Alibabacloud Ebs Disk Metric Analyzer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:49 AM UTC
• Version: 0.0.1

Overview

The skill is aimed at legitimate Alibaba Cloud EBS metric analysis, but its setup instructions create avoidable supply-chain and credential-handling risk.

Review this skill before installing. Use it only with a least-privilege Alibaba Cloud identity limited to EBS metric reads. Do not run the curl-to-bash installer or unverified latest binary downloads unless you independently trust and verify them. Avoid entering real access keys or tokens in command-line examples, logs, prompts, or agent sessions. Be cautious about enabling automatic Aliyun plugin installation and updating all plugins globally; restore or disable that setting after use if you proceed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:44

Finding

Unverified Remote Installation Script Executed Directly by Bash

Content

View full analysis

= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see `references/cli-installation-guide.md` for installation instructions. ``` ### Technical Analysis The command streams the current response from an external URL directly into Bash. The script is not pinned to a reviewed version, saved for inspection, or verified using a cryptographic signature or checksum. Consequently, the code that runs can change after the Skill itself has been audited. HTTPS provides transport protection but does not protect against compromise of the CDN, vendor publication pipeline, origin server, or authorized publishing credentials. Direct remote script execution is not the minimum behavior necessary for an EBS metric-analysis Skill. The project already documents package-manager and manual binary installation alternatives. ### Attack Path 1. The agent loads the Skill and checks the installed Aliyun CLI version. 2. The CLI is absent or older than the required version. 3. The agent follows the installation instruction and requests `setup.sh`. 4. The CDN, origin, publication pipeline, or remote script has been compromised. 5. The malicious response is passed directly to Bash without prior verification. 6. The payload executes with all operating-system privileges available to the invoking user. 7. The payload can inspect local files, steal cloud credentials, alter executables, or establish additional execution mechanisms. ### Impact Assessment Successful exploitation provides arbitrary code execution under the invoking account. The payload may access files and environment variables available to that account, including ...[truncated 343 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:23

Finding

Mutable CLI Binary Installed Without Signature or Checksum Verification

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:49

Finding

Mandatory Automatic Plugin Installation and Unpinned Global Updates

Content

View full analysis

[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ``` ### Technical Analysis The Skill requires a persistent CLI configuration change that automatically installs plugins and then updates all existing plugins to their current remote versions. No plugin version is pinned, and no integrity, signature, or publisher verification procedure is specified. Updating every existing plugin is broader than the declared task, which only requires EBS metric queries. It can modify unrelated CLI components and causes the effective executable dependency set to differ from the version reviewed with the Skill. The automatic-install setting may remain active after the Skill ends because the cleanup procedure disables AI mode but does not restore the previous plugin configuration. This creates continued supply-chain exposure during future CLI use. ### Attack Path 1. The agent enables `--auto-plugin-install` globally in the user's Aliyun CLI configuration. 2. The agent runs `aliyun plugin update`, contacting the configured remote plugin source. 3. A plugin source, publication account, or distribution channel serves a compromised update. 4. The CLI downloads and installs the unreviewed plugin. 5. The plugin is loaded when the EBS command or another associated command is invoked. 6. The plugin executes in the authenticated CLI process and can access local configuration, credentials, command parameters, and API responses. 7. Because automatic installation remains enabled, a later unrelated CLI command may repeat the same attack path. ### Impact Assessment A malicious plugin can execute with the ...[truncated 425 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:88

Finding

Access Keys and Tokens Recommended as Command-Line Arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` The guide repeats this pattern for access-key, STS-token, role-assumption, profile-management, and credential-rotation examples. It also states that non-interactive command-line flags are the recommended method. ### Technical Analysis Supplying access keys, secret keys, private-key paths, and STS tokens as command-line arguments can expose sensitive material through shell history, terminal recording, CI/CD logs, process inspection, debugging output, or copied support transcripts. The recommendation conflicts with the primary Skill's security rules, which prohibit using `aliyun configure set` with literal credentials and require credentials to be configured outside the agent session. A user following the linked installation guide may therefore bypass the safer restrictions in `SKILL.md`. Placeholders are not secrets by themselves, but the documented workflow directs users to replace them with real values in an exposure-prone channel. ### Attack Path 1. A user follows the guide and replaces the placeholders with valid Alibaba Cloud credentials. 2. The command is entered in an interactive shell or included in automation. 3. The shell, terminal, CI system, process monitor, or debug logger records the complete command. 4. Another local user, administrator, log reader, support operator, or compromised process obtains the recorded arguments. 5. The attacker extracts the access key and secret or STS token. 6. The attacker authenticates to Alibaba Cloud and performs operations allowed by the credential's RAM policies until the credential is revoked or expires. ### Impact Assessment ...[truncated 512 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence

