alibabacloud-mcp-connector

• Outcome: Review
• Latest audit: Sep 9, 2026 · 11:57 AM UTC
• Version: 1.0.0

Overview

This is a coherent Alibaba Cloud management skill, but it needs Review because it combines broad cloud-changing authority with unverified remote installers and dependency execution.

Install only if you trust the publisher and are comfortable granting an agent-assisted workflow access to Alibaba Cloud operations. Use a least-privilege RAM identity, review installer commands before running them, avoid primary-account credentials, and require explicit confirmation for any create, update, delete, Terraform apply, Terraform destroy, or paid operation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:136
• Finding: Unverified Remote Installer Scripts Are Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:136-150`; `scripts/mcpx.py:46-59` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code From `SKILL.md:136-150`: ```bash ### Step 2: install `uv` if missing ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Step 3: install the `aliyun` CLI if missing Most environments do not have it. **macOS / Linux** (auto-detects architecture): ```bash /bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh)" ``` ``` From `scripts/mcpx.py:46-59`: ```python UV_INSTALL_HINT_POSIX = "curl -LsSf https://astral.sh/uv/install.sh | sh" UV_INSTALL_HINT_WINDOWS = ( 'powershell -ExecutionPolicy ByPass -c ' '"irm https://astral.sh/uv/install.ps1 | iex"' ) ALIYUN_INSTALL_HINT_POSIX = ( '/bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 ' 'https://aliyuncli.alicdn.com/setup.sh)"' ) ALIYUN_INSTALL_HINT_WINDOWS = ( 'Invoke-WebRequest -Uri ' '"https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" ' '-OutFile "aliyun-cli.zip"; ' 'Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\\aliyun-cli' ) ``` ### Technical Analysis The POSIX installation instructions pipe mutable network responses directly into `sh` or interpolate them into a Bash command. The Windows UV instruction has the equivalent behavior through `Invoke-RestMethod | Invoke-Expression`. HTTPS and recognizable vendor domains reduce ordinary interception risk, but they do not establish artifact integrity. There is no pinned installer version, checksum, detached signature, certificate/public-key pin, or local review step. Consequently, the effective code executed on a user's system can change after this Skill has been reviewed. Installing the required dependencies is consistent with the Skill's functionality, but direct execution of an unverified response is not the minimum privilege or ...[truncated 1337 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace all `curl | sh`, command-substitution, and `irm | iex` instructions with a staged installation procedure. 2. Download a versioned artifact to a temporary file without executing it. 3. Verify a publisher-provided SHA-256 or stronger digest and, where available, a detached cryptographic signature. 4. Pin the installer or binary to an explicit release rather than a mutable “latest” endpoint. 5. Show the resolved version, source URL, checksum, and destination to the user before installation. 6. Require explicit user approval before any system modification or privilege elevation. 7. Prefer platform package managers with signature validation where supported. 8. For Windows, download the script or archive, verify it, and invoke it without `Invoke-Expression`. 9. Document the expected files, PATH changes, and required privilege level so users can assess the operation. 10. Consider making installation a user-run prerequisite instead of allowing the Agent to execute installation commands automatically. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/mcpx.py:29
• Finding: Runtime MCP Proxy and Transitive Dependencies Are Executed Without Hash-Locked Integrity<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mcpx.py:29-42`; `scripts/mcpx.py:207-218`; `scripts/mcpx.py:462-475` **Vulnerability Type**: Insecure third-party dependency execution **Risk Level**: High ### Vulnerable Code From `scripts/mcpx.py:29-42`: ```python # 钉住包版本而不用 @latest。两个原因: # 1. @latest 会让 uv 每次重新解析 53 个包的依赖树并查询包索引, 实测每次调用 # 多花约 6 秒 (1.1s -> 7s+); 钉版本直接命中已缓存的工具环境。 # 2. @latest 使每次调用都依赖包索引可达。客户环境里包索引不通但阿里云网关 # 通是常见情况, 那会变成一个与业务无关的失败点。 # 注意: 这是 pypi 包版本, 与 serverInfo.version (远端 MCP 服务版本) 无关。 # 15 个工具由远端服务提供, 钉住本地包不会冻结工具集。 # 升级: `uvx --from pip pip index versions alibabacloud.mcp-proxy` 查新版本后改这里。 MCP_PROXY_VERSION = "0.2.17" DEFAULT_SERVER_CMD = ["uvx", "alibabacloud.mcp-proxy@" + MCP_PROXY_VERSION] ``` From `scripts/mcpx.py:207-218`: ```python try: cmd = list(DEFAULT_SERVER_CMD) + ["proxy", "--debug", "--log-file", logpath] try: proc = subprocess.Popen( cmd, stdin=subprocess.PIPE, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, text=False, **spawn_kwargs()) except OSError: return None ``` From `scripts/mcpx.py:462-475`: ```python def start(self): base = server_command() if shutil.which(base[0]) is None: raise McpxError( "找不到可执行文件 %r。\n" "本 SKILL 需要 uv/uvx。