Alibabacloud Ecs Health Inspection

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:09 AM UTC
• Version: 0.0.1

Overview

The ECS inspection purpose is coherent, but the skill needs review because it changes local CLI/plugin state and uses unsafe shell, temp-file, and report-rendering patterns.

Install only after reviewing the local setup path. Prefer a pinned Aliyun CLI and pinned cms plugin in an isolated environment, keep RAM permissions read-only, validate instance/region/disk IDs before running shell batches, and treat generated HTML reports and /tmp telemetry files as potentially sensitive operational data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:29

Finding

Mutable Remote Installer and Automatically Updated Plugins Can Execute Unreviewed Code

Content

View full analysis

Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, install via the following secure flow (download → verify → install). **Do NOT use `curl ... | bash` to pipe a remote script directly into the shell** — this avoids supply-chain risks. > > **Step 1: Download the installer and the setup script:** > ```bash > # Choose the tarball that matches your architecture (amd64 / arm64) and OS > curl -fsSL -o aliyun-cli.tgz https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-arm64.tgz > curl -fsSL -o setup.sh https://aliyuncli.alicdn.com/setup.sh > ``` > > **Step 2: Inspect the script manually before executing:** > ```bash > less setup.sh > shasum -a 256 aliyun-cli.tgz setup.sh > bash ./setup.sh > aliyun version > ``` ``` ```bash aliyun configure set --auto-plugin-install true aliyun plugin update ``` ### Technical Analysis The pre-scan warning about direct `curl | bash` execution is a false positive: the Skill explicitly prohibits that pattern. Nevertheless, it still downloads a mutable remote shell script and executes it locally. The `setup.sh` URL and the archive name containing `latest` do not identify immutable artifacts. The instructions calculate hashes but do not provide trusted expected values, a signed checksum file, or a vendor-signature verification procedure. Calculating and recording the hash of a compromised download does not establish its authenticity. The mandatory plugin configuration also enables automatic installation and performs an unrestricted update. No exact plugin version, package digest, or signature is pinned. Consequently, the effective code executed by the Skill can change after the Skill itself has been audited. The installation is only necessary when the CLI is absent or outdated, but automatic plugi ...[truncated 1617 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/inspection-commands.md:90

Finding

Unvalidated Parameter Interpolation Enables Shell Injection and Unsafe Temporary-File Writes

Content

View full analysis

/tmp/ecs_inspect_cpu.json 2>&1 & aliyun ecs describe-disks \ --biz-region-id $RGN \ --region $RGN \ --instance-id $IID \ > /tmp/ecs_inspect_disks.json 2>&1 & wait for k in cpu load1m load5m load15m mem diskrbps diskwbps diskriops diskwiops netin netout diskusage disks; do echo "=== ${k} ===" && cat /tmp/ecs_inspect_${k}.json done ``` The fallback template has the same class of issue: ```bash aliyun ecs describe-instance-monitor-data --region-id $REGION --instance-id $INSTANCE_ID \ --start-time $START --end-time $END --period 60 \ > /tmp/ecs_3b_imd.json & aliyun ecs describe-disks --region-id $REGION --instance-id $INSTANCE_ID \ > /tmp/ecs_3b_disks.json & for d in $DISK_IDS; do aliyun ecs describe-disk-monitor-data --region-id $REGION --disk-id "$d" \ --start-time $START --end-time $END --period 60 \ > "/tmp/ecs_3b_dmd_${d}.json" & done wait ``` ### Technical Analysis The Skill requires the user to confirm instance and region parameters, but confirmation is not input validation. No strict syntax checks are mandated before the values are inserted into a shell batch. If an Agent replaces the example strings with raw user input, shell metacharacters inside the assignment remain active. For example, an input containing `$(command)` inside a double-quoted assignment performs command substitution. Embedded quotes or newlines can also terminate the intended assignment and introduce additional shell statemen ...[truncated 2570 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/render_report.py:375

Finding

Unescaped Anomaly Anchor Allows HTML Attribute Injection in Generated Reports

Content

View full analysis

section' if anchor else "" anomalies_html += ( f'

\n' f' {icon} {_esc(a.get("title", ""))}: {_esc(a.get("message", ""))}{detail_link}\n' f'

\n' ) ``` Validation errors do not prevent rendering: ```python # Auto-validate before rendering; errors are warnings only and do not block rendering errs = validate(data) if errs: print("⚠ JSON pre-validation found issues (continuing render anyway; recommend fixing per SKILL Step 6.1):", file=sys.stderr) for e in errs: print(f" - {e}", file=sys.stderr) html_str = render(data) with open(args.output, "w", encoding="utf-8") as f: f.write(html_str) ``` ### Technical Analysis Most report text is passed through `_esc()`, but `assessment.anomalies[].anchor` is directly inserted into a double-quoted `href` attribute. The renderer neither applies attribute-safe escaping nor restricts anchors to known section identifiers. A value such as: ```json { "anchor": "\" onclick=\"alert(document.domain)" } ``` produces markup equivalent to: ```html section ``` The injected quote terminates the intended `href` value and introduces an event-handler attribute. Other payloads can inject additional attributes or markup depending on browser parsing. The `validate()` function does not validate anomaly anchors. More broadly, the normal rendering path treats validation errors as warnings and continues, despite th ...[truncated 1650 chars]

