ClawHub
Back to skill

Security audit

alibabacloud-dsc-audit

Security checks for vulnerabilities and agentic risk

Overview

The skill’s cloud risk-query and handling functions are mostly coherent, but its setup instructions introduce unnecessary remote code execution and persistent CLI plugin changes.

Review before installing. The Data Security Center scripts are narrowly aimed at querying and manually handling risk events, but do not let an agent run the curl-to-bash installer or enable automatic Aliyun CLI plugin installation without separate review. Prefer installing required tools through a trusted, pinned method, use a least-privilege RAM role, and grant PreHandleAuditRisk only to users who are allowed to change risk-event state.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:79
Finding

Unverified Remote Installer Is Piped Directly Into a Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 79-82
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable code:

text
> **Pre-check: Aliyun CLI >= 3.3.3 required**
> Run the following command to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.

Technical Analysis

The instruction downloads a mutable shell script from an external server and passes it directly to bash. There is no version pinning, checksum verification, signature validation, local inspection step, or immutable artifact reference. HTTPS protects the connection in transit but does not establish that the content currently hosted at the URL is the same content that was reviewed with this Skill.

The effective code executed by the Skill can therefore change after publication. Compromise of the hosting service, CDN, DNS resolution, TLS trust chain, or upstream deployment process could turn this instruction into arbitrary shell execution.

This installation behavior also exceeds the minimum requirements of the declared functionality. The bundled Python scripts invoke the Alibaba Cloud OpenAPI SDK directly, and SKILL.md requires queries and handling operations to use those scripts rather than the Aliyun CLI. Installing or upgrading the CLI is consequently unnecessary for the core query and handling workflow.

Attack Path

  1. An attacker compromises or gains deployment control over https://aliyuncli.alicdn.com/setup.sh, or otherwise causes the client to receive attacker-controlled content from that URL.
  2. A user or agent follows the Skill instruction because the CLI is absent or below the specified version.
  3. curl downloads the current response without saving it for review.
  4. The shell executes the r ...[truncated 961 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash instruction.
  2. Remove the Aliyun CLI prerequisite entirely if all business operations continue to use the bundled Python SDK scripts.
  3. If the CLI is genuinely required, prefer a trusted operating-system package manager with a pinned version.
  4. Otherwise, download a versioned release artifact without executing it, verify a vendor signature or a pinned SHA-256 digest, and only then install it.
  5. Avoid mutable latest or generic installer URLs.
  6. Require the user to review and explicitly approve installation before any downloaded code is executed.
  7. Perform installation with an unprivileged account and request elevation only for a narrowly identified file operation when unavoidable.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:88
Finding

Automatic CLI Plugin Installation and Update Introduces an Unnecessary Supply-Chain Execution Path

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 88-92
Vulnerability Type: Uncontrolled third-party component update
Risk Level: Medium

Vulnerable code:

