alibabacloud-lingjun-node-diagnose

• Outcome: Review
• Latest audit: Sep 7, 2026 · 2:30 AM UTC
• Version: 0.0.1

Overview

This skill is a disclosed Alibaba Cloud node diagnosis and repair helper, but it bundles high-impact cloud actions with an unverified installer and safety wrappers that are referenced but not included for review.

Install only if you need an agent to help operate Alibaba Cloud Lingjun nodes and you are comfortable granting cloud repair authority. Prefer least-privilege RAM policies, avoid curl-to-bash installation unless you independently trust and verify the CLI source, review/redact logs before submission, and do not use reimage/stop/approval workflows without a fresh human confirmation and change window.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:33

Finding

Unverified Remote Installer Is Downloaded and Executed Directly

Content

View full analysis

= 3.3.3`; otherwise: ```bash curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash aliyun version ``` ``` `references/cli-installation-guide.md:4-11`: ```bash # Check the current version (requires >= 3.3.3; this skill is verified on 3.3.10) aliyun version # Install when missing or too old curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash exec $SHELL -l aliyun version ``` ### Technical Analysis The instructions pipe a mutable network response directly into Bash. The downloaded script is not saved for inspection and is not authenticated through a pinned checksum, detached signature, or reproducible package version. TLS protects the connection under normal circumstances but does not establish that the current remote payload is the same payload reviewed when the Skill was published. Compromise of the CDN origin, hosting account, DNS infrastructure, or TLS trust chain could replace the script without changing the audited Skill. The installer executes with all privileges held by the user following the instructions. If the command is run from an administrative shell, the remote payload would obtain administrative privileges. ### Attack Path 1. An attacker compromises or gains control over the remote `setup.sh` response path. 2. The attacker modifies the response to include arbitrary shell commands. 3. A user follows the Skill's installation or upgrade instructions. 4. `curl` retrieves the attacker-controlled response. 5. Bash executes it immediately without verification or review. 6. The payload can access the user's files, cloud configuration, environment variables, and any privileges available to ...[truncated 613 chars]

Remediation

View remediation

' 'aliyun-cli-installer' | sha256sum --check - ``` 4. Prefer a vendor-supported, signed operating-system package repository where available. 5. Verify a detached vendor signature using a pinned and independently obtained public key. 6. Display the resolved version and source to the user before installation. 7. Run the installer without administrative privileges unless a documented installation step strictly requires elevation. 8. Pin and verify the subsequently installed `eflo-controller` plugin as well. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/scripts.md:59

Finding

Mutation Workflow Persists Commands Containing Node Passwords Under a Temporary Directory

Content

View full analysis

aliyun eflo-controller create-diagnostic-task \ --endpoint eflo-controller.cn-hangzhou.aliyuncs.com --region cn-hangzhou \ --cluster-id --diagnostic-type BasicCheck --node-ids # Output: the hash is printed silently to stdout (for the Agent to capture, not shown to the user); the command is persisted to /tmp/lingjun-diag-mutate/-.json ``` `SKILL.md:196`: ```text Phase 1 never reaches the CLI — it only writes a base64 dump under `/tmp/lingjun-diag-mutate/` and echoes a 12-char hash ``` `references/mutating-schemas/reimage-nodes.yaml:34-39`: ```yaml - key: LoginPassword # required type: string business_required: true forbidden_inference: true # must not reuse the old password / any password from context sensitive: true # all output rendered as ****** ``` ### Technical Analysis The two-phase mutation contract states that the command is persisted under `/tmp/lingjun-diag-mutate/`. Reimaging requires a real `LoginPassword` in the command argument vector. Although user-facing output is masked, no equivalent guarantee is provided for the underlying persisted command. The Skill further characterizes the temporary representation as a base64 dump. Base64 is reversible encoding and provides no confidentiality. The supplied documentation does not require: - An owner-only temporary directory. - `0600` file permissions. - Safe, atomic file creation. - Protection against symbolic-link attacks. - Encryption of sensitive fields. - Secret exclusion ...[truncated 1632 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/diagnose-operations.md:53

