Alibabacloud Kafka Capacity Assessment

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:46 AM UTC
• Version: 0.0.1

Overview

The skill's Kafka read-only assessment workflow is mostly coherent, but its setup instructions require unsafe local CLI installation and plugin updates that can change the user's environment and expose cloud credentials.

Review before installing. Use this only in an isolated or already prepared Aliyun CLI environment, avoid curl-to-bash and unverified latest binaries, do not enable automatic plugin installation or update unrelated plugins unless you explicitly accept that change, and configure least-privilege temporary credentials outside the agent session without pasting secrets into commands or chat.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:18

Finding

Unpinned Remote Installation Script Is Executed Directly by a Shell

Content

View full analysis

= 3.3.3 required > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see `references/cli-installation-guide.md` for installation instructions. ``` ### Technical Analysis The command pipes a mutable response from an external URL directly into `bash`. The retrieved script is not pinned to a reviewed version and is not validated using a cryptographic checksum or publisher signature. It is also not saved for inspection before execution. HTTPS protects data in transit under normal circumstances, but it does not protect against compromise of the upstream publishing system, CDN, domain, signing infrastructure, or authorized publisher account. The effective code executed by the Skill can therefore change after the Skill package has been reviewed. This behavior is not required for the declared Kafka capacity-assessment functionality. The assessment itself only needs an already installed CLI capable of making two read-only API calls. ### Attack Path 1. An attacker compromises the installation-script publishing account, CDN origin, DNS path, or upstream release process. 2. The attacker replaces `setup.sh` with a malicious or backdoored script. 3. The Skill determines that Aliyun CLI is absent or outdated. 4. The installation command downloads the attacker's current payload. 5. `bash` executes the payload immediately with all privileges available to the Agent or user. 6. The payload can inspect local files and environment variables, steal cloud credentials, replace executables, alter shell configuration, or establish additional persistence. ### Impact Assessment The remote script receives arbitrary code execution under the a ...[truncated 543 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:24

Finding

Mandatory Automatic Plugin Installation and Unconditional Plugin Updates

Content

View full analysis

[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ``` The same commands are listed as required auxiliary commands in `references/related-commands.md:48-51`. ### Technical Analysis The Skill persistently enables automatic plugin installation and mandates updating all existing plugins. It does not pin plugin versions, validate plugin checksums or signatures, restrict updates to the `alikafka` and `cms` functionality needed by the Skill, or request approval before changing the local CLI environment. Updating every installed plugin unnecessarily affects components unrelated to Kafka capacity assessment. Automatic plugin installation also means that a later command can retrieve and execute code that was not present during this audit. These operations contradict the Skill's repeated claim that it performs only read-only operations. Although the cloud APIs in the core workflow are read-only, plugin configuration and updates modify the local system and its future execution behavior. ### Attack Path 1. An attacker compromises a plugin package, plugin repository, release account, or update-distribution channel. 2. A malicious release is published for a required or already installed plugin. 3. The Skill enables automatic plugin installation and invokes the blanket update command. 4. The compromised plugin is downloaded without a Skill-defined integrity check or reviewed version pin. 5. A subsequent authenticated `aliyun` command loads or executes the plugin. 6. The plugin reads credentials available to the CLI, changes request parameters, sends additional API requests, or exfiltra ...[truncated 734 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:39

Finding

Mutable Latest CLI Archive Is Installed into a Privileged System PATH Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:103

Finding

Credential Guide Recommends Passing Cloud Secrets Through Command-Line Arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` Additional examples pass access keys and STS tokens through command-line flags at `references/cli-installation-guide.md:129-181`, `260-270`, `369-382`, and `444-452`. ### Technical Analysis Command-line secrets can be exposed through shell history, process listings, CI/CD command logs, terminal recording, Agent transcripts, debugging output, and operating-system audit telemetry. Recommending this approach for scripts and Agent-driven automation increases the chance that literal credentials will be retained in logs or conversation context. The guidance conflicts with the stronger rules in `SKILL.md:35-38`, which prohibit asking users for AK/SK values and prohibit configuring literal credential values. Referencing the installation guide from the main Skill creates an unsafe alternate path despite those protections. The examples use placeholders rather than confirmed live credentials, so the repository itself does not contain a demonstrated secret. The vulnerability is the recommended handling method that would expose real credentials when followed. ### Attack Path 1. A user follows the linked quick-start or automation guidance. 2. The user replaces the placeholders with a real access key, secret, or STS token. 3. The command is stored in shell history, CI logs, an Agent transcript, process telemetry, or local audit records ...[truncated 962 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (16)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs the operator to fetch and immediately execute a remote shell script via curl ... | bash, which bypasses integrity verification, review, and change control. If the hosting endpoint, network path, or script content is compromised, arbitrary code would execute on the user's machine with the user's privileges before any Kafka assessment occurs.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

## Pre-check: Aliyun CLI >= 3.3.3 required

> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.

**Pre-check: Aliyun CLI plugin update required**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This reference file is a full Alibaba Cloud CLI installation and credentialing guide, which materially exceeds the declared purpose of a Kafka capacity-assessment skill. In an agent context, bundling broad cloud-administration setup increases the chance the skill collects powerful credentials or enables actions far beyond read-only Kafka diagnostics, expanding misuse and blast radius.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide shows users passing access-key ID and secret directly on the command line, which can expose secrets via shell history, process listings, terminal logging, and CI job logs. In an agent-assisted workflow, this is especially risky because commands may be echoed, stored, or replayed by automation systems.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation explicitly shows plaintext access key material stored in the CLI config file without an immediate warning that the file contains sensitive secrets. Users may copy this pattern into insecure environments, back up the file, or expose it via support bundles or repository mistakes, leading to credential compromise.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

These sections teach multiple authentication modes, including role assumption and elevated cross-account access, which enable broad cloud administration unrelated to assessing Kafka throttling. In a skill whose stated function is diagnostic capacity assessment, this unnecessary privilege-enablement makes accidental overreach or abuse more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The examples export long-lived credentials into environment variables without warning that these may leak into child processes, debugging output, crash dumps, build logs, or shared CI environments. This creates a common and realistic path to credential disclosure, especially in automated agent contexts.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The plugin-installation and cross-product exploration guidance extends the skill from Kafka assessment into a generic Alibaba Cloud CLI enablement guide. While not directly exploitable on its own, it broadens operator behavior and available tooling in ways unrelated to the skill’s purpose, increasing opportunity for misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown section states that retention periods may be ignored, messages may be purged, and new writes may be suspended once disk utilization crosses certain thresholds. Because these behaviors can affect user data and service availability, the skill description should explicitly warn users about the potential for data loss and write interruption during capacity checks or remediation guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The source references point exclusively to /zh/ Alibaba Cloud documentation pages, which implies a Chinese-language-only knowledge source. This can constitute a locale policy issue because the file does not state that Chinese is required, offer an alternative language, or explain why this locale restriction is necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file documents aliyun configure list, which exposes the current credential configuration status, but it does not include any warning that the command may reveal sensitive account or environment information on screen. Under the markdown-file criteria for missing user warnings, credential- or privacy-relevant behavior should be disclosed to the user.

Content

No source excerpt is available for this finding.