Security audit

Alibabacloud Emas Apm Query

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Alibaba Cloud APM troubleshooting helper, but its setup and data-handling guidance creates avoidable risk around cloud credentials, unpinned executable updates, and persisted sensitive diagnostic data.

Review this skill before installing if you will run it on a machine with Alibaba Cloud credentials. Prefer OAuth or managed roles, do not paste access-key secrets into chat or shell history, avoid auto-updating unpinned plugins, and store generated APM reports only in a private directory because they may contain user, device, IP, log, and crash details.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/cli-installation-guide.md:11
Finding: Unverified Remote Payloads Are Downloaded and Executed
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:52
Finding: Automatic Installation and Updating of an Unpinned CLI Plugin
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/cli-installation-guide.md:74
Finding: Cloud Credentials Are Recommended in Plaintext Command-Line Arguments
Content: View full analysis
\ --access-key-secret \ --region cn-hangzhou ``` The guide then states: ```text All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` Equivalent command-line patterns are also provided for STS tokens and role-based authentication later in the same guide. ### Technical Analysis The guide recommends passing long-lived access-key secrets and temporary security tokens as command-line arguments. Such values may be retained in shell history, terminal logs, CI job logs, agent transcripts, command auditing systems, and process telemetry. Depending on the operating system and process-inspection policy, arguments may also be observable by other local processes while the command is running. This conflicts with the Skill's stated policy that AK/SK values must not be printed or forwarded. The risk is greater in “agent-driven automation,” where a user may paste credentials into a conversational interface and the generated command may be retained by external logging or orchestration systems. ### Attack Path 1. The user is instructed to configure the CLI using non-interactive flags. 2. The user substitutes real Access Key, Secret Key, or STS token values. 3. The command is entered into a shell, CI configuration, automation system, or agent conversation. 4. The plaintext command is retained in history, logs, transcripts, audit telemetry, or process metadata. 5. An attacker with access to one of those records retrieves the credentials. 6. The attacker authenticates t ...[truncated 628 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/dig_issue.sh:101
Finding: Sensitive APM Sample Data Is Persisted Without Explicit Access Controls
Content: View full analysis
"$OUT_DIR/01-get-issue.json" 2>"$OUT_DIR/01-get-issue.err" ``` ```bash aliyun emas-appmonitor get-errors \ --app-key "$APP_KEY" --os "$OS" --biz-module "$BIZ_MODULE" \ --time-range "StartTime=$START_MS" "EndTime=$END_MS" \ --digest-hash "$DIGEST_HASH" \ --page-index 1 --page-size "$PAGE_SIZE" \ > "$OUT_DIR/02-get-errors.json" 2>"$OUT_DIR/02-get-errors.err" ``` ```bash "${CMD[@]}" > "$OUT_DIR/samples/${UUID}.json" 2>"$OUT_DIR/samples/${UUID}.err" ``` ### Technical Analysis The script writes complete APM API responses into the current working directory without setting a restrictive `umask` or explicitly applying owner-only permissions. The stored responses can contain device identifiers such as `Did`, `Uuid`, and `Utdid`, device and operating-system attributes, geographical dimensions, application logs, controller paths, stack traces, exception messages, thread information, and other business telemetry. The generated report also reproduces portions of these fields. Actual permissions are inherited from the caller's environment. On a system using a permissive `umask`, other local users or processes may be able to read the output. Because the default location is the application repository, the directory may also be accidentally added to version control, included in build artifacts, synchronized to shared storage, or uploaded to an external code-hosting service. The netwo ...[truncated 1346 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 91% confidence
Finding: The cleanup step instructs running rm -rf ./emas-apm-dig-*, which performs irreversible recursive deletion based on a glob in the current working directory. Although scoped to a prefix and marked optional, it still relies on cwd semantics and can delete unintended directories or files if the user is in the wrong location or if similarly named paths exist.
Content: Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.
aliyun configure ai-mode disable

