Alibabacloud Kms Secret Manage

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:32 AM UTC
• Version: 0.0.2

Overview

This documentation-only skill manages real Alibaba Cloud secrets, but its examples can expose, overwrite, or irreversibly delete sensitive credentials with broad cloud permissions.

Install only if you are comfortable with an agent guiding live Alibaba Cloud KMS administration. Use a tightly scoped RAM identity, avoid wildcard policies, do not paste real secret values into shell commands or chat, avoid printing SecretData into logs or transcripts, prefer non-production testing first, and require explicit confirmation before any write, rotation, policy, or deletion operation, especially force delete.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:109

Finding

Secrets Exposed Through Command-Line Arguments

Content

View full analysis

" --SecretData "" --VersionId "" --EncryptionKeyId "" --DKMSInstanceId "" --region --user-agent AlibabaCloud-Agent-Skills ``` ```bash aliyun kms PutSecretValue --SecretName "" --SecretData "" --VersionId "" --region --user-agent AlibabaCloud-Agent-Skills ``` ```bash aliyun kms CreateSecret \ --SecretName "" \ --SecretType Rds \ --SecretData '{"Accounts":[{"AccountName":"","AccountPassword":""}]}' \ --VersionId "v1" \ --ExtendedConfig '{"SecretSubType":"SingleUser","DBInstanceId":""}' \ --EnableAutomaticRotation true \ --RotationInterval 7d \ --region \ --user-agent AlibabaCloud-Agent-Skills ``` ```bash aliyun kms CreateSecret \ --SecretName "" \ --SecretType RAMCredentials \ --SecretData '{"AccessKeys":[{"AccessKeyId":"","AccessKeySecret":""}]}' \ --VersionId "v1" \ --ExtendedConfig '{"SecretSubType":"RamUserAccessKey","UserName":""}' \ --EnableAutomaticRotation true \ --RotationInterval 30d \ --region \ --user-agent AlibabaCloud-Agent-Skills ``` ```bash aliyun kms CreateSecret \ --SecretName "" \ --SecretType ECS \ --SecretData '{"UserName":"root","Password":""}' \ --VersionId "v1" \ --ExtendedConfig '{"SecretSubType":"Password","RegionId":"","InstanceId":""}' \ --EnableAutomaticRotation true \ --RotationInterval 30d \ --region \ ...[truncated 1675 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:159

Finding

Secret Retrieval Workflows Print Plaintext Secret Values

Content

View full analysis

\ --region \ --user-agent AlibabaCloud-Agent-Skills ``` ```json { "SecretName": "my-secret", "SecretData": "my-secret-value", "VersionId": "v1", "VersionStages": { "VersionStage": ["ACSCurrent"] }, "SecretDataType": "text", "RequestId": "xxx" } ``` ```bash echo "=== 3. Get Secret Value ===" aliyun kms GetSecretValue \ --SecretName "$SECRET_NAME" \ --region "$REGION" \ --user-agent AlibabaCloud-Agent-Skills ``` ### Technical Analysis The Python example prints the complete API response, including the `SecretData` field. The verification command and complete verification script likewise allow the Aliyun CLI response to be written directly to standard output. Although `SKILL.md` states that secret values should be masked by default, the example implements no masking or selective field extraction. User confirmation before retrieval does not prevent the resulting plaintext from being retained in terminal scrollback, CI logs, agent transcripts, observability systems, or screen recordings. ### Attack Path 1. A user requests or confirms retrieval of a secret. 2. The Skill executes the SDK example or documented CLI command. 3. Alibaba Cloud KMS returns the plaintext `SecretData` field to the authenticated client. 4. The example prints the entire response to standard output. 5. A terminal recorder, agent log, CI system, or unauthorized viewer ca ...[truncated 567 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/cli-installation-guide.md:39

Finding

Aliyun CLI Binaries Installed from Mutable URLs Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/ram-policies.md:41

Finding

Recommended Wildcard Policies Grant Account-Wide Secret and Credential Administration

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 275)May include surrounding context.

bash

aliyun kms CreateSecret \
  --SecretName "my-secret" \
  --SecretData "$(cat secret.txt)" \
  --VersionId "v1" \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger list is broad enough to activate on common phrases like 'create secret' or 'get secret value' without sufficient scoping to Alibaba Cloud KMS contexts. In a secret-management skill, overbroad activation increases the chance the agent routes unrelated sensitive requests here, which could lead to unsafe secret-handling guidance or accidental execution paths for destructive operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The update workflow provides a direct write command for PutSecretValue with no explicit confirmation gate, impact warning, or verification step. Because this skill manages high-value secrets, an ambiguous or mistaken request could overwrite production credentials, cause outages, or rotate applications onto incorrect secret material without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document includes a force-delete example for secrets without any nearby warning that the operation is irreversible and can permanently remove recovery options. In a secret-management skill, normalizing destructive commands without explicit caution increases the chance of accidental data loss by users or downstream agents following the acceptance criteria literally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This reference file is materially broader than the stated KMS secret-management scope: it teaches general Aliyun CLI installation, authentication, profile management, ECS commands, plugin installation, and account administration. In an agent skill, that scope expansion increases the chance the agent can be steered into unrelated cloud operations and widens the blast radius if credentials provided for KMS are reused for other services.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide shows secrets being passed directly on the command line and stored in configuration files or environment variables without prominently warning about shell history, process-list exposure, CI log leakage, and persistence in ~/.aliyun/config.json. Because this skill manages secrets, normalizing unsafe credential-handling patterns materially increases the risk of credential disclosure and compromise of the cloud account.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation explicitly enables non-KMS service use by instructing users to install arbitrary product plugins and explore unrelated commands such as ECS and Function Compute. For a KMS secret-management skill, this creates unnecessary operational capability and makes prompt or workflow abuse more dangerous because the surrounding guidance normalizes out-of-scope actions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document provides direct commands to create and automatically rotate live credentials, including RDS, RAM, and ECS secrets, without prominently warning that these operations can immediately affect authentication, service availability, and dependent applications. In a credential-management skill, omission of impact and rollout cautions increases the chance that an agent or user will apply these commands to production systems and trigger lockouts, outages, or unintended access changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation includes a destructive deletion path, including force deletion without recovery, but does not provide clear cautionary guidance, confirmation expectations, or operational safeguards. In a secret-management skill, this increases the risk that an agent or user could delete critical secrets irreversibly, causing outages or permanent credential loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file documents retrieval of live secret values and includes realistic example secret contents without privacy and handling warnings. In a KMS secret-management context, this is especially dangerous because it normalizes secret disclosure and may lead an agent to fetch, display, log, or echo sensitive values such as passwords, private keys, or access keys.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This section instructs users to retrieve secret values and shows example output containing SecretData in plaintext, without any warning about exposure in terminal history, logs, screenshots, or shared transcripts. In a secret-management skill, normalizing display of raw secrets materially increases the chance of accidental credential disclosure during verification or troubleshooting.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes the skill as supporting secret management operations such as create, delete, update, query, version management, and rotation policy configuration. This file additionally documents GetSecretPolicy verification, introducing secret policy management as a supported capability, which is not mentioned in the stated skill scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The complete verification script performs live secret creation, retrieval, restoration, and especially force deletion against KMS without a prominent safety warning, environment isolation guidance, or guardrails. In a production-like environment, an operator could inadvertently disclose secret contents or permanently delete active secrets, causing outages or loss of recoverability.

Content

No source excerpt is available for this finding.