Security checks for vulnerabilities and agentic risk
Overview
The skill is mainly a read-only Alibaba Cloud live-recording diagnostic, but its install and credential guidance can change local CLI state and expose cloud credentials if followed literally.
Review this skill before installing. Use a least-privileged Alibaba Cloud RAM role or short-lived credentials, do not paste access keys into command-line flags, avoid automatic plugin updates unless you trust the source, and manually disable or restore Aliyun CLI AI-mode/user-agent settings after use. Treat diagnostic output such as callback URLs, OSS paths, stream names, and bucket names as sensitive.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T08 · Insecure Dependencies
Error
Location
SKILL.md:44
Finding
Unpinned CLI and Plugin Downloads Permit Supply-Chain Code Execution
Content
View full analysis
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
Location
references/cli-installation-guide.md:107
Finding
Credential Setup Instructions Expose Secrets Through Command-Line Arguments
Content
View full analysis
\
--access-key-secret \
--region cn-hangzhou
```
```bash
aliyun configure set \
--mode AK \
--access-key-id LTAI5tXXXXXXXX \
--access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
--region cn-hangzhou
```
```bash
aliyun configure set \
--mode StsToken \
--access-key-id LTAI5tXXXXXXXX \
--access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
--sts-token v1.0:XXXXXXXXXXXXXXXX \
--region cn-hangzhou
```
The guide states:
```text
All `aliyun configure` commands support non-interactive flags, which is the recommended approach —
it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.
```
### Technical Analysis
The guide recommends placing access-key IDs, access-key secrets, and STS tokens directly in command-line arguments. When users replace the placeholders with real values, those secrets may be recorded in shell history, process-monitoring output, terminal transcripts, CI/CD logs, audit logs, or agent tool-call records.
This advice directly conflicts with the stronger security requirements in `SKILL.md:62-65` and `references/ram-policies.md:96-104`, which prohibit passing literal credentials to `aliyun configure set`. Because the unsafe guide is directly linked from the primary skill installation instructions, users may reasonably follow it despite the conflicting warning.
### Attack Path
1. A user follows the linked CLI configuration guide.
2. The user replaces the example placeholders with active Alibaba Cloud access keys or an STS token.
3. The shell records the command in history, or automation records it in build/session logs; while runn
...[truncated 872 chars]
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
Location
references/verification-method.md:150
Finding
Unvalidated Callback and Recording URLs Enable SSRF-Style Internal Network Probing
Content
View full analysis
`
```
```bash
# Test OSS file accessibility
curl -I --connect-timeout 10 --max-time 30 http://my-bucket.oss-cn-hangzhou.aliyuncs.com/record/live/stream123/index.m3u8
```
### Technical Analysis
The workflow retrieves callback and recording URLs from cloud configuration or API responses and recommends making network requests to those destinations. It does not define controls for URL schemes, approved hostnames, DNS resolution, redirects, loopback addresses, private networks, link-local ranges, or cloud instance metadata addresses.
An attacker who can influence the recording or callback configuration can supply a URL targeting services reachable from the agent's execution environment. Even an HTTP `HEAD` request can reveal service availability and response metadata. `openssl s_client` can similarly establish arbitrary TCP/TLS connections to attacker-selected hosts and ports when adapted to a returned callback hostname.
### Attack Path
1. An attacker obtains permission to alter a Live callback destination or otherwise controls a URL returned in recording metadata.
2. The attacker configures a destination such as localhost, an RFC 1918 address, a link-local metadata service, or an internal DNS name.