(optional) delete the local JSON directories produced by dig_issue.sh

rm -rf ./emas-apm-dig-*

text
## 10. Best Practices

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON manifest defines user-facing filter names and option labels entirely in Chinese, such as "异常类型", "设备ID", and status values like "未处理". Because the file does not indicate that this skill is region-specific or offer a language choice, it appears to impose a specific locale on all users, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This JSON defines user-facing natural-language labels such as "应用版本", "设备ID", and many others entirely in Chinese, but the file provides no opt-in, alternative locale, or documentation that the skill is intentionally China-specific. Under the policy, forcing a specific language without user choice or clear regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON manifest contains user-facing filter names and option labels entirely in Chinese, such as "异常类型", "是否自定义", and status values like "未处理". Because the file provides no indication that the skill is intentionally region-specific or that users can opt into a language/locale, it appears to force a specific language in a way that may violate locale-choice policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON manifest contains many user-facing names such as "应用版本", "设备ID", and status labels in Chinese, but provides no alternate locale values or opt-in mechanism. Under the policy, forcing a specific language without user choice is a natural-language locale violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JSON manifest contains many user-facing filter names and option labels entirely in Chinese, such as "应用版本", "设备ID", and status values like "未处理". Because the file does not provide any alternate locale values, opt-in mechanism, or documentation that this is a China-specific/Chinese-only deployment, it appears to force a specific language without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This JSON manifest contains user-facing natural-language labels entirely in Chinese, such as filter names and option names, but provides no indication that the skill is China-specific or that users can opt into a locale. That creates a language/locale policy concern because the skill appears to force a specific language in its interface strings without documented justification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest says the skill covers only four read-only OpenAPIs: get-issues, get-issue, get-errors, and get-error. This file explicitly treats additional commands such as get-activity-event and get-activity-events as part of the expected subcommand set, which broadens the documented behavior beyond the manifest's stated scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: These instructions require global CLI state changes (aliyun configure ai-mode enable/disable and set-user-agent) that are outside the declared read-only troubleshooting scope. Even though not directly credential-stealing, mutating client configuration creates hidden side effects, can affect other sessions or tools on the same environment, and expands the skill from passive querying into environment reconfiguration.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/appkey-detection.md (reported line 7)May include surrounding context.
md
## Detection order 1. First determine which project type the user currently has open (or has provided): existence of `build.gradle` / `AndroidManifest.xml` -> Android; `*.xcodeproj` / `Info.plist` -> iOS; `module.json5` + `ets/` -> HarmonyOS; `pubspec.yaml` -> Flutter; `Assets/` + `ProjectSettings/` + `*.cs` -> Unity; `package.json` plus an H5 SDK -> H5. 2. Run the grep / AST rules from the matching platform section. 3. Exactly one hit -> echo and ask the user to confirm; multiple hits -> list all candidates; zero hits -> ask the user proactively. 4. Flutter / Unity cross-platform apps usually ship **AppKeys for both Android and iOS**; the user must additionally pick which side this query targets.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/appkey-detection.md (reported line 98)May include surrounding context.
md
## Detection order 1. First determine which project type the user currently has open (or has provided): existence of `build.gradle` / `AndroidManifest.xml` -> Android; `*.xcodeproj` / `Info.plist` -> iOS; `module.json5` + `ets/` -> HarmonyOS; `pubspec.yaml` -> Flutter; `Assets/` + `ProjectSettings/` + `*.cs` -> Unity; `package.json` plus an H5 SDK -> H5. 2. Run the grep / AST rules from the matching platform section. 3. Exactly one hit -> echo and ask the user to confirm; multiple hits -> list all candidates; zero hits -> ask the user proactively. 4. Flutter / Unity cross-platform apps usually ship **AppKeys for both Android and iOS**; the user must additionally pick which side this query targets.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/appkey-detection.md (reported line 99)May include surrounding context.
md
## Detection order 1. First determine which project type the user currently has open (or has provided): existence of `build.gradle` / `AndroidManifest.xml` -> Android; `*.xcodeproj` / `Info.plist` -> iOS; `module.json5` + `ets/` -> HarmonyOS; `pubspec.yaml` -> Flutter; `Assets/` + `ProjectSettings/` + `*.cs` -> Unity; `package.json` plus an H5 SDK -> H5. 2. Run the grep / AST rules from the matching platform section. 3. Exactly one hit -> echo and ask the user to confirm; multiple hits -> list all candidates; zero hits -> ask the user proactively. 4. Flutter / Unity cross-platform apps usually ship **AppKeys for both Android and iOS**; the user must additionally pick which side this query targets.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest explicitly states that client coverage is native Android/iOS/HarmonyOS, Flutter, and Unity, and that H5 is out of scope. However, the detection order instructs the skill to identify H5 projects as a first-class project type, which expands behavior beyond the declared scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This section provides concrete H5 SDK patterns and grep rules for extracting H5 app keys from JavaScript/TypeScript/HTML projects. That operational guidance goes beyond the manifest's stated scope, which excludes H5 support.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file enumerates filter fields such as clientIp, userNick, userId, and device identifiers across multiple biz-modules and platforms, but does not include any warning that these fields may contain personal or sensitive data. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or privacy; here the reference encourages use of such fields without any disclosure or handling guidance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide instructs users to execute a remote installer script directly via curl piped to Bash. This prevents inspection of the script before execution and creates a supply-chain risk: if the hosting endpoint, CDN, DNS, or transport chain is compromised, arbitrary code would run immediately on the user's machine.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 37)May include surrounding context.
x86_64

