Security audit

alibabacloud-governance-evaluation-report

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a read-only Alibaba Cloud governance reporter, but it requires broad persistent Aliyun CLI plugin changes that are wider than needed.

Install only if you are comfortable with Aliyun CLI using your current cloud credentials. Prefer a dedicated read-only Governance Center profile, avoid enabling automatic plugin installation unless you explicitly want that persistent CLI behavior, and do not update unrelated plugins just to run this report.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:43
Finding: Mandatory Unpinned Plugin Updates and Automatic Plugin Installation
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:43-54, references/verification-method.md:18-28, and references/cli-installation-guide.md:544-551
Vulnerability Type: Unsafe third-party plugin installation and update policy
Risk Level: Medium

Vulnerable Code and Instructions:

markdown
> **Pre-check: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > use a package manager or the pinned, SHA256-verified packages in > [references/cli-installation-guide.md](references/cli-installation-guide.md). > Do not pipe a remotely downloaded installation script directly into a shell. > > Then [MUST] run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date. > > **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. ```bash aliyun version aliyun configure set --auto-plugin-install true python3 --version

text
The verification guide also directs the user to install a mutable plugin without version or digest pinning: ```markdown If plugin not installed: ```bash aliyun plugin install --names governance

text
The generic installation guide further recommends installing unrelated plugins: ```markdown 1. **Install plugins** for services you need: ```bash aliyun plugin install --names ecs vpc rds # List all available plugins aliyun plugin list-remote ```

Technical Analysis

The skill requires users to update all existing Aliyun CLI plugins and persistently enables automatic plugin installation. Neither operation pins plugin versions nor independently verifies plugin artifact digests. This creates a mutable supply-chain boundary: executable plugin content may change after the skill package itself has been reviewed.

The requirement to run `aliyun plugin updat ...[truncated 2137 chars]
Remediation: View remediation
Remediation Suggestions

Remove the mandatory global aliyun plugin update instruction. Do not update unrelated plugins as a prerequisite for this skill.

Do not require persistent automatic plugin installation. Keep --auto-plugin-install disabled unless the user explicitly approves the configuration change after being informed of its scope and persistence.

Install only the Governance Center plugin when it is actually absent. Remove the unrelated ECS, VPC, and RDS plugin recommendation from this skill's workflow.

Pin the Governance Center plugin to a reviewed version where the CLI supports version selection.

Publish trusted SHA-256 digests or signed provenance for the supported plugin artifact and verify it before installation. If the CLI cannot verify plugin artifacts, document that limitation and require an explicit user confirmation before installation.

Separate dependency installation from report execution. A normal report invocation should fail safely with installation guidance rather than modifying the CLI environment automatically.

Record the resolved plugin name, version, publisher, and source before use so operators can audit the executable dependency.

Recommend a dedicated least-privilege Alibaba Cloud profile containing only the Governance Center read permissions required for the requested mode.

T09 · Insecure Skill Coding Practices

Note

Location: scripts/governance_query.py:204
Finding: Metadata Cache Writes Follow Symbolic Links and Are Not Atomic
Content: View full analysis
Vulnerability Details

File Location: scripts/governance_query.py:204-217
Vulnerability Type: Insecure local cache file handling
Risk Level: Low

Vulnerable Code:

python
def load_metadata(refresh=False): """Load metadata with file cache (rarely changes).""" os.makedirs(CACHE_DIR, exist_ok=True) cache_file = os.path.join(CACHE_DIR, "metadata.json") if not refresh and os.path.exists(cache_file): age = time.time() - os.path.getmtime(cache_file) if age < METADATA_CACHE_TTL: with open(cache_file, "r", encoding="utf-8") as f: return json.load(f) data = call_api("list-evaluation-metadata") with open(cache_file, "w", encoding="utf-8") as f: json.dump(data, f, ensure_ascii=False) return data

Technical Analysis

The cache is stored at the predictable path ~/.governance_cache/metadata.json. The code creates the directory without explicitly enforcing restrictive permissions and opens the final cache pathname directly in truncating write mode.

It does not use lstat() to reject symbolic links, verify that the cache and parent directory are owned by the current user, or ensure that the target is a regular file. Python's ordinary open(..., "w") follows a symbolic link and truncates its target. Consequently, an attacker who can pre-position or replace the cache pathname may redirect the write to another file that the victim user is permitted to modify.

The direct write is also non-atomic. An interruption can leave partially written JSON, and another process can replace the pathname between validation and use. The cache contains governance metadata rather than secrets, so confidentiality impact is limited; the main concerns are local file integrity and cache availability.

Attack Path

An attacker obtains the ability to create or replace entries under the victim's ~/.governance_cache directory. Thi ...[truncated 1545 chars]
Remediation: View remediation
Remediation Suggestions

Create and validate the cache directory with mode 0700. Verify with lstat() that it is a real directory, is not a symbolic link, and is owned by the current user.

Before reading an existing cache, use lstat() and reject symbolic links, non-regular files, unexpected owners, and files with unsafe permissions.

Write metadata to a securely created temporary file inside the validated cache directory. Use tempfile.mkstemp() or NamedTemporaryFile(delete=False, dir=CACHE_DIR), set mode 0600, flush the data, and call os.fsync().

Atomically publish the completed cache with os.replace(temp_path, cache_file) after validating the destination and parent directory.

Where supported, use no-follow semantics such as os.open() with O_NOFOLLOW, together with O_CREAT, O_EXCL, and restrictive permissions.

Handle malformed or partial cache JSON by deleting or quarantining the invalid cache and retrieving fresh metadata rather than terminating unexpectedly.

Apply the same ownership, file-type, and symlink protections during refresh cleanup before deleting cache entries.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (36)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.
md
**Processing** — The script ([governance_query.py](scripts/governance_query.py)) merges data sources and caches results for 1 hour. It provides 4 query modes: `

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: This finding is a duplicate view of the same unsafe deletion instruction: rm -rf ~/.governance_cache/. In the context of an agent skill that may influence shell execution, normalizing forceful recursive deletion is risky and unnecessary when safer cache-management methods could be provided.
Content: Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.
python3 scripts/governance_query.py --refresh overview

Clear cache manually

rm -rf ~/.governance_cache/

text
## Best Practices

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: This finding is a duplicate view of the same unsafe deletion instruction: rm -rf ~/.governance_cache/. In the context of an agent skill that may influence shell execution, normalizing forceful recursive deletion is risky and unnecessary when safer cache-management methods could be provided.
Content: Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.
python3 scripts/governance_query.py --refresh overview

Clear cache manually

rm -rf ~/.governance_cache/

text
## Best Practices

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 39)May include surrounding context.
md
DOWNLOAD_URL="https://github.com/aliyun/aliyun-cli/releases/download/v${VERSION}/${ARCHIVE}" # Require HTTPS, download the pinned archive, and verify it before extraction. curl --proto '=https' --tlsv1.2 --fail --location \ --output "${ARCHIVE}" "${DOWNLOAD_URL}" printf '%s %s\n' "${EXPECTED_SHA256}" "${ARCHIVE}" | shasum -a 256 --check - tar -xzf "${ARCHIVE}"

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 81)May include surrounding context.
md
DOWNLOAD_URL="https://github.com/aliyun/aliyun-cli/releases/download/v${VERSION}/${ARCHIVE}" # Require HTTPS, download the pinned archive, and verify it before extraction. curl --proto '=https' --tlsv1.2 --fail --location \ --output "${ARCHIVE}" "${DOWNLOAD_URL}" printf '%s %s\n' "${EXPECTED_SHA256}" "${ARCHIVE}" | shasum -a 256 --check - tar -xzf "${ARCHIVE}"

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · references/report-format-pillar.md (reported line 59)May include surrounding context.
md
### Medium-Risk Items {If there are no Warning items, state "There are currently no medium-risk items."} {See "Item Count Rules" for display limits.}

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Tool Parameter Abuse

Clear cache manually

Tool Parameter Abuse

Clear cache manually

External Script Fetching

External Script Fetching

Anti-Refusal Statement