T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:31- Finding
Mutable Remote Installer Is Executed Directly Through Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
Alibabacloud Emas Apm Remotelog
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Alibaba Cloud remote-log helper, but its setup guidance can run unverified remote code, make broad persistent CLI plugin changes, and expose cloud credentials if followed literally.
Review before installing. Prefer a package-manager or pinned, checksum-verified Alibaba Cloud CLI installation; do not pipe remote scripts to bash; avoid global plugin updates and persistent auto-plugin-install unless you accept that broader CLI change; use least-privilege RAM permissions; do not paste AccessKeys or STS tokens into commands, chats, scripts, or CI logs; and only retrieve device logs with clear authorization and minimal time windows.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
references/cli-installation-guide.md:74- Finding
Unverified Mutable Binaries Are Installed into a Privileged Executable Path
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:40- Finding
Automatic Plugin Installation and Global Updates Introduce Unpinned Executable Dependencies
- Content
View full analysis
= 0.3.1 ``` ### Technical Analysis The Skill persistently enables automatic plugin installation, updates all installed plugins, and installs the EMAS plugin without pinning an exact reviewed version or requiring integrity verification. Checking only that the installed version is at least `0.3.1` is not an integrity control. Any later release, including an unexpectedly changed or compromised release, satisfies that condition. Updating every plugin also changes unrelated executable components and exceeds the Skill's requirement to use only the EMAS APM plugin. Because plugins run within the authenticated CLI context, a compromised plugin can interact with the local credential provider and alter cloud requests or responses. Persistently enabling automatic installation also changes future CLI behavior beyond the current Skill run. ### Attack Path 1. An attacker compromises a plugin publication account, repository, distribution system, or release pipeline. 2. A malicious plugin version is published under an expected name or delivered through the configured plugin source. 3. The Skill enables automatic plugin installation or invokes a global plugin update. 4. The CLI downloads and installs the compromised component without an exact version or independent integrity check. 5. A subsequent EMAS or other plugin command loads the malicious component. 6. The component executes under the user's account and authenticated CLI context. ### Impact Assessment A compromised plugin could access data avai ...[truncated 465 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/cli-installation-guide.md:146- Finding
Credential Guide Recommends Supplying Access Secrets Through Command-Line Arguments
- Content
View full analysis
\ --access-key-secret \ --region cn-hangzhou ``` The guide then states: ```text All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` Similar examples pass Access Key secrets and STS tokens directly through command-line flags. ### Technical Analysis Supplying credentials as command-line arguments can expose them through: - Shell history files - CI/CD command logs - Agent conversation or execution transcripts - Terminal recordings - Process-list inspection on platforms where arguments are visible - Debug output and error reports - Copied scripts and operational documentation Recommending this approach for scripts, CI/CD, and Agent automation increases the likelihood that users will substitute real secrets into recorded commands. This guidance also conflicts with `SKILL.md:74-89`, which explicitly states that the Agent must never request literal Access Key values or use `aliyun configure set` with literal credentials. The masked examples are not real secrets, but the documented usage pattern is unsafe when followed with actual credentials. ### Attack Path 1. A user follows the documented command and substitutes a real Access Key secret or STS token. 2. The complete command is stored in shell history, CI logs, an Agent transcript, a script, or process metadata. 3. Another local user, log reader, support oper ...[truncated 947 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (37)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The skill includes a one-liner that downloads a remote script and pipes it directly into
bash, which prevents inspection before execution and creates a supply-chain/code-execution risk. Even though the text warns about safer alternatives, presenting the dangerous pattern as a standard installation path can lead users or agents to execute arbitrary code from a remote host if the CDN, TLS path, or served content is compromised.- Content
bash aliyun version # If not installed or version too low (script served by Alibaba Cloud official CDN over HTTPS): curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash aliyun version
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The
| bashconstruct chains network retrieval directly into command execution, collapsing trust decisions into a single step and making it easy to execute unreviewed remote content. In an agent-skill context, this is particularly dangerous because automation may reproduce the command non-interactively, increasing the chance of silent compromise of the local environment.- Content
bash aliyun version # If not installed or version too low (script served by Alibaba Cloud official CDN over HTTPS): curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash aliyun version
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
This duplicate finding points to the same remote-script-to-shell pattern, which remains hazardous despite being discussed as a risk. The presence of such a pattern in the installation ecosystem materially raises supply-chain and arbitrary code execution concerns for users of the skill.
- Content
md | Risk | Where it shows up | Mitigation | |---|---|---| | **Remote script piped to shell** (`curl … \| bash`) | SKILL.md Installation section | Use the [Safer installation flow](#safer-installation-flow) below — download, inspect, then execute. | | **Privilege elevation via `sudo mv … /usr/local/bin/`** | macOS / Debian / Ubuntu / CentOS / RHEL / ARM64 binary install | Only run `sudo` after verifying the downloaded archive's source (HTTPS host = `aliyuncli.alicdn.com`) and contents (`file aliyun` to confirm it's an ELF/Mach-O executable, not a shell script). Prefer per-user installs (`~/.local/bin`, no `sudo`) where possible. | | **System-wide PATH modification** (`SetEnvironmentVariable(..., Machine)` on Windows) | Windows PowerShell flow | Requires Administrator. Only do this for binaries you've verified you trust. Prefer the user-scope target (`User`) when a per-user install is acceptable. | | **Tampered binary** (compromised CDN, MITM bypassing TLS, malicious mirror) | All download flows | Pin checksums when Aliyun publishes them; otherwise verify the host (`aliyuncli.alicdn.com`) and rely on HTTPS. Don't pull binaries from third-party mirrors. |
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
This duplicate finding points to the same remote-script-to-shell pattern, which remains hazardous despite being discussed as a risk. The presence of such a pattern in the installation ecosystem materially raises supply-chain and arbitrary code execution concerns for users of the skill.
- Content
md | Risk | Where it shows up | Mitigation | |---|---|---| | **Remote script piped to shell** (`curl ... \| bash`) | SKILL.md Installation section | Use the [Safer installation flow](#safer-installation-flow) below — download, inspect, then execute. | | **Privilege elevation via `sudo mv ... /usr/local/bin/`** | macOS / Debian / Ubuntu / CentOS / RHEL / ARM64 binary install | Only run `sudo` after verifying the downloaded archive's source (HTTPS host = `aliyuncli.alicdn.com`) and contents (`file aliyun` to confirm it's an ELF/Mach-O executable, not a shell script). Prefer per-user installs (`~/.local/bin`, no `sudo`) where possible. | | **System-wide PATH modification** (`SetEnvironmentVariable(..., Machine)` on Windows) | Windows PowerShell flow | Requires Administrator. Only do this for binaries you've verified you trust. Prefer the user-scope target (`User`) when a per-user install is acceptable. | | **Tampered binary** (compromised CDN, MITM bypassing TLS, malicious mirror) | All download flows | Pin checksums when Aliyun publishes them; otherwise verify the host (`aliyuncli.alicdn.com`) and rely on HTTPS. Don't pull binaries from third-party mirrors. |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
aliyun version
5. Clean up
rm /tmp/aliyun-setup.sh
text The same principle applies to the binary archives below: `wget` first, run `file aliyun` and (when checksums are available) `sha256sum -c`, then move into `/usr/local/bin/` with `sudo`.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list includes broad phrases such as "remote log", "tlog", and "log retrieval", which can cause the skill to activate in contexts where the user did not clearly intend to perform sensitive log-access operations. Because this skill retrieves end-user device logs, unintended invocation increases the chance of privacy-invasive actions or accidental exposure of user data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The scenario description explains how to retrieve and query end-user device logs but does not prominently warn that these logs may contain sensitive personal data, secrets, or regulated information. In a log-collection skill, that omission is risky because it normalizes privacy-sensitive operations without requiring explicit user acknowledgement or minimizing collected data.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md > > **[MUST] RegionId is fixed** — EMAS APM service is ONLY available in `cn-shanghai`. > Always pass `--region cn-shanghai` regardless of the credential's default region > (e.g., even if `aliyun configure list` shows `cn-hangzhou`). Do NOT ask the user > to confirm RegionId, and do NOT try other regions on failure. | Parameter | Required | Description | Example |
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This reference file substantially broadens the skill from EMAS APM remote-log operations into general Alibaba Cloud CLI installation, authentication, and multi-service usage. In an agent setting, this scope expansion increases the chance the skill is used to configure broad cloud access or invoke unrelated services, which violates least-privilege expectations and enlarges the attack surface.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | Risk | Where it shows up | Mitigation | |---|---|---| | **Remote script piped to shell** (`curl … \| bash`) | SKILL.md Installation section | Use the [Safer installation flow](#safer-installation-flow) below — download, inspect, then execute. | | **Privilege elevation via `sudo mv … /usr/local/bin/`** | macOS / Debian / Ubuntu / CentOS / RHEL / ARM64 binary install | Only run `sudo` after verifying the downloaded archive's source (HTTPS host = `aliyuncli.alicdn.com`) and contents (`file aliyun` to confirm it's an ELF/Mach-O executable, not a shell script). Prefer per-user installs (`~/.local/bin`, no `sudo`) where possible. | | **System-wide PATH modification** (`SetEnvironmentVariable(..., Machine)` on Windows) | Windows PowerShell flow | Requires Administrator. Only do this for binaries you've verified you trust. Prefer the user-scope target (`User`) when a per-user install is acceptable. | | **Tampered binary** (compromised CDN, MITM bypassing TLS, malicious mirror) | All download flows | Pin checksums when Aliyun publishes them; otherwise verify the host (`aliyuncli.alicdn.com`) and rely on HTTPS. Don't pull binaries from third-party mirrors. |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
This install flow tells users to move a downloaded binary into a system path with sudo, which grants a network-fetched artifact privileged trust on the host. Although common in documentation, it is risky because any compromised or spoofed binary becomes executable system-wide with admin involvement.
