alibabacloud-loongcollector-ops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:55 AM UTC
• Version: 0.0.2

Overview

The skill is transparent about Alibaba Cloud log-collection operations, but it needs review because its host install helper can generate unsafe shell commands and it runs unverified remote installers.

Review before installing. Use only narrowly scoped Alibaba Cloud credentials, verify the exact account/region/host/cluster, do not paste AK/SK, private keys, or kubeconfig into chat, and avoid using this skill for host installs until the command renderer validates and shell-quotes region and identity inputs and remote installers are pinned or integrity-checked.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:85

Finding

Alibaba Cloud CLI bootstrap executes a mutable remote script without integrity verification

Content

View full analysis

= 3.3.3 required** > [MUST] Verify: `aliyun version` — must be >= 3.3.3 (>= 3.3.5 recommended). > - First install or major upgrade: `/bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh)"` > - Routine update (CLI >= 3.3.5): `aliyun upgrade`. ``` The same command is repeated in `references/cli-installation-guide.md`: ```bash /bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh)" ``` ### Technical Analysis The command retrieves the current response from an external HTTPS endpoint and passes it directly to Bash through command substitution. The downloaded content is neither pinned to an immutable version nor checked against a cryptographic hash or digital signature. Consequently, the effective code executed by the Skill can change after the reviewed package has been published. HTTPS protects the transport under ordinary conditions, but it does not protect against compromise of the vendor endpoint, storage account, publishing pipeline, DNS/TLS trust chain, or authorized upstream maintainer account. The use of `curl -f` ensures that HTTP failures are rejected, but it does not establish artifact authenticity or integrity. Timeouts similarly provide availability safeguards rather than security validation. ### Attack Path 1. An attacker compromises the remote `setup.sh` object, its publishing pipeline, or another trusted component in its delivery path. 2. The remote endpoint begins returning a modified shell script. 3. A user follows the Skill's mandatory first-install or major-upgrade prerequisite. 4. `curl` downloads the attacker-controlled response. 5. Bash immediately e ...[truncated 928 chars]

Remediation

View remediation

/installer' printf '%s %s\n' '' 'aliyun-cli-installer' | sha256sum --check - chmod 700 aliyun-cli-installer ./aliyun-cli-installer rm -f aliyun-cli-installer ``` The actual release URL and digest must come from official, independently verified release metadata. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/render_loongcollector_install_cmd.py:28

Finding

LoongCollector installation executes an unverified mutable remote payload on target hosts

Content

View full analysis

Remediation

View remediation

//loongcollector.sh' printf '%s %s\n' '' "$tmpdir/loongcollector.sh" | sha256sum --check - chmod 700 "$tmpdir/loongcollector.sh" "$tmpdir/loongcollector.sh" install '' rm -rf "$tmpdir" ``` Avoid exposing the temporary path or installer contents if either could contain sensitive generated material. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/render_loongcollector_install_cmd.py:48

Finding

Insufficient validation permits shell command injection in generated SSH and ECS installation commands

Content

View full analysis

/dev/null" % args.user_defined_id.replace("'", "") ) status = "sudo /etc/init.d/loongcollectord status" remote = " && ".join([download, run] + identity + [status]) ``` ```python "runcommand_hint": "aliyun ecs run-command --biz-region-id --type RunShellScript --timeout 600 --command-content %s --instance-id " % json.dumps(remote), "ssh_hint": "ssh -- %s" % json.dumps(remote), ``` ### Technical Analysis The script constructs a shell program by interpolating externally supplied parameters directly into command strings. The `region` check only rejects `/` and the literal space character. It does not reject shell metacharacters or control characters such as: - Semicolons - Command substitutions - Backticks - Newlines or tabs - Ampersands - Pipes - Redirection operators - Shell comments `user_id` is not validated or shell-escaped at all before being appended to a command executed ...[truncated 2463 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (88)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The description frames the skill as LoongCollector/SLS operations, but the behavior includes enabling ACK service and provisioning CS-related service roles at the account level. That expands impact beyond log collection into broader account and cluster control, creating a deceptive trust boundary and raising the risk of unexpected privilege use.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description frames the skill as LoongCollector/SLS operations, but the behavior includes enabling ACK service and provisioning CS-related service roles at the account level. That expands impact beyond log collection into broader account and cluster control, creating a deceptive trust boundary and raising the risk of unexpected privilege use.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

", "从安装到能查到日志", "SLS 日志采集接入", "SLS 日志采集接入相关的事", "修改采集配置", "改采集配置", "采集配置校验", "validate_pipeline.py", "SLS 机器组", "新建 Logtail Pipeline 采集配置", "Logtail Pipeline",

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md

", "从安装到能查到日志", "SLS 日志采集接入", "SLS 日志采集接入相关的事", "修改采集配置", "改采集配置", "采集配置校验", "validate_pipeline.py", "SLS 机器组", "新建 Logtail Pipeline 采集配置", "Logtail Pipeline",

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.

md

", "从安装到能查到日志", "SLS 日志采集接入", "SLS 日志采集接入相关的事", "修改采集配置", "改采集配置", "采集配置校验", "validate_pipeline.py", "SLS 机器组", "新建 Logtail Pipeline 采集配置", "Logtail Pipeline",

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.

md

", "从安装到能查到日志", "SLS 日志采集接入", "SLS 日志采集接入相关的事", "修改采集配置", "改采集配置", "采集配置校验", "validate_pipeline.py", "SLS 机器组", "新建 Logtail Pipeline 采集配置", "Logtail Pipeline",

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

md

", "从安装到能查到日志", "SLS 日志采集接入", "SLS 日志采集接入相关的事", "修改采集配置", "改采集配置", "采集配置校验", "validate_pipeline.py", "SLS 机器组", "新建 Logtail Pipeline 采集配置", "Logtail Pipeline",

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

md

", "从安装到能查到日志", "SLS 日志采集接入", "SLS 日志采集接入相关的事", "修改采集配置", "改采集配置", "采集配置校验", "validate_pipeline.py", "SLS 机器组", "新建 Logtail Pipeline 采集配置", "Logtail Pipeline",

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.

md

", "从安装到能查到日志", "SLS 日志采集接入", "SLS 日志采集接入相关的事", "修改采集配置", "改采集配置", "采集配置校验", "validate_pipeline.py", "SLS 机器组", "新建 Logtail Pipeline 采集配置", "Logtail Pipeline",

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 386)May include surrounding context.

md

", "从安装到能查到日志", "SLS 日志采集接入", "SLS 日志采集接入相关的事", "修改采集配置", "改采集配置", "采集配置校验", "validate_pipeline.py", "SLS 机器组", "新建 Logtail Pipeline 采集配置", "Logtail Pipeline",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The skill asks the user to provide a usable kubectl and cluster context, which can lead users to supply highly sensitive access material in-band if the interface does not strictly separate metadata from secret content. In a skill that later performs cluster operations, any ambiguity around how kubeconfig or context should be shared raises credential-exposure risk.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

self_host_install: "是否确认在上述主机上安装 LoongCollector？"
  ack_install: "是否确认在上述 ACK 集群安装 loongcollector 组件？"
  self_k8s_install: "是否确认在上述 Kubernetes 集群安装 LoongCollector？"
  kubeconfig: "请提供可用的 kubectl 与目标集群 context。"
  ssh: "请提供已配置的 SSH（alias 或主机），不要在对话中发送私钥。"
  collector_version: "请提供采集器版本（例如 3.3.9）。"
markers:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

>
> **Security Rules:**
> - **NEVER** read, echo, or print AK/SK values (e.g., `echo $ALIBABA_CLOUD_ACCESS_KEY_ID` is FORBIDDEN)
> - **NEVER** use `cat`, `less`, `head`, `tail`, `grep`, `open`, `json.load`, or any file-reading command on credential files (e.g., `~/.aliyun/config.json`, `~/.aws/credentials`). To check file existence use `ls` only — never display contents. Printing plaintext secrets is an immediate task failure and security incident.
> - **NEVER** install or import `aliyun-log-python-sdk` / `aliyun.log` / `LogClient`, or any other SLS SDK, to bypass CLI. `pip install` of a cloud SDK is a task failure.
> - **NEVER** print, `cat`, or paste kubeconfig / client certificates / tokens into the conversation. For opt-in CRD only: write `describe-cluster-user-kubeconfig` output to a `0600` tempfile.
> - **NEVER** ask the user to input AK/SK directly in the conversation or command line

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

> - **ONLY** use `aliyun configure list` to check credential status. `scripts/preflight.sh` already does this.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

> - **ONLY** use `aliyun configure list` to check credential status. `scripts/preflight.sh` already does this.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

md

> - **ONLY** use `aliyun configure list` to check credential status. `scripts/preflight.sh` already does this.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 386)May include surrounding context.

md

> - **ONLY** use `aliyun configure list` to check credential status. `scripts/preflight.sh` already does this.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md

SKILL_SESSION_ID={session-id} bash scripts/wait_cs_task.sh --cluster-id c-xxx --region cn-shanghai

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

md

SKILL_SESSION_ID={session-id} bash scripts/wait_cs_task.sh --cluster-id c-xxx --region cn-shanghai

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 386)May include surrounding context.

md

SKILL_SESSION_ID={session-id} bash scripts/wait_cs_task.sh --cluster-id c-xxx --region cn-shanghai

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The same self-k8s gating language creates a repeated risk: operators may satisfy the prompt by pasting sensitive kubeconfig data into chat or logs. In an operational skill with cluster install capabilities, ambiguity around credential intake materially increases the blast radius of accidental exposure.

Content

Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.

md

- **Preflight**: `scripts/preflight.sh` (CLI/plugin/credential/scope). Add `--need-ecs` (ECS) / `--need-cs` (ACK) / `--need-kubectl` (**self_k8s install only**, or opt-in CRD). **Hard-gate only** (CLI / SLS plugin / credentials / ACK `--need-cs`): output `[BLOCKED: PREFLIGHT_FAILED] gate=<gate>; <reason>` and stop. **Adapters are not hard gates:**
  - **ECS:** `run-command` is the only host channel. `--need-ecs` is a warn, not a hard fail. Still run `scripts/render_loongcollector_install_cmd.py`, and **still ask** catalog message `ecs_install` with last line `[AWAITING: INSTALL_CONFIRMATION]`. Never emit `[BLOCKED: PREFLIGHT_FAILED] gate=workbench` / `gate=ecs`. After confirm, use exactly `aliyun ecs run-command --biz-region-id <region> ... --instance-id <id>` and poll with `aliyun ecs describe-invocation-results --biz-region-id <region> --invoke-id <id>`; never use `--instance-id.1`, `--region-id`, or `--region` for these plugin commands. Do **not** use `workbench exec` / `aliyun ecs-workbench` / OOS.
    **ECS post-install fast path:** After a successful invocation result, reuse every user-supplied Project, Logstore, machine-group, and config name verbatim. Do not read helper source, call `--help` for mapped commands, reinstall/update plugins, re-run Preflight, or write `outputs/*` / `ran_scripts/*` before collection approval. Run only the required Observe reads, render/validate/diff calls, then immediately emit the collection approval question. If invocation status is still running, wait and poll as separate tool calls; never combine `sleep` and the poll command.
  - **self_k8s kubectl missing:** this is the **first** stop — before Observe, Plan, values render, or any create-bind question. Ask exactly catalog message `kubeconfig` + `[AWAITING: KUBECONFIG]` and end the turn. **Never** `[BLOCKED: PREFLIGHT_FAILED] gate=kubectl`. Cloud writes / `create-logtail-pipeline-config` are forbidden until kubectl is provided. A refusal or catalog `end` marker → stop; do not 
...[truncated 26 chars]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The same self-k8s gating language creates a repeated risk: operators may satisfy the prompt by pasting sensitive kubeconfig data into chat or logs. In an operational skill with cluster install capabilities, ambiguity around credential intake materially increases the blast radius of accidental exposure.