Findings (19)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The explicit curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash command is a high-risk pattern because it fetches and executes a remote script in one step, bypassing meaningful user review. In the context of an agent skill, this is especially dangerous because users may trust and copy-paste the command during setup, enabling supply-chain compromise or endpoint takeover if the script source is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

**Pre-check: Aliyun CLI >= 3.3.3 required**

> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.

**Pre-check: Aliyun CLI plugin update required**

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md

5. **No Warnings**: Check that `Warnings` array is empty or review any warnings

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/verification-method.md (reported line 325)May include surrounding context.

md

# Check 4: Warnings
WARNINGS=$(echo "$RESPONSE" | jq -r '.Warnings // [] | length')
if [ "$WARNINGS" -eq 0 ]; then
  echo "✅ No warnings"
else
  echo "⚠️  $WARNINGS warning(s) present:"
  echo "$RESPONSE" | jq -r '.Warnings[]'

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest-style description declares triggers such as "disk metrics", "metric aggregation", and "IOPS analysis" without any scope constraints or exclusion conditions. These phrases are generic enough to match common cloud or observability conversations, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs users to execute a remote installer via curl ... | bash, which runs network-fetched code immediately without verification. If the distribution endpoint, network path, or downloaded script is compromised, this can lead to arbitrary code execution on the user's machine with the user's privileges.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide explicitly recommends passing long-lived Access Key credentials on the command line in non-interactive mode and documents that they are stored in ~/.aliyun/config.json. This can expose secrets through shell history, process inspection, terminal logging, CI logs, and plaintext local storage, especially in automation contexts where commands are copied verbatim.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document tells users to run credential configuration commands but provides no warning about handling access keys, profile scope, or avoiding credential entry inside an agent-driven session. In a skill context, that omission can normalize entering or exposing sensitive cloud credentials during automated workflows, increasing the chance of credential leakage or misuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.

md

## Reference

- [Alibaba Cloud CLI Documentation](https://www.alibabacloud.com/help/en/cli)
- [EBS API Reference](https://api.aliyun.com/api/ebs/2021-07-30)
- [OpenAPI Explorer - DescribeMetricData](https://api.aliyun.com/api/ebs/2021-07-30/DescribeMetricData)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 546)May include surrounding context.

md

## Reference

- [Alibaba Cloud CLI Documentation](https://www.alibabacloud.com/help/en/cli)
- [EBS API Reference](https://api.aliyun.com/api/ebs/2021-07-30)
- [OpenAPI Explorer - DescribeMetricData](https://api.aliyun.com/api/ebs/2021-07-30/DescribeMetricData)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/related-commands.md (reported line 202)May include surrounding context.

md

## Reference

- [Alibaba Cloud CLI Documentation](https://www.alibabacloud.com/help/en/cli)
- [EBS API Reference](https://api.aliyun.com/api/ebs/2021-07-30)
- [OpenAPI Explorer - DescribeMetricData](https://api.aliyun.com/api/ebs/2021-07-30/DescribeMetricData)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/related-commands.md (reported line 203)May include surrounding context.

md

## Reference

- [Alibaba Cloud CLI Documentation](https://www.alibabacloud.com/help/en/cli)
- [EBS API Reference](https://api.aliyun.com/api/ebs/2021-07-30)
- [OpenAPI Explorer - DescribeMetricData](https://api.aliyun.com/api/ebs/2021-07-30/DescribeMetricData)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/verification-method.md (reported line 367)May include surrounding context.

md

## Reference

- [Alibaba Cloud CLI Documentation](https://www.alibabacloud.com/help/en/cli)
- [EBS API Reference](https://api.aliyun.com/api/ebs/2021-07-30)
- [OpenAPI Explorer - DescribeMetricData](https://api.aliyun.com/api/ebs/2021-07-30/DescribeMetricData)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Recommending automatic plugin installation can cause the CLI to modify the local system and fetch executable components from external sources without a clear trust warning. In an agent skill, this expands the attack surface and may lead users to permit unreviewed code installation as part of routine execution.

Content

No source excerpt is available for this finding.