Finding

AI Job Logs Are Transmitted Without Mandatory Secret Redaction or Data-Minimization Controls

Content

View full analysis

","AiInstance":"job-worker-0","Logs":["NCCL WARN Call to connect returned Connection timed out"]}]}' ``` ### Technical Analysis The `CheckByAiJobLogs` feature intentionally sends user-provided job-log information to the Alibaba Cloud `eflo-controller` API. That transmission is related to the declared diagnostic functionality and is not covert exfiltration. However, the workflow does not require inspection or redaction of the content before transmission. AI and training logs commonly contain: - API tokens and authorization headers. - Access-key identifiers or secrets. - Internal hostnames, IP addresses, and filesystem paths. - Dataset records or personal information. - Proprietary model, prompt, or workload content. - Signed URLs, session cookies, and service credentials. The workflow also places the complete JSON value in a command-line argument. On some systems, process arguments may be visible to other local users or collected by telemetry and debugging too ...[truncated 1466 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The quick reference exposes operational commands that appear broader than the declared skill scope, including cluster detail, image listing, region discovery, and maintenance approval. In an agent setting, undocumented or under-declared capabilities weaken policy boundaries and can enable actions or data access a user or reviewer did not expect, especially because some listed commands are mutating and infrastructure-affecting.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The trigger set includes broad phrases like 'syslog', 'fault report', '重启节点', and generic failure terms that can match ordinary admin or troubleshooting requests, causing this skill to activate unexpectedly. In this skill, unexpected activation is more dangerous because the body includes real mutating workflows for reboot, reimage, stop, reporting status, and approving operations against cloud infrastructure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The unified error output template hard-codes Region : cn-hangzhou, which can cause the agent to present an incorrect region in failure reports instead of the actual user-selected or request-derived region. In this skill, region is an operationally critical parameter for cloud diagnostics and repair workflows, so a wrong region can mislead operators during incident response, ticket escalation, and reconciliation with RequestId/DiagnosticId.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The document grants and recommends mutating repair permissions such as reboot, reimage, stop, and report-node-status, but it does not clearly warn that these actions can disrupt workloads, cause downtime, or result in destructive changes such as reimaging. In an AI-agent skill context, documenting these capabilities without prominent operational safeguards increases the chance that users or downstream automation over-provision access and invoke high-impact actions without adequate review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The fault-report policy includes mutating capabilities to stop diagnostics and approve operations, but the text frames them mostly as tracking/management features and does not prominently emphasize their system-impacting nature. In this skill, where an agent may assist with operational workflows, understated documentation around approval and termination permissions can lead to unsafe delegation of authority or accidental interruption of maintenance and diagnosis processes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The skill defines an automatic commit path where Phase 2 is invoked without fresh user confirmation when MUTATE_AUTOCONFIRM=1. If this environment variable is set in an interactive or misconfigured production context, destructive operations such as reimage, reboot, stop, or fault-report actions could execute without meaningful human approval, bypassing the intended two-phase safety control.

Content

Scanner excerpt · references/scripts.md (reported line 72)May include surrounding context.

md

1. Phase 1 does **not** actually issue the request; it only persists the `cmd` text + prints the hash + renders the parameter confirmation table + validates that `forbidden_inference` fields are complete.
2. Phase 2 strictly matches the hash; missing or expired (30min) -> refuse to execute.
3. Phase 2 submission still goes through the `safe_aliyun` wrapper.
4. **Test mode**: when `MUTATE_AUTOCONFIRM=1`, Phase 2 is invoked automatically after Phase 1 for automated testing; this environment variable must never be enabled in interactive sessions.
5. For `reimage-nodes`, the Phase 1 confirmation table must prominently render the [WARN] system-disk-wiped, irreversible warning; the user's unified confirmation word (zh word per parameter-confirmation.md / en "confirm") acknowledges that impact, after which the Agent internally runs `safe_mutate_confirm <hash>` to enter Phase 2.

---

Static analysis

No suspicious patterns detected.