Content

Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.

md

- **Preflight**: `scripts/preflight.sh` (CLI/plugin/credential/scope). Add `--need-ecs` (ECS) / `--need-cs` (ACK) / `--need-kubectl` (**self_k8s install only**, or opt-in CRD). **Hard-gate only** (CLI / SLS plugin / credentials / ACK `--need-cs`): output `[BLOCKED: PREFLIGHT_FAILED] gate=<gate>; <reason>` and stop. **Adapters are not hard gates:**
  - **ECS:** `run-command` is the only host channel. `--need-ecs` is a warn, not a hard fail. Still run `scripts/render_loongcollector_install_cmd.py`, and **still ask** catalog message `ecs_install` with last line `[AWAITING: INSTALL_CONFIRMATION]`. Never emit `[BLOCKED: PREFLIGHT_FAILED] gate=workbench` / `gate=ecs`. After confirm, use exactly `aliyun ecs run-command --biz-region-id <region> ... --instance-id <id>` and poll with `aliyun ecs describe-invocation-results --biz-region-id <region> --invoke-id <id>`; never use `--instance-id.1`, `--region-id`, or `--region` for these plugin commands. Do **not** use `workbench exec` / `aliyun ecs-workbench` / OOS.
    **ECS post-install fast path:** After a successful invocation result, reuse every user-supplied Project, Logstore, machine-group, and config name verbatim. Do not read helper source, call `--help` for mapped commands, reinstall/update plugins, re-run Preflight, or write `outputs/*` / `ran_scripts/*` before collection approval. Run only the required Observe reads, render/validate/diff calls, then immediately emit the collection approval question. If invocation status is still running, wait and poll as separate tool calls; never combine `sleep` and the poll command.
  - **self_k8s kubectl missing:** this is the **first** stop — before Observe, Plan, values render, or any create-bind question. Ask exactly catalog message `kubeconfig` + `[AWAITING: KUBECONFIG]` and end the turn. **Never** `[BLOCKED: PREFLIGHT_FAILED] gate=kubectl`. Cloud writes / `create-logtail-pipeline-config` are forbidden until kubectl is provided. A refusal or catalog `end` marker → stop; do not 
...[truncated 26 chars]

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The guide instructs users to execute a remote shell script directly via curl piped into bash, which is a classic supply-chain and arbitrary code execution risk. If the remote host, CDN path, TLS trust chain, or script content is compromised, the user would immediately run attacker-controlled code on the local system; in an ops skill that explicitly drives installation steps, this context makes the risk more actionable rather than theoretical.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 10)May include surrounding context.

/bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh)"

text

Routine update when CLI >= 3.3.5 (prefer built-in self-update):
```bash
aliyun upgrade

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 446)May include surrounding context.

md

1. The user explicitly asked for `ClusterAliyunPipelineConfig` / GitOps / `kubectl apply` CR.
2. Environment is ACK or self-built K8s.
3. `kubectl` is on PATH (or the user named a working context).
4. A **reachable** kube-apiserver is proven (see Temporary public KubeConfig below).
5. `kubectl auth can-i create clusteraliyunpipelineconfigs` is `yes`.
6. `kubectl get crd clusteraliyunpipelineconfigs.telemetry.alibabacloud.com` succeeds.
7. `alibaba-log-controller` or `loongcollector-operator` is running.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/crd-pipeline.md (reported line 40)May include surrounding context.

md

1. The user explicitly asked for `ClusterAliyunPipelineConfig` / GitOps / `kubectl apply` CR.
2. Environment is ACK or self-built K8s.
3. `kubectl` is on PATH (or the user named a working context).
4. A **reachable** kube-apiserver is proven (see Temporary public KubeConfig below).
5. `kubectl auth can-i create clusteraliyunpipelineconfigs` is `yes`.
6. `kubectl get crd clusteraliyunpipelineconfigs.telemetry.alibabacloud.com` succeeds.
7. `alibaba-log-controller` or `loongcollector-operator` is running.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/crd-pipeline.md (reported line 49)May include surrounding context.

md

1. The user explicitly asked for `ClusterAliyunPipelineConfig` / GitOps / `kubectl apply` CR.
2. Environment is ACK or self-built K8s.
3. `kubectl` is on PATH (or the user named a working context).
4. A **reachable** kube-apiserver is proven (see Temporary public KubeConfig below).
5. `kubectl auth can-i create clusteraliyunpipelineconfigs` is `yes`.
6. `kubectl get crd clusteraliyunpipelineconfigs.telemetry.alibabacloud.com` succeeds.
7. `alibaba-log-controller` or `loongcollector-operator` is running.

Static analysis

No suspicious patterns detected.