text
> **Pre-check: Aliyun CLI plugin update required**

```bash
aliyun configure set --auto-plugin-install true
aliyun plugin update
text

### Technical Analysis

These commands persistently enable automatic plugin installation and update locally installed CLI plugins from a remote plugin ecosystem. The instructions do not pin plugin names or versions and do not require checksum, signature, provenance, or review verification.

Updating executable components immediately before cloud operations expands the trusted computing base beyond the audited repository. A compromised plugin repository, release pipeline, package, or update channel could introduce attacker-controlled code. Enabling automatic installation also changes persistent CLI configuration, allowing future commands to retrieve components that were not present during this audit.

This behavior exceeds the minimum privilege and dependency scope needed by the Skill. The declared implementation uses the Python SDK, and `SKILL.md` directs business API calls through `scripts/query_risk.py` and `scripts/handle_risk.py`. No CLI plugin is needed by those scripts.

The broader installation guide additionally recommends unrelated ECS, VPC, and RDS plugins, but these are outside the Data Security Center query and handling functionality.

### Attack Path

1. An attacker compromises a CLI plugin, plugin repository, update metadata, or upstream publication account.
2. An agent follows the mandatory pre-check and enables automatic plugin installation.
3. `aliyun plugin update`, or a later CLI command, retrieves the compromised plugin.
4. The plugin is installed into the user’s CLI environment without a project-pinned version or repository-controlled integrity check.
5. When the CLI loads or 
...[truncated 805 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the mandatory plugin-update pre-check and do not enable automatic plugin installation.
  2. Keep the Skill limited to its pinned Python SDK dependencies and bundled scripts.
  3. If a CLI plugin becomes necessary, identify the exact plugin and version required.
  4. Verify plugin provenance, cryptographic signatures, and pinned hashes before installation.
  5. Disable automatic updates so future executions cannot silently change the reviewed code path.
  6. Obtain explicit user approval before changing persistent CLI configuration.
  7. Remove unrelated ECS, VPC, and RDS plugin recommendations from the Skill-specific installation path.
  8. Continue using the documented least-privilege RAM policy, preferably separating read-only query access from mutation access.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (25)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code clearly targets Alibaba Cloud Data Security Center and security risk events, which aligns with the general domain in the description. It authenticates to the DSC endpoint and invokes the DescribeRiskRules API to list risk items filtered by HandleStatus, CurrentPage, and PageSize. However, the description says the skill supports both viewing unprocessed risk events and performing manual handling operations on risk events. This code chunk implements only the viewing/query portion and contains no API call or logic for manual handling, updating, or pre-handling events. Therefore, the declared description overstates the implemented capabilities, creating a description-behavior mismatch.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The skill instructs piping a remotely fetched script directly into bash, which creates an immediate arbitrary code execution path if the hosting endpoint, network path, or script content is compromised. In an agent skill context, this is especially dangerous because it normalizes unaudited code execution during setup before any business logic runs.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

Pre-check: Aliyun CLI >= 3.3.3 required Run the following command to verify >= 3.3.3. If not installed or version too low, run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to update, or see references/cli-installation-guide.md for installation instructions.

bash

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md
then confirms a `RiskId` that is absent from that query result, do not run `scripts/handle_risk.py`. The fresh query already proves that the target is not curr

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

md
then confirms a `RiskId` that is absent from that query result, do not run `scripts/handle_risk.py`. The fresh query already proves that the target is not curr

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

md
then confirms a `RiskId` that is absent from that query result, do not run `scripts/handle_risk.py`. The fresh query already proves that the target is not curr

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md
then confirms a `RiskId` that is absent from that query result, do not run `scripts/handle_risk.py`. The fresh query already proves that the target is not curr

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md
then confirms a `RiskId` that is absent from that query result, do not run `scripts/handle_risk.py`. The fresh query already proves that the target is not curr

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

md
then confirms a `RiskId` that is absent from that query result, do not run `scripts/handle_risk.py`. The fresh query already proves that the target is not curr

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

md
then confirms a `RiskId` that is absent from that query result, do not run `scripts/handle_risk.py`. The fresh query already proves that the target is not curr

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

md
then confirms a `RiskId` that is absent from that query result, do not run `scripts/handle_risk.py`. The fresh query already proves that the target is not curr

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.

md
then confirms a `RiskId` that is absent from that query result, do not run `scripts/handle_risk.py`. The fresh query already proves that the target is not curr

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

md
then confirms a `RiskId` that is absent from that query result, do not run `scripts/handle_risk.py`. The fresh query already proves that the target is not curr

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

md
then confirms a `RiskId` that is absent from that query result, do not run `scripts/handle_risk.py`. The fresh query already proves that the target is not curr

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.

md
then confirms a `RiskId` that is absent from that query result, do not run `scripts/handle_risk.py`. The fresh query already proves that the target is not curr

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.

md
then confirms a `RiskId` that is absent from that query result, do not run `scripts/handle_risk.py`. The fresh query already proves that the target is not curr

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes shell commands, reads environment state, installs packages, and can perform a state-changing cloud action, yet it declares no explicit tool scope or permission boundaries. That increases the chance an agent/runtime grants broader execution than intended and makes review and enforcement of least privilege difficult.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md
1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash
# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The policy example grants yundun-sddp:PreHandleAuditRisk, which enables manual handling of security risk events, but the documentation does not clearly warn users that this is a state-changing permission rather than read-only access. In a security operations context, unclear presentation of mutating permissions can lead users to over-grant access or attach a policy believing it is only for viewing events, increasing the chance of unauthorized or accidental changes to audit/risk workflows.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

Lines L316-L318 state the skill only uses two DSC APIs and explicitly say not to use Alibaba Cloud CLI tools to call APIs. Earlier sections, however, repeatedly describe business API CLI invocations with a required --user-agent flag and direct the operator to use Aliyun CLI setup/configuration commands, creating contradictory operational guidance in the same document.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The sample stored configuration sets "language": "en", which imposes a specific language in the documented profile example. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is clearly optional or justified.

Content

No source excerpt is available for this finding.