alibabacloud-idaas-ecs-m2m-federated-credential

• Outcome: Review
• Latest audit: Nov 7, 2026 · 10:19 AM UTC
• Version: 0.0.1

Overview

ClawScan rates this skill suspicious with medium confidence: scanners report credential handling and guidance that could expose credentials or affect protected cloud resources, and the review was incomplete.

Consider the suspicious verdict and incomplete scan before installing. In particular, weigh the reported credential exposure and cloud-resource selection risks; the scanners do not establish malicious intent, but they also do not establish that the skill is safe.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output

Findings (15)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The command requests access credentials for a RAM role identified by cloudAccountRoleExternalId. This is a distinct credential-acquisition capability, not a federation-configuration operation, inventory query, or PKCS#7 token exchange. Although it could be a downstream use of an authenticated M2M application, that capability is not disclosed in the declared purpose. The mismatch is the additional credential acquisition, not the use of bearer authentication or proof that long-lived AccessKeys are required.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: alibabacloud-idaas-ecs-m2m-federated-credential
description: "Configure Alibaba Cloud IDaaS EIAM federation for ECS without AccessKeys (AK): create PKCS#7 federated credential providers, create or select M2M client applications, bind application federated credentials to ECS instances or cloud accounts, authorize PAM scopes, and guide ECS signature and client_assertion token exchange with pkcs7-bearer. Use when users ask for machine identity authentication, read-only IDaaS/ECS inventory, or missing federation parameters. Triggers: ECS authentication without AK, PKCS#7 federation, federated credential providers, M2M client applications, application federated credentials, ECS-to-EIAM/IDaaS access tokens, read-only IDaaS/ECS instance queries"
---

# IDaaS ECS M2M Federation (PKCS#7, Without AK)

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 85% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · references/api-and-pitfalls.md (reported line 240)May include surrounding context.

8. End-to-End Sequence (Reference)

text

ECS ──1. IMDSv2 token + audience──▶ 100.100.100.200 ──▶ PKCS#7 signature
ECS ──2. HTTPS token exchange (pkcs7-bearer assertion)──▶ EIAM
EIAM: 3. Provider verifies the signature (official root certificate + owner-account-id + aud + signingTime validity)
      4. Verify the application federated credential (instance-id or account expression)

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 85% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · references/ram-policies.md (reported line 124)May include surrounding context.

md

M application quota; Free Edition requires extended services. Otherwise, `CreateApplication` (m2m type) or token requests fail.
2. **The M2M server (ResourceServer) referenced by scope must already exist and authorize the client**. A token request with `scope=<ResourceServerIdentifier>|<ScopeValue>` requires the ResourceServer to be registered in the same instance and the client application to be authorized for the scope (`AuthorizeResourceServerScopesToClient`; the PAM path is automated by this skill; custom resource servers must be prepared separately).
3. **ECS**: The target instance must be able to access the metadata service at `100.100.100.200` (available by default). For hardened instances (IMDSv2), the generated signature command already includes the metadata token; no additional configuration is needed.
4. **Network**: The machine running the skill must be able to reach `eiam.<region>.aliyuncs.com` (OpenAPI) and `https://<instance_DefaultEndpoint>` (the public token endpoint).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/oauth-token.openapi.yaml (reported line 18)May include surrounding context.

yaml

paths:
  /api/v2/iauths_system/oauth2/token:
    post:
      summary: Exchange an ECS PKCS7 assertion for an M2M access token
      description: >-
        Authentication is carried by the required client assertion and credential
        name in the form body. A real positive test requires an actual ECS identity

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/oauth-token.openapi.yaml (reported line 64)May include surrounding context.

yaml

description: Resource-server scope authorized for the selected client.
      responses:
        "200":
          description: JSON response containing an access token.
          content:
            application/json:
              schema:

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 85% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · scripts/gen_ecs_sign_command.py (reported line 22)May include surrounding context.

python

'(ECS_IMDS_HEADER=X-aliyun-ecs-metadata-token; '
    'ECS_IMDS_VALUE=$(curl -fsS --connect-timeout 3 --max-time 10 -X PUT '
    '-H "$ECS_IMDS_HEADER-ttl-seconds:1200" '
    '"http://100.100.100.200/latest/api/token") && '
    '[ -n "$ECS_IMDS_VALUE" ] && '
    'curl -fsS --connect-timeout 3 --max-time 10 '
    '-H "$ECS_IMDS_HEADER: $ECS_IMDS_VALUE" '