安装方式:\n %s" % (base[0], uv_install_hint()) ) cmd = self._build_server_command(base) try: self.proc = subprocess.Popen( cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=False, **spawn_kwargs() ) ``` ### Technical Analysis The direct package version is pinned to `0.2.17`, which is safer than using `latest`. However, the Skill invokes the package through `uvx` without a hash-locked dependency manifest, vendored artifact ...[truncated 2016 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create and commit a lockfile that pins the complete transitive dependency graph. 2. Require hashes for every downloaded wheel or source distribution. 3. Prefer prebuilt, internally mirrored, reviewed artifacts from a controlled repository. 4. Verify package signatures or provenance attestations where the ecosystem supports them. 5. Prevent fallback to untrusted or user-controlled package indexes. 6. Run the proxy in a restricted environment containing only necessary variables and files. 7. Use a dedicated least-privilege Alibaba Cloud RAM identity. 8. Restrict filesystem access through OS sandboxing, containers, or an equivalent isolation mechanism. 9. Separate dependency installation from cloud-operation execution so review and verification occur before credentials are exposed. 10. Document a controlled update process that reviews package and lockfile diffs before changing the pinned version. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: scripts/gen_tool_reference.py:51
• Finding: Mutable Remote Tool Descriptions Can Be Persisted as Authoritative Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gen_tool_reference.py:51-53`; `scripts/gen_tool_reference.py:92-123`; `scripts/gen_tool_reference.py:142-158`; `SKILL.md:264-266` **Vulnerability Type**: Remote instruction injection into Skill reference material **Risk Level**: High ### Vulnerable Code From `scripts/gen_tool_reference.py:51-53`: ```python def fetch_tools(timeout=180.0): with mcpx.McpSession(timeout=timeout) as session: session.initialize() return session.list_tools() ``` From `scripts/gen_tool_reference.py:92-123`: ```python def render(tools): out = [HEADER, ""] out.append("%d tools. You can use the short name; the script auto-prepends the `%s` prefix." % (len(tools), mcpx.TOOL_PREFIX)) out.append("") for tool in tools: full = tool["name"] out.append("### %s" % mcpx.short_name(full)) out.append("") out.append("Full name: `%s`" % full) out.append("") out.append("**Original description:**") out.append("") for para in normalize_cli(tool.get("description") or "").split("\n"): out.append(para) out.append("") schema = tool.get("inputSchema") or {} props = schema.get("properties") or {} required = set(schema.get("required") or []) if not props: out.append("**Parameters:** none") out.append("") continue out.append("**Parameters (descriptions verbatim):**") out.append("") for name in sorted(props, key=lambda n: (n not in required, n)): out.extend(render_param(name, props[name] or {}, required)) out.append("") return "\n".join(out).rstrip() + "\n" ``` From `scripts/gen_tool_reference.py:142-158`: ```python tools = fetch_tools() if not tools: raise SystemExit("未取到任何工具，中止") block = render(tools) if to_stdout: sys.stdout.write(block) return 0 curr ...[truncated 3401 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all remotely retrieved descriptions as untrusted data rather than Agent instructions. 2. Require a human-reviewed diff before updating `references/tool-reference.md`. 3. Pin an expected schema and description digest for each approved server release. 4. Reject or quarantine unexpected behavioral directives, URLs, shell commands, credential instructions, and changes to approval requirements. 5. Store declarative parameter metadata separately from prose instructions. 6. Add an explicit statement in `SKILL.md` that generated remote content cannot override user intent, confirmation rules, credential protections, or higher-priority safety policies. 7. Render remote prose inside a clearly delimited untrusted-data section. 8. Make `--check` the default CI behavior and require an explicit reviewed flag for writes. 9. Record the remote server identity, version, retrieval time, and cryptographic digest alongside generated content. 10. Prevent automated publication or deployment when generated descriptions differ from the reviewed baseline. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill exposes powerful capabilities including shell execution, file read/write, and environment interaction, yet declares no explicit permissions boundary. In a cloud-management skill that can run commands, scripts, and Terraform, this mismatch increases the chance of overbroad invocation and unsafe execution without adequate policy gating.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The skill instructs the agent to use it whenever the user needs to do anything with Alibaba Cloud, which is an extremely broad activation rule for a skill capable of creating, modifying, and deleting cloud resources. Overbroad routing can cause the skill to activate in loosely related contexts and increases the risk of unnecessary privileged operations or unsafe command generation.

