Security audit

alibabacloud-lingjun-cluster-manage

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Alibaba Cloud cluster-management skill, but it should go to Review because key runtime and installation paths are not tightly bounded or verifiable.

Before installing, verify that the packaged runtime includes the expected lib/lj_init.sh and review it directly. Prefer a signed or package-manager Aliyun CLI install, avoid curl-to-bash installers, pin or administratively control the eflo-controller plugin version, and use a dedicated low-privilege or short-lived Alibaba Cloud profile rather than a broad long-lived AccessKey. Do not use the documented --insecure test-region path with production credentials or networks.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/cli-installation.md:15
Finding: Unverified Remote Installer Is Piped Directly into a Shell
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/cli-installation.md:22
Finding: Automatically Installed and Updated CLI Plugin Is Not Version-Pinned
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: SKILL.md:4
Finding: Environment-Controlled External Initialization Script Is Sourced Without Verification
Content: View full analysis
[args] ``` ```bash source "$LJ_SKILL_DIR/lib/lj_init.sh" && safe_mutate_oneshot [--intent ""] aliyun eflo-controller --region [args] ``` ### Technical Analysis The Skill sources `lib/lj_init.sh` from a directory selected by the existing `LJ_SKILL_DIR` environment variable. Shell `source` executes every command in the selected file in the current shell process. The audited package does not contain the referenced `lib/lj_init.sh`. As a result, the implementations of `query`, `safe_aliyun`, `safe_mutate_oneshot`, `safe_mutate_confirm`, plugin installation, confirmation enforcement, and request rewriting cannot be validated from the supplied artifact. If an attacker can influence `LJ_SKILL_DIR` or modify the external installation directory, they can replace the trusted ...[truncated 1087 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/cli-installation.md:42
Finding: Long-Lived Cloud Credentials Are Supplied as Command-Line Arguments
Content: View full analysis
\ --access-key-secret \ --region cn-hangzhou ``` Credentials are stored in `~/.aliyun/config.json`. ``` The short-term and role examples also place credentials directly in arguments: ```bash aliyun configure set --mode StsToken \ --access-key-id --access-key-secret \ --sts-token --region cn-hangzhou ``` ### Technical Analysis Substituting real secrets into the documented commands can expose them through shell history, terminal recording, debugging logs, command auditing, or process-argument inspection. The documentation also states that credentials are stored in `~/.aliyun/config.json` but does not require restrictive file permissions or describe encryption-at-rest protections. Recommending long-lived AK mode increases the duration and impact of accidental disclosure. Role-based or short-lived credentials provide a safer default for this workload. ### Attack Path 1. A user replaces the placeholders with an actual AccessKey ID and AccessKey Secret. 2. The shell records the command in history, or local process/audit tooling captures its arguments. 3. The CLI stores the credential in `~/.aliyun/config.json`. 4. A local attacker, support bundle, backup process, or diagnostic collector obtains the command record or configuration file. 5. The attacker authenticates to Alibaba Cloud using the exposed credential. 6. The attacker performs actions permitted by the credential's attached RAM policies until the key is revoked ...[truncated 406 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/endpoint-and-regions.md:28
Finding: TLS Certificate Verification Is Disabled Across All CLI Calls in Test-Region Sessions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation instructs users to configure long-lived AccessKey credentials and notes they are stored in ~/.aliyun/config.json, but it does not warn that these secrets are locally recoverable by other processes or users with filesystem access. In a cluster-management skill, these credentials can enable creation, deletion, and modification of cloud resources, so omission of basic secret-handling guidance materially increases credential exposure risk.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The instruction pipes a remotely fetched script directly into bash, eliminating an opportunity for inspection and making users fully trust the network path, hosting endpoint, and upstream publisher at execution time. In a cloud cluster-management context, compromise of that script could install malware, steal Alibaba credentials, or tamper with CLI behavior used to manage or destroy infrastructure.
Content: Scanner excerpt · references/cli-installation.md (reported line 18)May include surrounding context.
md
| Platform | Command | |---|---| | macOS (Homebrew) | `brew install aliyun-cli && brew upgrade aliyun-cli` | | macOS / Linux x86_64 | `curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh \| bash` | | Linux ARM64 | `wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz && tar -xzf aliyun-cli-linux-latest-arm64.tgz && sudo mv aliyun /usr/local/bin/` | | Windows | Download `https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip`, unzip, and add to PATH |