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 85% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · scripts/gen_ecs_sign_command.py (reported line 26)May include surrounding context.

python

'[ -n "$ECS_IMDS_VALUE" ] && '
    'curl -fsS --connect-timeout 3 --max-time 10 '
    '-H "$ECS_IMDS_HEADER: $ECS_IMDS_VALUE" '
    '"http://100.100.100.200/latest/dynamic/instance-identity/pkcs7'
    '?audience=%7B%22aud%22%3A%22{iid}%22%2C%22signingTime%22%3A$(date +%s)%7D")'
)

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

md

s `Forbidden.RAM`, fall back to manual instance ID input. Do not block the flow or encourage full ECS access; read-only `AliyunECSReadOnlyAccess` is sufficient for listing.
7. Provider names must match `[a-z0-9_-]{1,64}`; application and application federated credential names must be ≤64 characters.
8. Token requests keep TLS certificate verification enabled. On connection or certificate failure, stop and report the failure; fix connectivity or the certificate trust chain before retrying. Never bypass verification with `-k`. HTTP errors exit nonzero and must not be reported as successful token issuance.
9. Signatures and tokens are sensitive. Delete temporary files immediately after use. **Redaction must occur in script stdout**: test_m2m_token.py replaces access_token with its first 12 characters and total length, while printing error responses unchanged. Stdout enters the conversation transcript and telemetry as-is; agent-side presentation rules alone are insufficient. When relaying

The user is instructed to paste an authentication signature into the conversation without a sensitivity warning.

Medium

• Category: Output Handling
• Confidence: 97% confidence

Finding

The reference tells users to paste a live PKCS#7 authentication assertion into the conversation, exposing it to transcript storage and telemetry. A party obtaining the assertion may replay it during its validity window to request tokens for a matching authorized application; audience binding and expiry limit but do not eliminate that risk.

Content

No source excerpt is available for this finding.

Candidate-selection guidance overrides explicit resource protection notices.

Medium

• Category: Prompt Injection
• Confidence: 83% confidence

Finding

Candidate-selection guidance explicitly disregards 'do not touch' and similar protection notices when choosing instances for live tests. Although dedicated-account restrictions and ownership tracking reduce the risk of deleting historical resources, creating clients, trust providers, or PAM grants on a protected shared instance can still change its security posture and consume quotas.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/common.py (reported line 98)May include surrounding context.

python

if args and args[0] == "aliyun" and "--user-agent" not in args:
        args = list(args) + ["--user-agent", _USER_AGENT]
    try:
        return subprocess.run(args, capture_output=True, text=True, timeout=timeout)
    except FileNotFoundError:
        die(f"Command not found: {args[0]} (install and configure the aliyun CLI first)")
    except subprocess.TimeoutExpired:

Tainted flow: 'args' from os.environ.get (line 96, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/common.py (reported line 98)May include surrounding context.

python

if args and args[0] == "aliyun" and "--user-agent" not in args:
        args = list(args) + ["--user-agent", _USER_AGENT]
    try:
        return subprocess.run(args, capture_output=True, text=True, timeout=timeout)
    except FileNotFoundError:
        die(f"Command not found: {args[0]} (install and configure the aliyun CLI first)")
    except subprocess.TimeoutExpired:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 90% confidence

Finding

The subprocess call is not shell injection, but its curl argument list contains the complete PKCS#7 client_assertion. Where process arguments are visible to other users, same-user processes, or monitoring systems, this authentication material can be captured and potentially replayed within its validity and federation constraints; response-token redaction does not protect it.

Content

Scanner excerpt · scripts/test_m2m_token.py (reported line 119)May include surrounding context.

python

"-w", "\nHTTP_STATUS=%{http_code}",
    ]
    try:
        p = subprocess.run(args, capture_output=True, text=True, timeout=60)
    except subprocess.TimeoutExpired:
        sys.exit("ERROR: Token request timed out after 60 seconds; check connectivity before retrying")
    except OSError: