Alibabacloud Ecs Reboot Or Crash Diagnosis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:19 AM UTC
• Version: 0.0.1

Overview

The skill is mostly aligned with ECS crash diagnosis, but it asks for broad remote command execution and understates that authority.

Review before installing. Use a narrowly scoped, short-lived Alibaba Cloud identity, confirm the exact instance and region before any Cloud Assistant command, avoid unpinned plugin updates during diagnosis, and treat kdump or Windows dump configuration steps as privileged changes that need separate approval.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/ram-policies.md:30

Finding

Fleet-Wide Remote Command Execution Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: references/ram-policies.md:30-42
Vulnerability Type: Excessively broad remote command execution permission
Risk Level: High

Vulnerable Code

json

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeInstances",
        "ecs:DescribeInstanceAttribute",
        "ecs:DescribeInstanceHistoryEvents",
        "ecs:DescribeCloudAssistantStatus",
        "ecs:RunCommand",
        "ecs:DescribeInvocations"
      ],
      "Resource": "*"
    }
  ]
}

Technical Analysis

The policy grants ecs:RunCommand, which permits remote shell or PowerShell command execution through Alibaba Cloud Assistant. Unlike the other listed Describe* operations, this is a privileged, mutating capability that can execute arbitrary commands in the guest operating system.

Combining ecs:RunCommand with "Resource": "*" allows the credential to target every ECS resource to which the policy applies rather than only the instance being diagnosed. The Skill only needs to diagnose a user-selected instance, so fleet-wide scope exceeds the minimum privileges necessary for its declared function.

The documentation provides command templates containing instance and script-content parameters. If either value is improperly influenced, the broad policy does not provide a resource-level boundary to contain misuse.

Attack Path

1. An administrator grants the documented RAM policy to the identity used by the Skill.
2. An attacker influences the target instance ID or the generated Cloud Assistant command content through compromised input, workflow manipulation, or agent misuse.
3. The Skill invokes ecs:RunCommand against an arbitrary ECS instance covered by "Resource": "*".
4. Cloud Assistant executes the submitted shell or PowerShell content using its privileged execution context.
5. The attacker can read protected data, modify system configuration, install persistence, or di ...[truncated 802 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict the policy to explicitly approved instance ARNs wherever Alibaba Cloud RAM supports resource-level constraints for the relevant action.
2. If resource-level restriction is unavailable, enforce instance-ID and region allowlists through an external authorization layer that cannot be modified through prompt input.
3. Use a dedicated, short-lived role scoped to one diagnostic session and one approved instance.
4. Separate read-only cloud API diagnosis from guest operating-system command execution. Request the latter permission only when it is actually needed.
5. Replace dynamically generated scripts with fixed, reviewed diagnostic scripts or a strict command allowlist.
6. Validate target identifiers against values returned by trusted Alibaba Cloud APIs rather than accepting arbitrary command targets.
7. Require explicit user confirmation immediately before invoking Cloud Assistant.
8. Record the target instance, exact script hash, requesting identity, and execution result in an immutable audit log.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/ram-policies.md:13

Finding

RAM Documentation Incorrectly Characterizes Remote Execution as Read-Only

Content

View full analysis

Vulnerability Details

File Location: references/ram-policies.md:13-22
Vulnerability Type: Misleading privilege and security documentation
Risk Level: Medium

Vulnerable Code

markdown

`ecs:DescribeCloudAssistantStatus` — Verify Cloud Assistant running status to ensure remote diagnostic commands can execute

`ecs:RunCommand` — Execute diagnostic scripts through Cloud Assistant (Linux Shell or Windows PowerShell)

`ecs:DescribeInvocations` — Obtain Cloud Assistant command execution results and extract diagnostic output

## Permission Description

- **Permission scope**: Contains only the read-only and command-execution permissions required for diagnosis
- **Write operations**: None (this Skill does not modify instance configuration)
- **Wildcards**: Not used (follows the principle of least privilege)

Technical Analysis

The statements that there are no write operations and that wildcards are not used are contradicted by the supplied policy:

• ecs:RunCommand permits arbitrary shell or PowerShell execution and is therefore inherently write-capable.
• The custom policy uses "Resource": "*".
• A diagnostic command can become mutating without requiring any additional RAM action.

Security documentation is part of the authorization decision. Characterizing remote command execution as non-mutating may cause administrators to approve a policy without understanding that it can modify guest operating systems. The incorrect wildcard statement also conceals the policy's fleet-wide scope.

