alibabacloud-idaas-cloud-role-management

• Outcome: Review
• Latest audit: Oct 29, 2026 · 7:58 AM UTC
• Version: 0.0.1

Overview

This cloud-role tool needs review because its supposedly read-only reuse mode can create roles and restore permissions without separate approval.

Use credentials that cannot change permissions when checking existing roles. Before granting provisioning access, require a fix that prevents reuse from creating resources or restoring policy attachments without explicit approval of those changes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/alibaba_role_lifecycle.py

Finding

Reuse mode can perform provisioning and permission changes

Content

View full analysis

Impact

A reuse request can restore permissions to an existing federated role without approval for that permission change, including undoing an intentional policy detachment. Existing identity, trust and policy-content checks constrain the affected account, role and permissions but do not prevent this unauthorized action.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/alibaba_role_lifecycle.py (reported line 186)May include surrounding context.

python

self.cli = shutil.which('aliyun')
        if not self.cli:
            raise ValueError('Alibaba CLI missing')
        self.env = dict(os.environ)
        self.env['ALIBABA_CLOUD_USER_AGENT'] = user_agent(session)
        self.sequence = 0
        self.deadline = time.monotonic() + 600

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/role_environment.py (reported line 33)May include surrounding context.

python

'configuration_performed':False, 'eiam_commands':{}}
    if missing:
        return result
    env = dict(os.environ, ALIBABA_CLOUD_USER_AGENT=user_agent())
    def local(argv, timeout):
        remaining = deadline - time.monotonic()
        if remaining <= 0:

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/role_environment.py (reported line 101)May include surrounding context.

python

if result['status'] == 'cli_capabilities_available' or result['missing_clis']:
        return result
    cli = finder('aliyun')
    env = dict(os.environ, ALIBABA_CLOUD_USER_AGENT=user_agent())
    def command(argv, maximum):
        remaining = deadline - time.monotonic()
        if remaining <= 0:

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

SESSION --evidence-dir DIR --output-plan PLAN.json`. This read-only adapter
   verifies both identities, account/provider/system-role health, role absence,
   and the selected policy's actual document/default version. It outputs an
   unsealed plan and establishes no approval. It currently supports only absent
   Alibaba roles reusing one explicitly selected existing Custom policy; stop
   on a collision rather than treating it as absence. Seal the resulting plan
   with `role_tools.py seal`, show it and wait before using the apply executor.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/alibaba_role_lifecycle.py (reported line 253)May include surrounding context.

python

argv = auxiliary_command(self.cli, action, params or {}, profile)
        started = time.monotonic()
        try:
            response = subprocess.run(argv, stdin=subprocess.DEVNULL, capture_output=True,
                text=True, encoding='utf-8', errors='replace', shell=False,
                timeout=min(45, remaining), env=self.env)
        except subprocess.TimeoutExpired:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/alibaba_role_lifecycle.py (reported line 498)May include surrounding context.

python

'check', '--input', self.original_plan_file,
                    '--approved-sha256', checked['sha256']]
            try:
                result = subprocess.run(argv, stdin=subprocess.DEVNULL, capture_output=True,
                    text=True, encoding='utf-8', errors='replace', shell=False, timeout=15)
            except subprocess.TimeoutExpired:
                raise OperationError('PlanCheck', 'LocalPlanCheckTimeout') from None

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/role_discovery.py (reported line 65)May include surrounding context.

python

raise ValueError('Request account differs from diagnostic target')
    argv = [sys.executable, str(Path(__file__).with_name('role_tools.py')),
            'validate', '--input', str(Path(path).resolve())]
    completed = subprocess.run(argv, stdin=subprocess.DEVNULL, capture_output=True,
                               text=True, shell=False, timeout=15)
    print(json.dumps({'command': shlex.join(argv), 'exit_code': completed.returncode,
                      'stdout': completed.stdout, 'stderr': completed.stderr}), flush=True)

Static analysis

No suspicious patterns detected.