alibabacloud-lingjun-node-ops

• Outcome: Review
• Latest audit: Sep 8, 2026 · 2:21 AM UTC
• Version: 0.0.1

Overview

The skill is a real Alibaba Cloud infrastructure-operations guide, but its install path and missing safety wrapper implementation create review-worthy risk.

Install only in a controlled Alibaba Cloud operations environment. Prefer a verified, pinned Alibaba Cloud CLI and plugin installation instead of curl-to-bash or automatic plugin updates, use the smallest RAM policy set needed, and review every confirmation carefully before reimage, renew, run-command, or resource-group changes.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:47
• Finding: Unverified Remote Installer Is Piped Directly into Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:47-49`; duplicated in `references/cli-installation-guide.md:21-24` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High ### Vulnerable Code `SKILL.md:47-49`: ```bash curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash aliyun version ``` `references/cli-installation-guide.md:21-24`: ```bash curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash exec $SHELL -l aliyun version ``` ### Technical Analysis The installation instructions stream the current response from an external URL directly into Bash. The payload is not pinned to a reviewed version, downloaded for inspection, checked against a SHA-256 digest, or authenticated with a publisher signature. HTTPS protects the connection against ordinary interception when certificate validation and the trust store remain sound, but it does not protect against compromise of the CDN, origin server, DNS or certificate ecosystem, publisher account, or release process. It also does not prevent the content at the URL from changing after this Skill has been audited. Because Bash begins interpreting the response immediately, a malicious or compromised installer can execute arbitrary commands with the privileges of the user running the installation. The installation guide also recommends using `sudo` following a permission error at `references/cli-installation-guide.md:61`, which could cause a user to rerun the same unverified installer with administrative privileges. ### Attack Path 1. An attacker compromises the installer origin, CDN distribution, publisher account, or another part of the delivery chain. 2. The attacker replaces or modifies `setup.sh` with commands that install malware, steal credentials, alter shell configuration, or establish persistence. 3. A user or agent follows the Skill's installation instructions. 4. `curl` ...[truncated 954 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` installation instructions. 2. Pin the Alibaba Cloud CLI to a specific reviewed version. 3. Download the artifact to a newly created private temporary directory rather than streaming it into a shell. 4. Obtain the expected digest or signature through an independently authenticated release channel. 5. Verify a publisher signature where available. At minimum, compare a pinned SHA-256 digest before execution. 6. Abort installation on any verification failure. 7. Display or inspect the downloaded installer before running it. 8. Execute installation without elevated privileges whenever possible. 9. Do not recommend `sudo` as a generic response to installer permission failures. Provide a documented user-local installation procedure instead. 10. Apply the corrected procedure consistently in both `SKILL.md` and `references/cli-installation-guide.md`. A safer pattern is: ```bash tmp_dir="$(mktemp -d)" chmod 700 "$tmp_dir" curl -fL --proto '=https' --tlsv1.2 \ -o "$tmp_dir/setup.sh" \ 'https://trusted.example/versioned/setup.sh' printf '%s %s\n' 'PINNED_SHA256' "$tmp_dir/setup.sh" | sha256sum -c - bash "$tmp_dir/setup.sh" rm -rf "$tmp_dir" ``` The URL, version, and digest must come from a trusted and reviewed release rather than using placeholders in production instructions. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:59
• Finding: Alibaba Cloud Plugins Are Automatically Installed and Updated Without Version Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:59-63`; duplicated in `references/cli-installation-guide.md:27-31` **Vulnerability Type**: Unpinned automatically retrieved dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:59-63`: ```bash aliyun configure set --auto-plugin-install true aliyun plugin install --name eflo-controller aliyun plugin install --name bssopenapi aliyun plugin update ``` `references/cli-installation-guide.md:27-31`: ```bash aliyun configure set --auto-plugin-install true aliyun plugin install --name eflo-controller aliyun plugin install --name bssopenapi aliyun plugin update ``` ### Technical Analysis The instructions enable automatic plugin installation and then install and update plugins without identifying tested versions, immutable package references, checksums, or publisher signatures. Consequently, the components executed during cloud operations may differ from those reviewed with this Skill. The unconditional `aliyun plugin update` command further replaces installed code with the latest available release. Enabling `--auto-plugin-install true` also allows future commands to trigger dependency retrieval implicitly, reducing user visibility into when executable components are introduced or changed. The plugin names appear consistent with the declared Alibaba Cloud functionality, and the audit found no evidence of typosquatting in the names themselves. The risk arises from mutable, unpinned supply-chain inputs rather than from a confirmed malicious plugin. ### Attack Path 1. An attacker compromises a plugin repository, plugin publisher account, release process, or distribution channel. 2. A malicious release is published under one of the expected plugin names or replaces an update artifact. 3. The user follows the Skill instructions, enables automatic installation, and runs an unpinned install or update. 4. The Alibaba Cloud CLI retrieves and activates the compromised plugin. 5. The plugin exe ...[truncated 778 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not enable automatic plugin installation by default. 2. Pin each plugin to a specific version tested with this Skill. 3. Document the official repository and publisher identity for every plugin. 4. Verify publisher signatures or pinned cryptographic digests before activation. 5. Replace unconditional `aliyun plugin update` with an explicit, user-approved update procedure. 6. Review release notes and integrity metadata before changing plugin versions. 7. Record approved plugin versions in the manifest so the reviewed dependency set is reproducible. 8. Fail closed if the installed version differs from the approved version. 9. Run plugin installation under an unprivileged account. 10. Retain the documented separation of RAM permission sets and avoid assigning the union of all operation sets to one role. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/scripts.md:49