Remediation

View remediation

section' ``` 3. Apply an identifier grammar such as `^[A-Za-z][A-Za-z0-9_-]*$` even when an allowlist is used. 4. Validate `anomalies` as a list of objects and validate `level`, `anchor`, `title`, and `message` types. 5. Restrict `level` to known CSS classes such as `warn` and `crit`; do not interpolate arbitrary class names. 6. Make all validation errors fatal in the normal rendering path: ```python errs = validate(data) if errs: for error in errs: print(error, file=sys.stderr) return 1 ``` 7. Add regression tests with quote-breaking anchors, event-handler payloads, tags, control characters, and malformed types. 8. Consider adding a restrictive Content Security Policy to the generated document as defense in depth, while retaining correct contextual escaping as the primary fix. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Although the text warns against piping curl to bash, it still directs the agent to fetch and execute a remote installer script after only manual inspection and hash recording. In practice, remote script execution remains a supply-chain risk, especially when hashes are not pinned in the skill and the source is fetched live at runtime.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

### Pre-check: Aliyun CLI >= 3.3.3 required

> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, install via the following secure flow (download → verify → install). **Do NOT use `curl ... | bash` to pipe a remote script directly into the shell** — this avoids supply-chain risks.
>
> **Step 1: Download the installer and the setup script:**
> ```bash

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instructions are internally contradictory: 3B says all CMS calls must stop immediately, but later requires GPU instances on 3B to still attempt CMS GPU queries. In an automated agent, conflicting directives can cause unsafe fallback behavior, repeated failed calls, policy bypass attempts, or nondeterministic execution paths that are hard to audit.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The skill performs wildcard deletion in /tmp as part of mandatory cleanup. Even though the pattern is somewhat constrained, destructive shell cleanup can remove unrelated files matching the prefix, and in less controlled environments it creates unnecessary risk around path expansion and collateral data loss.

Content

Scanner excerpt · SKILL.md (reported line 348)May include surrounding context.

md

> [MUST] On every exit — success, failure, cancel, or any exception — **always** run:
> ```bash
> aliyun configure ai-mode disable 2>/dev/null || true
> rm -f /tmp/ecs_inspect_*.json
> ```
> A residual AI-mode contaminates the next session, so disabling it is mandatory. This skill is read-only — no cloud-side cleanup is needed.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/inspection-commands.md (reported line 252)May include surrounding context.

aliyun configure ai-mode disable 2>/dev/null || true

Remove temporary JSON files generated during inspection

rm -f /tmp/ecs_inspect_*.json

text

> AI-mode must not leak across sessions. Whether or not the inspection completed, this step is mandatory.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill clearly performs file reads and writes, including reading reference files and writing reports and temporary JSON, but it does not declare an explicit tool scope or allowed-tools boundary. That weakens sandbox expectations and can let an agent use broader file capabilities than reviewers or orchestrators anticipate.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill markets itself as read-only and zero-mutation on the execution path, yet it instructs the agent to change local CLI state, enable AI mode, toggle auto-plugin-install, update plugins, and potentially install software. This mismatch can mislead operators and policy engines about the true side effects of running the skill.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill documentation couples a read-only ECS health inspection workflow with broader CLI environment changes, including plugin-related behavior and global configuration assumptions. Expanding scope beyond the inspection task increases attack surface and can persistently alter the operator environment in ways the user may not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The referenced workflow assumes or enables persistent auto-plugin installation for the Alibaba CLI, which modifies future tool behavior beyond the current inspection task. Silent or implicit dependency installation creates supply-chain and environment-integrity risk, especially in automated agent contexts where users may not realize their CLI has been reconfigured.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Enabling and later disabling a global 'ai-mode' changes CLI state outside the immediate inspection action and is not necessary to retrieve ECS health metrics. Any global mode change can affect other sessions, commands, or tools, especially if cleanup is skipped on interruption, creating cross-session state leakage and unexpected behavior.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The workflow writes collected telemetry and instance metadata to predictable files under /tmp, which can expose operational data to other local users or processes depending on host configuration and file permissions. Relying on later cleanup is fragile because crashes, cancellations, or concurrent runs can leave sensitive artifacts behind.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest enumerates CPU usage, system load, memory usage, disk IO, network traffic, disk capacity, and GPU metrics. Lines L139-L147 add Top-5 process inspection via process.cpu and process.memory, which inspects individual processes rather than the declared instance-level health metrics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The rendered document sets <html lang="en"> unconditionally, which forces an English-language locale in the output regardless of user preference or input context. Under the policy, locale constraints should either be user-selectable or explicitly justified.

Content

No source excerpt is available for this finding.