- Content
md tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
The Debian/Ubuntu example uses sudo to place a downloaded binary into /usr/local/bin, creating a privileged installation path for externally sourced code. In enterprise or agent-managed systems, this can turn a supply-chain issue into host-wide execution impact.
- Content
md # Extract and install tar -xzf aliyun-cli-linux-latest-amd64.tgz sudo mv aliyun /usr/local/bin/ # Verify aliyun version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
The CentOS/RHEL example repeats a privileged move of a downloaded binary into a system PATH directory. This is dangerous if the archive is tampered with or if operators follow the instructions without adequate verification.
- Content
md # Extract and install tar -xzf aliyun-cli-linux-latest-amd64.tgz sudo mv aliyun /usr/local/bin/ # Verify aliyun version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
The ARM64 example also instructs a sudo-based system-wide install of a downloaded binary. This expands the blast radius of any compromised artifact and is more sensitive in automated environments where elevation may be preapproved.
- Content
Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/
text ### Windows
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The examples pass access keys and secrets directly on the command line, which can expose credentials via shell history, process listings, terminal logging, and audit tools. In agent-driven or shared environments, this creates a realistic path to credential theft and subsequent cloud-account compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document recommends non-interactive credential flags for automation without warning that these values may be captured by CI logs, workflow traces, build metadata, and process telemetry. In automated agent contexts, this materially increases the chance of long-lived secret leakage at scale.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 74% confidence
- Finding
The guide encourages creating and saving persistent AccessKey credentials, which promotes long-lived secret material in a skill that could instead emphasize temporary credentials or instance roles. Persistent keys increase exposure windows and are especially risky in automation and agent contexts where secrets may be reused broadly.
- Content
md 1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once ### Configuration Modes
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Restrict permissions chmod 600 ~/.aliyun/config.jsonTroubleshooting
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide explicitly encourages installation of arbitrary Alibaba Cloud product plugins unrelated to this skill's stated purpose. That enables capability expansion beyond remote log retrieval and can let an agent or operator pivot into managing other cloud resources from the same CLI environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document grants and normalizes permissions for remote log retrieval and log search, which can expose sensitive application and user data contained in mobile logs, but it does not warn about the sensitivity of those logs or recommend restricting access. In a skill specifically designed to collect and query remote logs, omission of privacy and access-control guidance increases the chance of overbroad access and misuse by operators.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document provides step-by-step commands for enumerating devices, creating remote log collection tasks, and searching device logs without any warning that these operations can access sensitive user and device data. In the context of an agent skill, this increases the risk of unauthorized or privacy-impacting use because operators may treat the workflow as routine administration rather than access to potentially regulated telemetry and personal data.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | API | Documentation | |-----|---------------| | GetTlogDeviceList | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/GetTlogDeviceList | | GetTlogDeviceInfo | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/GetTlogDeviceInfo | | CreateTlogTask | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/CreateTlogTask | | GetTlogTaskInfo | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/GetTlogTaskInfo |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | API | Documentation | |-----|---------------| | GetTlogDeviceList | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/GetTlogDeviceList | | GetTlogDeviceInfo | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/GetTlogDeviceInfo | | CreateTlogTask | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/CreateTlogTask | | GetTlogTaskInfo | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/GetTlogTaskInfo |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | API | Documentation | |-----|---------------| | GetTlogDeviceList | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/GetTlogDeviceList | | GetTlogDeviceInfo | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/GetTlogDeviceInfo | | CreateTlogTask | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/CreateTlogTask | | GetTlogTaskInfo | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/GetTlogTaskInfo |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | API | Documentation | |-----|---------------| | GetTlogDeviceList | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/GetTlogDeviceList | | GetTlogDeviceInfo | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/GetTlogDeviceInfo | | CreateTlogTask | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/CreateTlogTask | | GetTlogTaskInfo | https://api.aliyun.com/api/emas-appmonitor/2019-06-11/GetTlogTaskInfo |
Static analysis
No suspicious patterns detected.