Attack Path

1. An administrator reviews the permission description before deploying the Skill.
2. The administrator relies on the claims that the Skill performs no writes and uses no wildcards.
3. The administrator grants the supplied policy, including ecs:RunCommand over "Resource": "*".
4. A generated, mistaken, or attacker-influenced command performs a mutating operation on an ECS instance.
5. The modification succeeds despite the documented ...[truncated 693 chars]

Remediation

View remediation

Remediation Suggestions

1. Explicitly describe ecs:RunCommand as privileged, mutating remote code execution.
2. Replace the “Write operations: None” statement with an explanation that the current diagnostic examples are intended to be read-only, but the permission itself can perform arbitrary writes.
3. Correct the wildcard statement and document the exact resource scope of "Resource": "*".
4. Explain the operating-system identity under which Cloud Assistant commands execute.
5. Document required safeguards, including target validation, fixed scripts, user confirmation, short-lived credentials, and audit logging.
6. Present separate policies for:
   • Cloud API read-only diagnosis.
   • Optional guest operating-system command execution.
7. Include a warning that commands recommended for kdump configuration modify packages, bootloader settings, services, and reboot state and must not be executed without explicit approval.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unpinned Alibaba Cloud CLI Plugin Update During Skill Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:47-57
Vulnerability Type: Unpinned runtime dependency update
Risk Level: Medium

Vulnerable Code

bash

# Enable AI-Mode
aliyun configure ai-mode enable

# Set user-agent for skill identification
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-ecs-reboot-or-crash-diagnosis"

# Update plugins
aliyun plugin update

Technical Analysis

The Skill instructs the agent to update executable Alibaba Cloud CLI plugins immediately before performing diagnosis. No plugin versions, integrity hashes, or reviewed release constraints are specified.

This makes the effective executable dependency set mutable after the Skill has been audited. A compromised upstream distribution channel, malicious plugin release, or incompatible update could alter command processing or execute code with the permissions of the user running the CLI.

The command does not itself prove that a malicious dependency exists. The vulnerability is the uncontrolled runtime update of executable components during a privileged diagnostic workflow.

Attack Path

1. A user invokes the Skill in an environment with configured Alibaba Cloud credentials.
2. The Skill runs aliyun plugin update.
3. The CLI obtains the latest available plugin artifacts rather than a version reviewed with the Skill.
4. A compromised, malicious, or unexpectedly changed plugin is installed.
5. Subsequent aliyun ecs operations load or execute the altered plugin.
6. The plugin can misuse the user's local execution privileges or Alibaba Cloud credentials, modify API requests, alter diagnostic output, or target unintended resources.

Impact Assessment

A malicious plugin would execute under the local identity running the Alibaba Cloud CLI and could potentially access that identity's files, environment, and configured cloud credentials. It could also influence cloud API requests made during diagnosis.

Potential ...[truncated 435 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic plugin updates from the normal diagnostic workflow.
2. Specify and pin exact plugin versions tested with the Skill.
3. Install dependencies during a controlled provisioning phase rather than during each diagnosis.
4. Verify plugin signatures or cryptographic checksums using the official Alibaba Cloud distribution mechanism.
5. Maintain an approved dependency manifest and review updates before deployment.
6. Fail safely when the installed plugin version is unsupported instead of automatically replacing it.
7. If an update is necessary, disclose the version change and require explicit administrative confirmation before installation.
8. Run dependency installation with the minimum local privileges and separately from identities holding broad cloud permissions.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest metadata sets ai-mode: disabled at L011, but the operational instructions explicitly require enabling AI-Mode before running commands at L045-L057. This is an active contradiction in the skill's own documentation about how it should be executed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill directs the agent to execute remote diagnostic commands on a user's ECS instance via Cloud Assistant, including inspection of logs, reboot records, kernel messages, OOM events, and crash-related artifacts, without an explicit user-facing consent step or warning about what data will be accessed. This can lead to unexpected collection of sensitive operational data from the instance and erodes informed user authorization for invasive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Windows workflow similarly authorizes remote inspection of shutdown events, dump configuration, pagefile settings, and dump-file presence without clearly warning the user that commands will be executed on their host and that potentially sensitive crash-diagnostic data will be examined. On Windows systems, event logs and dump metadata may reveal system state, application names, users, or other operationally sensitive information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file states its instructions and operational guidance entirely in Chinese and does not indicate that language selection is optional or user-driven. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.

reboot

6. 启用并启动 kdump 服务

systemctl enable kdump systemctl start kdump systemctl status kdump

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/diagnostic-commands.md (reported line 188)May include surrounding context.

reboot

6. 启用并启动 kdump 服务

systemctl enable kdump systemctl start kdump systemctl status kdump

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document includes direct Cloud Assistant remote execution examples for shell and PowerShell scripts but does not prominently warn that these commands will execute on production instances with the permissions of the cloud agent context. In a diagnostic skill, this increases the risk of operators or downstream agents running generated scripts without explicit confirmation, change control, scope validation, or review, which could cause service disruption or unintended system modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file instructs the user to manually SSH as root and inspect system logs and crash data, which can expose sensitive system information. The surrounding documentation presents these steps as operational guidance but does not include any warning about privileged access, reviewing potentially sensitive logs, or ensuring authorization before running them.

Content

No source excerpt is available for this finding.