alibabacloud-ebs-disk-snapshot-management

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:45 AM UTC
• Version: 0.0.1

Overview

This skill supports legitimate Alibaba Cloud snapshot work, but its installation and permission guidance can expose users to unnecessary high-impact cloud and local execution risk.

Review the RAM policy before installing or using this skill: do not grant wildcard delete or rollback permissions to the skill identity unless you separately intend that administrative access. Avoid the curl-to-bash installer path; use a trusted package manager or verified release instead. Treat any generated CLI command as text to review before running, and require explicit human approval for proxy changes or destructive cloud operations.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/cli-installation-guide.md:20

Finding

Unverified Remote Installer Is Piped Directly into a Shell

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auto_snapshot_policy_helper.py:112

Finding

User-Controlled Values Are Embedded into Copyable Shell Commands Without Safe Quoting

Content

View full analysis

\\ --diskIds '{json.dumps(disk_ids, ensure_ascii=False)}' \\ ``` ### Technical Analysis The helper accepts `--region`, `--name`, and `--disk-ids` values from command-line input and emits a shell command intended to be copied and executed. The `region` and policy-name values are interpolated directly into the command without shell-safe quoting or restrictive format validation. The script does not invoke a shell itself, so this is not immediate code execution during helper execution. However, its declared purpose is to generate sample Alibaba Cloud CLI calls. If a user copies the generated output into a POSIX shell, shell metacharacters, substitutions, separators, or whitespace embedded in an attacker-controlled value can be interpreted as shell syntax rather than as one CLI argument. The disk-ID JSON is enclosed in single quotes, but the underlying disk IDs are not validated against the expected ECS identifier syntax. A disk ID containing a single quote can terminate the shell quoting around the JSON text and alter the resulting command. ### Attack Path 1. An attacker or untrusted automation supplies a craf ...[truncated 1059 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/ram-policies.md:5

Finding

Recommended RAM Policy Grants Destructive Account-Wide Permissions Outside the Skill Scope

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a comprehensive ECS snapshot-management skill with many operational triggers and capabilities. The supplied code chunk implements only a small subset: parsing weekdays/timepoints/retention values for auto snapshot policies, validating them, and emitting sample CLI commands and JSON/table output. It neither invokes cloud APIs nor performs any actual snapshot operations. While auto snapshot policy configuration is one declared area, the overall declared purpose materially overstates the skill's behavior and primary scope, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description promises a comprehensive ECS snapshot operations skill, including operational workflows like creating snapshots, listing them, deleting them, rolling back disks, configuring auto snapshot policies, calculating costs, and managing consistency groups for crash-consistent backup. The supplied code does not implement those behaviors. Instead, it is a standalone command-line validator that performs local precondition checks using an optional JSON file and prints whether the requested operation appears valid. It supports only five operation types and even for those, it does not invoke Alibaba Cloud APIs or mutate resources. Several declared intents are entirely unsupported, especially snapshot listing, cost calculation, and actual backup/group orchestration. Because the primary purpose is narrower and materially different from the declared skill behavior, this is a mismatch.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

>
> Ensure a valid Alibaba Cloud profile or environment credentials are configured before using this skill. If no valid credentials exist, stop and advise the user to configure credentials through official Alibaba Cloud channels.
>
> **Credential Troubleshooting:** When CLI authentication fails, guide the user to verify their credentials in the official Alibaba Cloud console. Use `aliyun configure list` as the diagnostic command for credential issues — it displays profile names without secret values — in preference to inspection commands such as `cat ~/.aliyun/config.json`, `grep` over credential files, `echo $ALIBABA_CLOUD_*`, `env | grep -i key`, or `printenv` on credential variables. Keeping real credential values out of the conversation protects the user's account.

---

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The guide instructs users to fetch and immediately execute a remote shell script via curl ... | bash, which removes the opportunity to inspect the script and makes execution dependent on the integrity of the remote host, CDN, transport, and any intermediate compromise. In a cloud operations skill, this is especially risky because users running the installer are likely to have privileged local environments and cloud credentials configured, increasing the blast radius of any malicious or tampered script.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 23)May include surrounding context.

macOS and Linux (recommended one-liner)

bash

curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

macOS (Homebrew)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The | bash construct is a direct command-chaining pattern that executes whatever bytes are returned by the remote endpoint as shell code, providing no review boundary and making supply-chain or content-injection attacks immediately executable. In the context of Alibaba Cloud snapshot management, operators may run this on administration workstations with access to production cloud accounts, so compromise could lead to credential theft, persistence, or unauthorized cloud actions.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 23)May include surrounding context.

macOS and Linux (recommended one-liner)

bash

curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

macOS (Homebrew)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description says the skill should be used for deleting snapshots and rolling back disks, but later sections state those actions are outside the execution scope and only conceptual guidance is allowed. This creates ambiguity about when the skill should activate versus when another skill or generic assistant behavior should handle the request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad enough to invoke the skill for vague ECS maintenance requests, increasing the chance of accidental activation in the wrong context. In a cloud-management skill, overbroad routing is more dangerous because even read/create paths can expose infrastructure metadata or initiate state changes like snapshot creation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The scope statement explicitly excludes executing deletion, rollback, and policy unbinding operations. However, later documentation says the skill is for the 'complete snapshot lifecycle' and scenario bullets include delete and rollback as supported lifecycle operations, creating an active contradiction about what the skill does versus only explains.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Lines L46-L53 present delete, rollback, and policy deletion as ordinary operational capabilities, while L22-L28 and L173-L206 clearly prohibit executing those destructive actions. This is not merely incomplete wording; it actively blurs the boundary between execution and conceptual guidance.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

md

## Parameter Confirmation

> **IMPORTANT: Parameter Confirmation** — Every required parameter (e.g., `RegionId`, `DiskId`, `SnapshotId`, `InstanceId`, `RetentionDays`, `Force`, policy schedule, etc.) must have an explicit, user-provided value before executing any command or API call. **A parameter the user has already provided in the request is considered confirmed — do NOT ask the user to re-confirm values they have already given.** When the user has supplied all required parameters for a non-destructive operation (create / list / analyze / auto-policy create/apply), proceed directly to execution without an extra confirmation round. Pause to confirm only when a required parameter is missing, when a provided value is genuinely ambiguous, or for destructive operations. Do NOT assume or use default / CLI-profile values in place of a required parameter the user did not provide.

> **[MUST] Interception when a required parameter is missing.** When the user has not explicitly provided a required parameter (`DiskId`, `RegionId`, `SnapshotId`, `InstanceId`, `SnapshotGroupId`, etc.), the assistant stops and asks the user for it. Asking the user is the right path — rather than substituting with either of the following:
> - Using the CLI profile / environment default value (such as the default region) as a substitute for an explicitly confirmed `RegionId`.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.

md

> **[MUST] Session-id and User-Agent first.** Before ANY API call, generate the session-id and attach `--user-agent AlibabaCloud-Agent-Skills/alibabacloud-ebs-disk-snapshot-management/{session-id}` to every `aliyun` command, as described in the **Observability** section, so that all requests in this session can be traced end to end. Before executing each command, check that the `--user-agent` flag is present; if it is missing, rebuild the command with the flag before running it. This is the first step of every workflow, prior to any pre-check or query.

> **[MUST] Unified polling bounds.** When a workflow requires polling (`DescribeSnapshots`, `DescribeSnapshotGroups`, `DescribeDisks`), use a fixed interval of **5–10 seconds** and a maximum of **30 attempts** (about 3–5 minutes). Do NOT poll in a tight loop and do NOT continue past the limit. If the target state is not reached within the limit, stop polling, report the latest observed status plus the `RequestId` to the user, and ask whether to keep waiting — do not silently retry forever.

### Create snapshots

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description limits the skill to ECS disk snapshot operations such as creating/listing/deleting snapshots, rollback, auto snapshot policies, lifecycle management, cost calculation, and consistency groups. Lines L433-L449 add separate capabilities for snapshot preheating and cross-region replication, which are not mentioned in the manifest and represent additional snapshot-related but distinct operational domains.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill instructs altering proxy-related environment variables before retrying API calls, which changes network execution context outside the core business function. In enterprise environments, this can bypass required egress controls, monitoring, or DLP proxies and may cause requests to leave through an unapproved path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The rollback sections document reset-disk and reset-disks without an explicit warning that these operations overwrite current disk state and can cause irreversible data loss. In a skill intended to help users perform ECS snapshot management, omission of a prominent destructive-action warning increases the risk that an agent or user will treat rollback as routine maintenance rather than a last-resort recovery action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file grants and documents use of destructive operations such as snapshot deletion and disk rollback (ecs:DeleteSnapshot, ecs:ResetDisk, ecs:ResetDisks) but does not pair them with an explicit warning that these actions can cause irreversible data loss, service disruption, or rollback to stale state. In a snapshot-management skill, users are likely to operationalize these permissions directly, so omission of safety guidance materially increases the chance of accidental destructive use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow explicitly instructs operators to delete snapshots as part of cleanup and post-upgrade handling, but it does not clearly warn that snapshot deletion is irreversible and can permanently remove recovery points needed for rollback or incident recovery. In this skill’s context, the omission is more dangerous because the document is an operational decision tree for production backup and restore actions, so users are likely to treat the steps as authoritative and execute destructive actions without additional safeguards.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document repeatedly states that delete and rollback are outside the skill's execution scope. Yet the success-verification checklist includes 'Delete' and 'Rollback' verification steps alongside executed operations, implying the skill may perform or complete those workflows itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The introductory text directs users to Alibaba Cloud ECS OpenAPI documentation using a /help/zh/ Chinese-language link as the authoritative reference. This imposes a specific language without user opt-in or an alternative locale, which conflicts with the language-choice policy.

Content

No source excerpt is available for this finding.