• Finding: Sensitive Mutation Parameters Are Reversibly Serialized Under a Shared Temporary Directory<![CDATA[ ## Vulnerability Details **File Location**: `references/scripts.md:49-52` **Vulnerability Type**: Unsafe temporary storage of potentially sensitive command arguments **Risk Level**: Medium ### Vulnerable Code ```text `safe_mutate_oneshot` internally performs: parameter freezing (base64 dump to `/tmp/lingjun-mutate/`) -> hash verification -> assembly into `safe_aliyun aliyun ...` submission -> dump cleanup. This guarantees "the parameters the user confirmed = the parameters actually submitted". ``` ### Technical Analysis The documented mutation wrapper serializes parameters as Base64 under `/tmp/lingjun-mutate/`. Base64 is an encoding and provides no confidentiality. Mutation parameters can include login passwords, command parameters, user data, and other operationally sensitive values. The package does not contain the referenced `lib/core/mutate-runner.sh` implementation, so the audit could not verify whether the directory is created with mode `0700`, whether files use mode `0600`, whether names are unpredictable, whether symlink attacks are prevented, or whether cleanup traps execute after interruption and failure. Using a fixed path beneath a shared temporary directory can create several risks if the missing implementation does not enforce strict ownership and creation semantics: - Other local users or processes may read serialized secrets. - Predictable files may be targeted with symlinks or race conditions. - A crash, forced termination, or power loss may leave recoverable data behind. - Hash verification protects integrity only if implemented correctly; it does not protect confidentiality. - A pre-created attacker-controlled directory could influence reads, writes, or cleanup if ownership and file type are not validated. This finding is based on the documented storage design and the absence of verifiable implementation safeguards. It does not establish that the missing wrapper actually uses permissive file modes. ### Attack Path 1. A u ...[truncated 1242 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer keeping sensitive mutation parameters in memory and avoid filesystem serialization. 2. If temporary storage is unavoidable, create a unique directory with `mktemp -d` and immediately enforce mode `0700`. 3. Set a restrictive `umask`, such as `077`, before creating any files. 4. Create files atomically with exclusive-create semantics and mode `0600`. 5. Verify that the directory and every file are owned by the current effective user. 6. Reject symbolic links, hard-link anomalies, unexpected file types, and pre-existing paths. 7. Install cleanup traps for normal exit, errors, signals, and interrupted submissions. 8. Minimize the lifetime of sensitive files and delete them immediately after use. 9. Do not rely on Base64 or hashing for confidentiality. 10. Avoid placing secrets in process arguments where they may be visible through process inspection. 11. Include the referenced `lib/` implementation in the auditable package so its permission, integrity, quoting, and cleanup controls can be reviewed. 12. Add automated tests that verify file modes, ownership, symlink resistance, crash cleanup, and absence of plaintext residual data. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The schema permits tagging not only nodes but also clusters and Hypernodes, which exceeds the skill's stated node-operations scope. This creates a scope-expansion/authorization risk: a user invoking a node-focused skill could unintentionally or maliciously mutate metadata on broader, potentially higher-impact resources.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The untag operation allows removal of tags from clusters and Hypernodes despite the manifest presenting the skill as node-focused. Untagging can disrupt governance, automation, billing allocation, or security controls that depend on tags, and the presence of the --all option further increases the blast radius if used on broader resource types.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: Allowing change-resource-group for clusters and Hypernodes broadens the skill from node management into moving larger infrastructure assets between resource groups. Resource-group reassignment can affect access control boundaries, billing ownership, policy application, and operational isolation, making this more dangerous than routine node lifecycle actions.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This schema exposes an `update-node-group` mutating capability even though the skill metadata explicitly states `change-node-group` is out of scope. That mismatch creates unauthorized capability expansion: an agent or caller relying on the declared scope could still trigger node-group level changes, including image, credentials, userdata, RAM role, and disk-related updates, which can materially alter fleet behavior.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The action goes beyond per-node lifecycle operations and enables broader node-group mutation, including changing defaults such as image, login password, user data, key pair, and RAM role. In a skill positioned as node operations, this increases the chance that higher-impact configuration changes are invoked without the stricter review or user expectations normally applied to provisioning/scaling workflows.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The workflow requires `aliyun resourcemanager list-resource-groups`, which enumerates all resource groups in the account before moving a single node. That broadens data access beyond the minimum needed for node operations and can expose organization-wide tenancy structure and identifiers to a skill that otherwise appears node-scoped.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Listing every resource group under the current account is broader than necessary to move one node and violates least-privilege principles. In the context of an ops skill, this can leak sensitive account topology, naming conventions, and administrative boundaries even when the user only intended a single-node metadata change.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This documentation enumerates destructive node power operations such as stop, reboot, and reimage, including parameters for batch targeting, but provides no explicit operator warning, confirmation guidance, or note about service interruption and data-loss risk. In an agent skill intended to drive infrastructure actions, omission of these cautions makes accidental misuse more likely and lowers the barrier to disruptive operations.