Vague Triggers

High

• Confidence: 93% confidence
• Finding: Several triggers are generic enough to overlap with ordinary conversation, especially broad terms like 'documentation', '云资源', and other product acronyms that may arise outside a real admin request. Because the skill can invoke shell commands and cloud-changing operations, accidental triggering materially expands the attack surface.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This example set includes infrastructure-changing operations such as Terraform-based resource creation and presigned upload URL generation, but it does not place a clear safety warning immediately around those examples. In a skill explicitly designed to operate Alibaba Cloud resources, copy-pasteable destructive or billable commands can lead users or downstream agents to make real changes without appreciating cost, persistence, or blast-radius implications.

Unvalidated Output Injection

High

• Category: Output Handling

Content

1. Call AlibabaCloud___GetApiDefinition with product="Ecs", apiVersion="2014-05-26", apiName="DescribeInstances"
2. Review the API definition to understand required parameters
3. Call this tool with appropriate parameters to generate the CLI command
4. Execute the generated command with tool AlibabaCloud___CallCLI


**Parameters (descriptions verbatim):**

• Confidence: 90% confidence
• Finding: The workflow explicitly tells the agent to execute a generated CLI command after reviewing API metadata, but it does not require independent validation that the generated command is safe, read-only, or actually matches user intent. In a skill whose core capability includes creating, modifying, and deleting Alibaba Cloud resources, treating generated output as executable input creates a dangerous output-to-action chain that can lead to unauthorized destructive operations or unintended billable changes.

External Script Fetching

Low

• Category: Supply Chain

Content

EXIT_USAGE = 2
EXIT_TRANSPORT = 3

UV_INSTALL_HINT_POSIX = "curl -LsSf https://astral.sh/uv/install.sh | sh"
UV_INSTALL_HINT_WINDOWS = (
    'powershell -ExecutionPolicy ByPass -c '
    '"irm https://astral.sh/uv/install.ps1 | iex"'

• Confidence: 86% confidence
• Finding: The script embeds and recommends a `curl | sh` installation pattern for `uv`, which executes remote content directly without verification. In a skill designed to operate cloud infrastructure and run local commands, users may copy-paste this advice, creating a supply-chain execution path if the download source, TLS interception, or distribution channel is compromised.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 91% confidence
• Finding: The trigger '运维' is very broad and likely to appear in unrelated operational discussions, causing this high-privilege cloud-management skill to activate too easily. In a skill that can run scripts, IaC, and API-changing commands, overly permissive triggers increase the risk of accidental or adversarial routing into privileged workflows.

Static analysis

No suspicious patterns detected.