Alibabacloud Icpba Sucessdata Query

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:32 AM UTC
• Version: 0.0.1

Overview

The skill’s main query script is purpose-aligned, but its installation and setup instructions introduce broad, persistent, and unverified executable components.

Install only after reviewing the setup steps carefully. Avoid curl-to-bash, unverified latest binaries, automatic plugin installation, and command-line secrets; use a preinstalled verified Aliyun CLI, a separate least-privilege runtime identity limited to beian:QuerySuccessIcpData, and redact or limit filing data displayed in shared logs or chats.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:30

Finding

Unverified Remote Installation Script Is Piped Directly into Bash

Content

View full analysis

Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see `references/cli-installation-guide.md` for installation instructions. ``` ### Technical Analysis The installation command streams a mutable remote resource directly into Bash. The downloaded content is neither displayed for inspection nor validated using a pinned checksum or cryptographic signature before execution. Although the URL appears to be associated with Alibaba Cloud, the command creates a remote code execution channel whose effective payload can change after the Skill has been reviewed. Compromise of the hosting infrastructure, CDN, publishing pipeline, DNS/TLS trust chain, or upstream script could cause arbitrary shell commands to run with the invoking user's privileges. This behavior is not necessary for the declared ICP filing query. The Skill uses the Python Common SDK because the required CLI operation is unavailable, so immediate installation of the CLI through a remote shell script exceeds the minimum execution surface needed by the core workflow. ### Attack Path 1. An attacker compromises or gains control over the remote installation script or its delivery infrastructure. 2. The attacker modifies `setup.sh` to include arbitrary commands. 3. A user or agent follows the Skill's installation pre-check. 4. `curl` retrieves the altered content and sends it directly to Bash. 5. Bash executes the payload without integrity verification or an intervening review step. 6. The payload operates with the privileges and accessible credentials of the invoking process. ### Impact Assessment Successful exploitation permits arbitrary code execution as the current user. Depending on t ...[truncated 463 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:34

Finding

Mandatory Automatic Plugin Installation and Unpinned Plugin Updates

Content

View full analysis

[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ``` ### Technical Analysis The Skill mandates enabling automatic plugin installation and updating existing plugins without pinning versions or requiring integrity verification. This permits executable components that were not part of the audited project to be downloaded and introduced at runtime. The commands also alter persistent CLI configuration beyond the duration of the query. Enabling automatic installation means future commands may retrieve additional plugins without an explicit review or approval step. This behavior is unnecessary for the declared function. The Skill explicitly states that the required CLI command is unavailable and that the Python Common SDK is used instead. Consequently, globally enabling plugin installation and updating unrelated existing plugins exceeds the minimum dependencies and side effects needed for an ICP filing query. ### Attack Path 1. An attacker compromises a plugin package, plugin repository, maintainer account, or update-delivery infrastructure. 2. The Skill requires the user to enable automatic plugin installation and execute a plugin update. 3. The CLI downloads the altered plugin outside the reviewed Skill package. 4. The compromised plugin executes when loaded by a subsequent CLI operation. 5. The plugin gains access to the invoking user's files, environment, and CLI credential context. ### Impact Assessment A compromised plugin could execute code with the user's privileges and potentially: - Access Alibaba Cloud credentials available to the CL ...[truncated 431 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/cli-installation-guide.md:39

Finding

Unverified Mutable CLI Archives Are Installed into a Privileged PATH

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:102

Finding

Cloud Secrets Are Encouraged in Command-Line Arguments and Plaintext Configuration

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` The guide repeats literal command-line secret patterns for AK, STS, role-assumption, profile, and credential-rotation workflows at `references/cli-installation-guide.md:126-180`, `257-271`, and `369-382`. It also documents plaintext secret storage at `references/cli-installation-guide.md:139-149`. ### Technical Analysis Passing an access-key secret or STS token as a command-line argument can expose it through: - Shell history. - CI/CD command logs. - Agent transcripts. - Process accounting or telemetry. - Process listings on systems where command-line arguments are observable. - Debugging and terminal-recording tools. The guide explicitly recommends non-interactive flags for scripts, CI/CD, and agent automation, environments where command logging is common. It also documents persistent plaintext credential storage. Although the guide later recommends `chmod 600`, the initial instructions do not ensure secure permissions before secrets are written. This guidance conflicts with `SKILL.md:53-55`, which says not to ask for AK/SK values directly or use `aliyun configure set` with literal credentials in the session. ### Attack Path 1. A user follows the recommended non-interactive configuration command. 2. The access-key secret or STS token appears in the shell command line. 3. The command is captured in shell history, CI logs, process telemetry, or ...[truncated 991 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/ram-policies.md:53