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The run-command section documents arbitrary remote command execution across up to 50 nodes without any warning about privilege level, command safety, credential exposure, persistence modes, or production impact. Because this skill is specifically for node operations, normalizing unaudited shell execution materially increases the chance of destructive commands, lateral movement, or secret leakage if a user prompt or downstream agent is manipulated.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The node-group update documentation includes sensitive and high-impact configuration fields such as login passwords, image IDs, user-data, key-pair names, RAM roles, and disk settings, but does not warn about credential handling, rollout consequences, or configuration drift. In this operational skill context, these changes can silently alter future node provisioning behavior and expose secrets if mishandled.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide instructs users to execute a remote installer directly via `curl ... | bash`, which runs network-fetched code without giving the user an opportunity to inspect it first or warning about the trust implications. In an ops-focused skill that manages cloud nodes and credentials, this is more dangerous because users are likely to run the command in privileged environments where a compromised installer could steal Alibaba Cloud credentials or alter local tooling.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document mandates use of `--insecure` for the test region, which disables TLS certificate validation and permits man-in-the-middle interception or endpoint impersonation if the network path is compromised. Although the text gives an operational reason (self-signed cert), it does not require an explicit user warning, certificate pinning, or any compensating control, so operators may normalize unsafe transport behavior for real node-management actions.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The manifest exposes a mutating reboot action but does not constrain or clearly document the intended invocation scope beyond generic required parameters. In an operational skill that can reboot up to 100 nodes asynchronously, underspecified scope increases the chance of overbroad targeting, accidental misuse, or unsafe invocation against production nodes without sufficient guardrails.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: This schema describes an asynchronous node reboot operation but contains no user-facing warning that the action is disruptive and can cause service interruption, workload failure, or temporary unavailability. In a node-operations skill, omission of an explicit disruption warning materially raises the risk of an operator or agent triggering reboots without understanding the operational blast radius.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The file explicitly documents that a successful call immediately creates a fault report and causes the node to leave the Using state for a deep diagnosis workflow. Because this is a mutating, potentially disruptive operation, the absence of an explicit user warning/confirmation requirement raises the risk that an agent could trigger downtime-affecting behavior without the user understanding the operational consequences. In a node-operations skill, that context makes the side effect materially important rather than incidental.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: This manifest exposes a general-purpose remote command execution action against up to 50 nodes with root defaults, but does not declare any manifest-level trigger constraints, safety gating, or exclusion conditions. In a node-operations skill, that means normal user prompts could be translated into arbitrary shell execution on infrastructure, increasing the chance of destructive misuse, prompt-injection-driven abuse, or accidental execution without sufficient confirmation.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The manifest provides remote command execution via CommandContent but does not include an explicit user-facing warning that commands will run on remote nodes, potentially as root and possibly repeatedly via reboot/period modes. Without a clear warning, users may not understand the destructive potential, and an agent may present the action as routine automation rather than privileged code execution.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The manifest defines a mutating action but does not specify invocation scope constraints such as required approvals, actor restrictions, or environmental boundaries. Without explicit scope controls, automation may invoke a write operation in unintended contexts, increasing the risk of unauthorized or accidental changes to production node-group configuration.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The reimage flow gates execution on an exact language-matched confirmation word, but the document does not define how the user's language is determined or how the user opts into that confirmation mode. In a destructive operation like reimage, this can cause ambiguous confirmation handling: a valid user intent may be rejected or, worse, a mismapped locale could accept an unintended confirmation token, increasing the risk of accidental destructive execution or unsafe operator workarounds.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: This documentation guides operators through approving disruptive maintenance actions such as repair, reboot, and upgrade, but it does not clearly and explicitly warn that approving them can interrupt workloads, reboot the node, or temporarily remove capacity. In an ops skill that may be executed with user confirmation, omission of service-impact warnings increases the chance of accidental approval of high-impact actions, especially because the workflow emphasizes enum correctness and approval mechanics more than operational blast radius.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This skill documents and operationalizes in-place node type changes on live infrastructure without clearly warning about service disruption, performance changes, or workload impact beyond a narrow task-specific warning. In an infrastructure-operations skill, omission of operational risk guidance can cause an agent or operator to perform destructive or destabilizing changes on production nodes with insufficient caution.

Static analysis

No suspicious patterns detected.