agent-driven automation, increasing the likelihood that secrets will be copied into logs or retained in automation definitions. ### Attack Path 1. A user follows the referenced configuration guide. 2. The user inserts a real Access Key ID and Access Key secret into the command. 3. The shell stores the command in history, or a local process, terminal recorder, CI system, or agent log captures the arguments. 4. An attacker with access to that history, process information, or log retrieves the credentials. 5. The attacker authenticates to Alibaba Cloud using the exposed key. 6. The attacker exer ...[truncated 597 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (56)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This mismatch is more serious because the finding indicates undeclared STS AssumeRole or cross-account access behavior, which materially expands trust and access boundaries beyond the stated purpose. Undeclared identity pivoting can surprise users and reviewers, and may enable access to additional accounts or resources without clear consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This mismatch is more serious because the finding indicates undeclared STS AssumeRole or cross-account access behavior, which materially expands trust and access boundaries beyond the stated purpose. Undeclared identity pivoting can surprise users and reviewers, and may enable access to additional accounts or resources without clear consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch is more serious because the finding indicates undeclared STS AssumeRole or cross-account access behavior, which materially expands trust and access boundaries beyond the stated purpose. Undeclared identity pivoting can surprise users and reviewers, and may enable access to additional accounts or resources without clear consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch is more serious because the finding indicates undeclared STS AssumeRole or cross-account access behavior, which materially expands trust and access boundaries beyond the stated purpose. Undeclared identity pivoting can surprise users and reviewers, and may enable access to additional accounts or resources without clear consent.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill recommends piping a remotely fetched script directly into bash, which is a classic high-risk supply-chain pattern. If the remote content is compromised, intercepted, or unexpectedly changed, arbitrary code will execute immediately on the user's system with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.

**Pre-check: Aliyun CLI plugin update required**

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/verification-method.md (reported line 22)May include surrounding context.

Flush local DNS cache before verification

macOS

sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder

Linux

sudo systemd-resolve --flush-caches

text

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/dns_common.py (reported line 265)May include surrounding context.

python

# Flush local DNS cache before verification
# macOS
sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder
# Linux
sudo systemd-resolve --flush-caches
```

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

This command changes CLI behavior by enabling auto-plugin installation, which is an unnecessary and potentially dangerous tool reconfiguration for a diagnostic skill. It abuses the tool boundary by altering execution policy rather than merely querying DNS-related state.

Content

Scanner excerpt · scripts/dns_openapi.py (reported line 28)May include surrounding context.

python

if HAS_CLI:
    try:
        subprocess.run(
            "aliyun configure set --auto-plugin-install true",
            shell=True, capture_output=True, text=True, timeout=5,
        )

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This command installs additional CLI plugins from outside the skill, effectively expanding executable functionality without explicit authorization. That is a strong example of tool parameter abuse because the skill moves from diagnosis into host modification and code acquisition.

Content

Scanner excerpt · scripts/dns_openapi.py (reported line 32)May include surrounding context.

python

"aliyun configure set --auto-plugin-install true",
            shell=True, capture_output=True, text=True, timeout=5,
        )
        subprocess.run(
            "aliyun plugin install --names aliyun-cli-alidns aliyun-cli-domain aliyun-cli-pvtz 2>/dev/null",
            shell=True, capture_output=True, text=True, timeout=60,
        )

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

Copying and forwarding the full process environment to a child process can expose unrelated secrets, tokens, proxy settings, and cloud credentials to the invoked CLI and any plugin code it loads. Because this skill also enables plugin installation and cloud API access, inherited environment data significantly increases the sensitivity of the subprocess boundary.

Content

Scanner excerpt · scripts/dns_openapi.py (reported line 80)May include surrounding context.

python

if value is not None:
                cmd.extend([f"--{_camel_to_kebab(key)}", str(value)])

    env = os.environ.copy()

    import shlex
    shell_cmd = " ".join(shlex.quote(c) for c in cmd)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Using shell=True for regular cloud API invocation is an unnecessary escalation of execution flexibility that broadens the subprocess attack surface. In a skill with access to cloud credentials and dynamic parameters, this weakens the security boundary around tool use even if direct injection is partially mitigated.

Content

Scanner excerpt · scripts/dns_openapi.py (reported line 85)May include surrounding context.

python

import shlex
    shell_cmd = " ".join(shlex.quote(c) for c in cmd)
    try:
        result = subprocess.run(
            shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout, env=env,
        )
    except subprocess.TimeoutExpired:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Using shell=True for STS assume-role calls is especially risky because it wraps privileged authentication actions in an unnecessary shell layer. In the context of cross-account access, any tool misuse has greater consequence than ordinary DNS lookups.

Content

Scanner excerpt · scripts/dns_openapi.py (reported line 162)May include surrounding context.

python

import shlex
    shell_cmd = " ".join(shlex.quote(c) for c in cmd)
    try:
        result = subprocess.run(shell_cmd, shell=True, capture_output=True, text=True, timeout=15)
    except (subprocess.TimeoutExpired, FileNotFoundError):
        return None

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes shell commands, accesses local files, and appears to rely on environment/configuration state, but it declares no explicit tool scope or allowed-tools boundary. That weakens platform enforcement and reviewability, making it easier for the skill to perform broader actions than users or policy expect.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

description: |
  Alicloud DNS Diagnostic Skill. Diagnose DNS resolution failures, domain unreachable issues, NXDOMAIN errors,
  DNS record propagation delays, DNS hijacking, and other DNS-layer problems.
  Automatically performs WHOIS queries, recursive tracing, OpenAPI config verification, and nationwide probing via boce.
  Covers Alibaba Cloud DNS, GTM, PrivateZone, and third-party DNS.
  Triggers: "DNS resolution failed", "domain unreachable", "DNS not working", "NXDOMAIN", "domain ping failed", "DNS diagnose"
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Broad trigger phrases like 'domain unreachable' or 'DNS not working' can cause unintended invocation in ordinary conversations. In this skill, accidental activation is more concerning because the workflow includes shell commands, package installation guidance, network probing, and local file creation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs installation and execution of external tools, plugin updates, Python packages, and browser binaries, and writes artifacts under /tmp, without a prominent up-front warning about downloads, system modification, and local file creation. Users may unknowingly authorize changes to their host or CI environment during what sounds like a simple diagnostic flow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill’s API reference includes an STS AssumeRole example that returns temporary access credentials, which expands the documented capability from read-only DNS diagnosis into credential acquisition. In an agent context, documenting this flow can encourage collection or display of secrets that are not necessary for most troubleshooting tasks, increasing the risk of privilege expansion or accidental credential exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The reference explicitly lists sensitive response fields such as AccessKeyId, AccessKeySecret, and SecurityToken without any warning about handling, redaction, or non-disclosure. In a diagnostic skill, this makes it more likely that an agent logs, echoes, or stores live credentials during troubleshooting, creating a direct secret-exposure path.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This reference file is far broader than a DNS-diagnosis skill needs: it teaches full Alibaba Cloud CLI installation, authentication, profile management, plugin installation, and examples touching multiple services. In an agent skill context, overbroad operational guidance expands the reachable capability surface and can normalize collecting or configuring credentials unrelated to DNS troubleshooting, increasing the chance of unintended cloud access.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Static analysis

No suspicious patterns detected.