bash
wget --connect-timeout=10 --read-timeout=120 --tries=3 -qO- https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz sudo mv aliyun /usr/local/bin/

ARM64

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 43)May include surrounding context.
x86_64

bash
wget --connect-timeout=10 --read-timeout=120 --tries=3 -qO- https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz sudo mv aliyun /usr/local/bin/

ARM64

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 90)May include surrounding context.
md
1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once ### Configuration Modes

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 383)May include surrounding context.
bash
# Restrict permissions chmod 600 ~/.aliyun/config.json

Troubleshooting

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation explicitly describes retrieving complete crash sample details that include sensitive identifiers and telemetry such as ClientIp, UserId, UserNick, device attributes, logs, and memory snapshots, yet provides no privacy, minimization, redaction, or retention guidance. In a troubleshooting skill, this omission can lead operators to collect and handle personal or sensitive diagnostic data in unsafe ways, increasing the risk of accidental exposure or policy noncompliance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The example directs users to write the full GetError response to /tmp, which commonly has broad local visibility and weak lifecycle guarantees, while the payload may contain logs, identifiers, crash reports, and memory-related data. This creates a practical risk of sensitive crash data being exposed to other local users, backup/indexing processes, or left behind after troubleshooting.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation explicitly surfaces and recommends passing plaintext device identifiers (Did) in CLI queries and follow-up API usage, but does not include a privacy or data-handling warning. Device identifiers are sensitive telemetry data that can enable device-level tracking, correlation across events, and accidental disclosure through logs, shell history, screenshots, or copied troubleshooting output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The examples write aggregated issue data and full sample details to predictable files under /tmp without warning that these outputs can contain sensitive diagnostic information, including stack traces and per-sample identifiers. On multi-user systems or in shared/containerized environments, temporary files may be accessible to other processes, retained longer than expected, or later exfiltrated via backups, support bundles, or agent tooling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation explicitly recommends using --log-level DEBUG and notes it includes the HTTP body, but it does not warn that APM requests and responses may contain sensitive diagnostic content such as stack traces, device identifiers, UUIDs, UTDIDs, app metadata, and other sample details. In an agent-assisted troubleshooting workflow, debug logs are likely to be persisted to terminals, CI logs, chat transcripts, or observability systems, creating an avoidable data exposure risk.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tool Parameter Abuse

(optional) delete the local JSON directories produced by dig_issue.sh

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Description-Behavior Mismatch

Description-Behavior Mismatch

Session Persistence

Session Persistence

Session Persistence

Description-Behavior Mismatch

Description-Behavior Mismatch

Missing User Warnings

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

Session Persistence

Sudo/Root Execution

Troubleshooting

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings