ClawHub
Back to skill

Security audit

Alibabacloud History Lock Diagnose

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Alibaba Cloud database lock diagnostic skill, but it uses risky installation/update steps and broad credential guidance that users should review before installing.

Install only in a controlled environment with a dedicated least-privilege Alibaba Cloud RAM identity, avoid root/admin credentials, avoid curl-to-bash and unpinned plugin updates, and expect diagnostic output to include sensitive SQL text and session information from related database workloads.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:26
Finding

Unverified Remote Installer Is Piped Directly into Bash

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/smart-lock-diagnosis.py:3150
Finding

Aliyun CLI Plugins Are Automatically Installed and Updated Without Version Pinning

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
references/cli-installation-guide.md:102
Finding

Documentation Encourages Supplying Cloud Secrets Through Command-Line Arguments and Environment Variables

Content
View full analysis
\ --access-key-secret \ --region cn-hangzhou ``` It also gives examples placing credentials directly in environment variables: ```bash export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret export ALIBABA_CLOUD_REGION_ID=cn-hangzhou ``` For STS authentication, the guide additionally exports the security token: ```bash export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token export ALIBABA_CLOUD_REGION_ID=cn-hangzhou ``` ### Technical Analysis Passing an access-key secret through command-line arguments can expose it through: - Shell history. - Process inspection tools while the command is executing. - Terminal recording and audit systems. - CI/CD command logs. - Agent or automation transcripts. Exporting long-lived credentials into a general shell environment causes every subsequently launched child process to inherit them unless the environment is explicitly sanitized. Crash reporters, diagnostic tools, process-inspection interfaces, or compromised child programs may consequently access the credentials. This guidance conflicts with the main Skill's rules not to ask for, echo, or print access keys. Although the Python diagnosis script does not directly read access-key environment variables or credential files, the insta ...[truncated 1883 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (24)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The skill instructs users to execute a remote installer via curl ... | bash, which runs unverified code directly from the network in a shell. This is dangerous because any compromise of the hosting endpoint, transport chain, or script contents can lead to immediate arbitrary code execution on the machine running the skill.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.

**Pre-check: Aliyun CLI plugin update required**

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
> **Do NOT read `scripts/smart-lock-diagnosis.py` — it is 3700+ lines and reading it will waste context and slow down execution.**

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
> **Do NOT read `scripts/smart-lock-diagnosis.py` — it is 3700+ lines and reading it will waste context and slow down execution.**

Context Leakage

High
Category
Data Exfiltration
Confidence
93% confidence
Finding

This code intentionally broadens collection to all related thread IDs found in table activity and then queries transaction-control statements for those threads, which can expose SQL text, transaction state, and session behavior belonging to other workloads. In a diagnostic skill, that creates significant context leakage because the output later prints detailed timelines and SQL from threads other than the user-specified blocked thread.

Content

Scanner excerpt · scripts/smart-lock-diagnosis.py (reported line 1801)May include surrounding context.

python
all_logs = table_all_sqls
                    batch_results['WHERE precise matching'] = table_all_sqls

                    # Re-collect thread transaction control
                    related_thread_ids = set(str(log.get('ThreadID')) for log in table_all_sqls)
                    related_thread_ids.add(str(thread_id))

Context Leakage

High
Category
Data Exfiltration
Confidence
93% confidence
Finding

Here the skill collects thread IDs from all matching table DML and then fetches transaction-control logs for those threads, enabling broad visibility into other sessions' SQL and transaction metadata. Because the script later renders these results in human-readable timelines, the skill can leak sensitive operational context across tenants, applications, or users sharing the database instance.

Content

Scanner excerpt · scripts/smart-lock-diagnosis.py (reported line 2696)May include surrounding context.

python
all_logs = table_all_sqls
                    batch_results['full_table_DML'] = table_all_sqls
                    
                    # Collect thread transaction control
                    related_thread_ids = set(str(log.get('ThreadID')) for log in table_all_sqls)
                    related_thread_ids.add(str(thread_id))

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill invokes shell commands, accesses environment-dependent credentials, and reaches cloud/network APIs, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where an agent may execute more capabilities than a reviewer or policy engine can safely constrain, increasing the chance of unintended command execution or data exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This file is a full Alibaba Cloud CLI installation and account configuration guide, which materially exceeds a skill whose stated purpose is historical MySQL lock-wait diagnosis. By teaching broad CLI setup and credential onboarding, it expands the skill from narrowly scoped diagnostics into general cloud account access enablement, increasing the chance an agent or user is induced to provision unnecessary privileges.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide recommends non-interactive commands that place access keys directly on the command line and store them in the local CLI configuration without a prominent warning. This is dangerous because credentials may be exposed via shell history, process inspection, logs, or persisted plaintext-like config handling, especially in CI/CD or agent-driven environments.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

The guide explicitly directs users to create and save an AccessKey pair, reinforcing use of persistent credentials for a skill that should ideally rely on least-privilege, short-lived access. In an agent skill context, encouraging durable credential creation increases the risk of long-term secret reuse, leakage, and unnecessary account exposure.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md
1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

These sections document multiple authentication modes and credential mechanisms that can grant broad Alibaba Cloud account access, including long-lived access keys, assumed roles, and cross-account role usage. For a lock-wait analysis skill, this is more dangerous because it normalizes acquiring powerful credentials that are not inherently required for read-only diagnostic workflows.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash
# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The plugin installation and multi-service exploration content introduces unrelated capabilities such as ECS, VPC, and Function Compute usage, which are outside database lock troubleshooting. In the context of an agent skill, this broadens reachable functionality and may encourage unnecessary command execution against additional services.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The sample Python logic is incomplete relative to the surrounding specification and can misclassify whether a transaction is still active. In a lock-diagnosis skill, that can produce incorrect attribution of the blocking session or miss implicit commit/rollback cases, leading operators to diagnose the wrong root cause and potentially take disruptive actions against healthy sessions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The class initializer and CLI arguments present the skill as region-configurable, storing region and constructing a region-specific endpoint. However, the actual DAS CLI invocation hard-codes das.cn-shanghai.aliyuncs.com, so the runtime behavior does not match the documented/configured regional behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill auto-installs aliyun-cli-das plugins on the host as part of normal execution, despite the stated function being historical lock diagnosis. This is dangerous because it gives a read-oriented diagnostic workflow the ability to mutate the host environment and fetch/install third-party code, increasing supply-chain exposure and violating least privilege.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/smart-lock-diagnosis.py (reported line 3157)May include surrounding context.

python
for product in required:
            plugin_name = f'aliyun-cli-{product}'
            try:
                check = subprocess.run(
                    ['aliyun', 'plugin', 'list'],
                    capture_output=True, text=True, timeout=30
                )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

This subprocess call installs an Alibaba Cloud CLI plugin on the host at runtime, which changes the execution environment and pulls code from an external source during normal skill execution. For a diagnostic skill, modifying the host by installing software is an unnecessary expansion of trust and creates supply-chain and persistence risk if the plugin source, transport, or host environment is compromised.

Content

Scanner excerpt · scripts/smart-lock-diagnosis.py (reported line 3163)May include surrounding context.

python
)
                if plugin_name in (check.stdout or ''):
                    continue
                install = subprocess.run(
                    ['aliyun', 'plugin', 'install', '--name', plugin_name],
                    capture_output=True, text=True, timeout=60
                )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/smart-lock-diagnosis.py (reported line 3203)May include surrounding context.

python
max_attempts = 3
        for attempt in range(max_attempts):
            try:
                result = subprocess.run(
                    cmd,
                    capture_output=True,
                    text=True,

Tainted flow: 'cmd' from os.environ.get (line 3190, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/smart-lock-diagnosis.py (reported line 3203)May include surrounding context.

python
max_attempts = 3
        for attempt in range(max_attempts):
            try:
                result = subprocess.run(
                    cmd,
                    capture_output=True,
                    text=True,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The config example sets "language": "en", which imposes a specific language in a natural-language sample without indicating that other language choices are available. Under the locale policy, forcing a language without opt-in can be a policy concern unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.