Finding

Permission Setup Requires RAM Administration Beyond the Read-Only Query Scope

Content

View full analysis

``` ``` A Python policy-creation implementation is also provided at `references/ram-policies.md:69-140`, and related RAM mutation commands are repeated at `references/related-commands.md:206-225`. ### Technical Analysis The Skill's runtime operation requires only: ```json { "Effect": "Allow", "Action": ["beian:QuerySuccessIcpData"], "Resource": "*" } ``` However, the setup instructions show policy creation and user-policy attachment. Executing these operations requires RAM administrative capabilities that are substantially broader than the read-only ICP query permission. The target policy itself is narrowly scoped to the single Beian action, and `Resource: "*"` may be required because the API does not expose resource-level authorization. The problem is the administrative identity needed to create and attach that policy, particularly if the same credentials are then used by the Skill runtime. Authorization provisioning should be separated from normal Skill execution and performed by an independent administrator through a controlled process. ### Attack Path 1. A user runs the Skill or its setup steps with an identity capable of creating and attaching RAM policies. 2. The administrative credentials become available to the same environment that runs downloaded dependencies, CLI plugins, or the query code. 3. A compromised installation component or local process obtains or abuses that credential contex ...[truncated 961 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (49)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose says this skill should query Alibaba Cloud ICP filing success information and associated risk details. However, the provided code chunk only validates whether the skill is properly configured in a development/runtime environment. Its actions are limited to checking file existence, imports, metadata formatting, and credential availability. There is no API call, no ICP filing lookup logic, no handling of entity/website/app data, and no risk alert retrieval. This is a material description-to-behavior mismatch because the code's primary purpose is validation/setup checking, not filing information querying.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to install/update the CLI by piping a remotely fetched script directly into bash. This is a classic supply-chain and remote-code-execution risk: if the download source, TLS trust, CDN, or distribution path is compromised, arbitrary code will execute immediately on the user’s system.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.

**Pre-check: Aliyun CLI plugin update required**

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill reads local files via multiple referenced local documents and instructs creation/execution of a local Python script, but it declares no explicit tool scope such as allowed-tools or permissions. That omission weakens least-privilege controls and makes it harder for a host agent to constrain filesystem access or review the skill’s actual capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Several trigger phrases are broad, such as 'filing information', 'filing risk', and the Chinese equivalents, which could activate the skill for requests outside the intended Alibaba Cloud ICP context. Over-broad activation increases the chance of unintended execution of credentialed queries and disclosure of filing data when a user meant something more generic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill retrieves and prints personally and organizationally sensitive data, including responsible person names, entity names, domain lists, app data, and risk details, but it does not prominently warn users that this information will be displayed in output. In an agent setting, lack of disclosure increases the risk of unnecessary exposure of personal data in chat logs, terminals, or audit trails.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 271)May include surrounding context.

❌ INCORRECT

python

# Direct access without checking
response = client.call_api(params, request, runtime)
body = response['body']  # May raise KeyError
ba_list = body['BaSuccessDataWithRiskList']

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/error-handling.md (reported line 281)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/error-handling.md (reported line 282)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide tells users to configure long-lived access keys non-interactively and only later notes that configuration is stored in ~/.aliyun/config.json. This can lead users to write sensitive credentials to disk without an immediate warning, which is especially risky in shared workstations, CI runners, or agent-managed environments where files may persist or be exposed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Documenting elevated and cross-account credential modes such as RamRoleArn and RamRoleArnWithEcs is unnecessary for a filing-query skill and can steer operators toward over-privileged configurations. In this context, providing multiple advanced auth patterns broadens the attack surface and may lead users or automations to grant access far beyond simple read/query needs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Recommending debug logging without warning about sensitive output can expose request metadata, tokens, headers, or other credential-related details in terminal history, CI logs, or centralized logging systems. In an automation skill context, verbose logs may be retained and accessible longer than intended, increasing credential leakage risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide expands beyond the stated ICP filing query purpose by encouraging installation of broad product plugins and exploration of unrelated services such as ECS, VPC, RDS, and FC. In an agent skill, this unnecessarily enlarges the operational scope and can normalize use of additional cloud capabilities that are not needed for filing lookups, increasing the chance of misuse or excessive permissions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The helper is presented as an ICP filing query client but defaults to the companyreg.aliyuncs.com endpoint, which is inconsistent with the stated purpose and can cause requests to be sent to the wrong Alibaba Cloud service. In a credentialed environment, that mismatch can lead to unintended authenticated calls, operational confusion, or accidental exposure of query data to an unintended service endpoint.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · references/common-sdk-usage.md (reported line 382)May include surrounding context.

md

## Best Practices

1. **Use CredentialClient**: Always use automatic credential discovery instead of hardcoding
2. **Handle Errors**: Implement comprehensive error handling and retry logic
3. **Parse Responses**: Use helper functions to extract structured data
4. **Timeout Configuration**: Set appropriate timeouts for your use case

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is described as query-only, but the documentation includes executable IAM/RAM write examples that create and attach policies. This expands the operational scope from read-only data access into privilege administration, which can mislead users or downstream agents into performing unnecessary access-management changes and violates least-privilege expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document explicitly claims least-privilege and read-only behavior while also providing examples that perform IAM write operations such as creating and attaching policies. This contradiction can cause operators or autonomous systems to trust the skill as harmless and then execute privileged administrative actions, increasing the chance of over-permissioning and unauthorized identity changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented response schema and examples explicitly include personal and organizational filing fields such as responsible person names, entity names, domains, app names, and risk details, but provide no privacy, minimization, or handling guidance. In a skill whose purpose is querying filing success data, this omission can normalize unsafe downstream logging, display, or reuse of regulated personal/business data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

Check APP information if available:

python

    # Check AppList exists
    assert 'AppList' in ba_data, f"Missing AppList in record {idx}"
    apps = ba_data['AppList']

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.

Check APP information if available:

python

    # Check AppList exists
    assert 'AppList' in ba_data, f"Missing AppList in record {idx}"
    apps = ba_data['AppList']

Static analysis

No suspicious patterns detected.