Security audit

alibabacloud-livedebug

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its live-debugging purpose, but it needs review because it can install broad runtime probes and retrieve sensitive data captured from live services.

Install only for operators who are allowed to debug the target Alibaba Cloud services. Use a least-privilege RAM sub-account, prefer read-only permissions unless creating probes is required, avoid wildcard instance targeting in production, keep TTL and capture counts short, do not target auth/payment/session paths without explicit approval, and treat SLS capture results as potentially containing secrets or personal data.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/live-debug/send_command.sh:62
Finding: Unrestricted Runtime Inspection and Sensitive-State Capture
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/live-debug/query_task.sh:65
Finding: SLS Query Injection Through an Unescaped Task Identifier
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi ``` - If the service supports another identifier format, define a strict allowlist containing only necessary characters and lengths. 2. Escape SLS string literals with a dedicated routine if arbitrary identifiers must be supported. Do not rely on shell quoting as query-language escaping. 3. Reject control characters and SLS operators in task identifiers, including quotes, backslashes, pipes, line breaks, and comment syntax. 4. Prefer an exact structured-field predicate when the task ID exists in a dedicated indexed field, rather than a free-text search across all log content. 5. Add tests covering: - Embedded double and single quotes. - Backslashes and newline characters. - Pipeline operators. - Wildcards and Boolean operators. - Valid and invalid task-ID lengths. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
md
`instanceIds is required` | Read the message, re-check the taskConfig against [references/live-debug.md](references/live-debug.md) (flat JSON, `instanceIds` pl

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.
md
`instanceIds is required` | Read the message, re-check the taskConfig against [references/live-debug.md](references/live-debug.md) (flat JSON, `instanceIds` pl

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 88% confidence
Finding: The skill exposes powerful create/get/delete/query operations over live-debug tasks against production services, including deletion by workspace, serviceId, taskId, and type, without embedding strong guardrails such as confirmation requirements, ownership checks, or explicit authorization boundaries in the documented workflow. In an agent setting, attacker-influenced parameters could be abused to disable diagnostics, alter instrumentation, or target unintended services and instances, especially because the skill also instructs reading identifiers from local project files and using wildcard instance targeting.
Content: Scanner excerpt · references/live-debug.md (reported line 69)May include surrounding context.
md
| Create | `POST /serviceTask/{workspace}/{serviceId}/task` | `aliyun cms2 apm service-task create` | `send_command.sh` | | List | `GET /serviceTask/{workspace}/{serviceId}/tasks` | `aliyun cms2 apm service-task list` | `list_tasks.sh` | | Get one | `GET /serviceTask/{workspace}/{serviceId}/task/{taskId}` | `aliyun cms2 apm service-task get` | `get_task.sh` | | Delete | `DELETE /serviceTask/{workspace}/{serviceId}/task/{taskId}` | `aliyun cms2 apm service-task delete` | `delete_task.sh` | | Bulk-delete probes | list + delete combination | - | `delete_all_probes.sh` | | Query results | SLS query | `aliyun sls get-logs-v2` | `query_task.sh` |

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

Help output OK -> continue.

unknown command / missing -> the CMS ServiceTask capability is provided by the aliyuncms2 plugin binary. Confirm it is placed in ~/.aliyun/ (or PATH) and is executable:
bash
ls -l ~/.aliyun/aliyuncms2 chmod +x ~/.aliyun/aliyuncms2 aliyun cms2 apm service-task --help

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file includes an irreversible operational example for deleting all probes under a service, including a non-dry-run invocation. While a dry-run example is provided, there is no explicit warning about the impact of actually deleting all probes or guidance to confirm intent before performing the destructive action.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This skill explicitly enables runtime probes that can capture arguments, return values, locals, stack traces, object graphs, and custom expressions from live applications, which can easily include credentials, tokens, PII, secrets, or business data. Although a small redaction example appears in Java snapshot config defaults, the document lacks prominent safety guidance, approval requirements, minimization advice, or warnings against targeting sensitive code paths, making accidental over-collection and disclosure likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This section grants write/delete permissions for live-debug probes and service tasks but does not clearly warn users that these actions can actively modify diagnostics on running services, increase load, expose sensitive runtime data, or disrupt production behavior if misused. In the context of a runtime debugging skill, omission of an explicit operational-risk warning can lead operators to overgrant privileges and use invasive actions in production without understanding the blast radius.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.