3. The diagnostic workflow retrieves the attacker-selected URL.
4. The agent follows the verification guide and invokes `curl`
...[truncated 946 chars]
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
Location
SKILL.md:118
Finding
Persistent AI-Mode Mutation and Tracking Metadata Contradict Read-Only Guarantees
This reference file materially exceeds the stated scope of a live recording diagnostic skill by teaching full Alibaba Cloud CLI installation, authentication, profile management, plugin installation, and cross-service usage. In an agent skill context, that broad operational enablement can unnecessarily equip the agent or user to access unrelated cloud resources, expanding privileges and attack surface far beyond troubleshooting recording issues.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
High
Category
Not specified by scanner
Confidence
96% confidence
Finding
The document includes detailed credential setup for multiple authentication modes, including long-lived Access Keys, role assumption, ECS role usage, and profile management, none of which are justified as necessary within a narrowly scoped diagnostic skill. In this context, embedding broad privileged-auth guidance increases the likelihood of over-privileged configurations, credential exposure, and use of the skill as a stepping stone to wider Alibaba Cloud access.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The trigger list includes phrases like "record not working" and "record file missing," which are generic troubleshooting expressions and could overlap with many non-Alibaba Cloud or non-live-streaming contexts. Although the description narrows the domain somewhat, the manifest does not provide negative examples or stricter activation constraints to prevent unintended invocation.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The skill instructs the agent to run aliyun configure ai-mode enable and set a global user agent before any diagnostic command, which modifies persistent CLI client state rather than performing a purely read-only diagnosis. Changing global configuration can affect later commands, other sessions, or other skills, and if execution exits unexpectedly the modified state may remain in place despite the later disable step.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The document claims the skill is read-only and does not modify configurations, but earlier steps direct modification of CLI configuration via AI-mode enable/disable and user-agent changes. This mismatch can mislead users and automated systems into granting more trust than warranted, reducing scrutiny around commands that alter local client state.
Content
No source excerpt is available for this finding.
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content
Scanner excerpt · references/cli-installation-guide.md (reported line 29)May include surrounding context.
md
# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz
# Install to user-local bin (no sudo required)
mkdir -p ~/.local/bin
mv aliyun ~/.local/bin/
export PATH="$HOME/.local/bin:$PATH"
Session Persistence
Medium
Category
Rogue Agent
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content
Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.
md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz
# Install to user-local bin (no sudo required)
mkdir -p ~/.local/bin
mv aliyun ~/.local/bin/
export PATH="$HOME/.local/bin:$PATH"
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The examples pass access keys and secrets directly on the command line, which can expose credentials through shell history, process listings, audit logs, terminal recording, or agent telemetry. In an automation or agent setting, this risk is amplified because command invocations may be captured centrally or echoed into logs.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The guide promotes unrelated ECS operations, profile switching, and plugin installation/listing for multiple products, which are outside the remit of a live recording diagnostic skill. That makes the skill more dangerous because it encourages broader cloud exploration and capability expansion instead of limiting users or agents to recording-specific diagnostics.
Content
No source excerpt is available for this finding.
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content
Scanner excerpt · references/cli-installation-guide.md (reported line 412)May include surrounding context.
The workflow begins issuing account-scoped diagnostic commands and changing CLI mode without a clear upfront disclosure that cloud account metadata, stream history, and recording details will be queried. Lack of transparent notice can lead users to authorize execution without understanding the scope of data access, increasing privacy and trust risks even when commands are read-oriented.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
81% confidence
Finding
This markdown file documents callback endpoints and live stream URLs that could reveal internal integration points or publishing infrastructure. Under the markdown-file warning criterion, the document does not mention any caution about treating these values as sensitive or avoiding use of real production endpoints in shared outputs.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
88% confidence
Finding
The sample config sets "language": "en", which can be interpreted as forcing a specific language/locale in natural-language guidance. The document does not indicate that language is optional, user-selectable, or required for a region-specific compliance reason.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
85% confidence
Finding
This markdown file documents read-only diagnostic commands, but it includes examples and sample output exposing potentially sensitive infrastructure details such as callback URLs and OSS recording locations without any user-facing caution. For markdown files, SQP-2 applies when the skill description omits warnings about behavior that could affect user data, privacy, or system integrity, and these commands can disclose internal service endpoints and stored recording metadata.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
80% confidence
Finding
This markdown file includes an automated script block and instructs the user to save it as verify-recording.sh, make it executable, and run it. While the script's purpose is verification, the document does not explicitly warn that following these steps will create a local file and execute shell commands on the user's system.
