Alibabacloud Mse Nacos Inspection

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:10 AM UTC
• Version: 0.0.1

Overview

This is a Nacos inspection skill, but its setup path is risky enough for Review because it can change local CLI/plugin state and its reference guide shows unsafe credential handling.

Review the setup steps before installing. Prefer a verified, pinned Aliyun CLI and explicit plugin installs; do not enable broad automatic plugin updates unless you accept that local executable code may change. Do not paste Alibaba Cloud secrets into chat, command lines, or logs, and run the skill with a dedicated least-privilege read-only profile.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:20

Finding

Unverified CLI Downloads and Mandatory Automatic Plugin Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20-23; references/cli-installation-guide.md:24-30, 44-48, 58-62, 72-76, 92-98
Vulnerability Type: Supply-chain execution without artifact integrity verification
Risk Level: High

Vulnerable Code

SKILL.md:20-23:

text

**Pre-check: Aliyun CLI plugin update required**
> [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date.

references/cli-installation-guide.md:44-48:

bash

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install to user-level directory
tar -xzf aliyun-cli-linux-latest-amd64.tgz
mv aliyun ~/.local/bin/

Equivalent unverified installation instructions are provided for macOS, CentOS/RHEL, ARM64 Linux, and Windows.

Technical Analysis

The installation guide downloads mutable latest archives and places the extracted executable in a user-level or system-level executable search path without validating a cryptographic checksum or publisher signature. The Skill also mandates enabling automatic plugin installation and updating all existing plugins.

HTTPS protects the connection in transit under normal conditions, but it does not independently establish that the downloaded artifact is the expected audited release. A compromise involving the distribution CDN, publishing account, plugin repository, DNS resolution, certificate trust chain, or release pipeline could cause a modified binary or plugin to be installed.

The risk is elevated because the CLI is subsequently executed with authenticated Alibaba Cloud access. A malicious replacement could inspect local credential sources, alter API requests and responses, or perform unauthorized actions available to the active identity.

Attack Path

1. An attacker compromises or inf ...[truncated 1481 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the Alibaba Cloud CLI and required plugins to explicitly reviewed versions rather than mutable latest releases.
2. Publish and verify SHA-256 or stronger checksums through an independently authenticated official channel before extracting any archive.
3. Prefer publisher-signed packages and verify the signature and signing identity.
4. Remove the mandatory --auto-plugin-install true instruction. Require explicit user approval before installing or updating executable components.
5. Install only the plugins required for MSE and ARMS rather than updating every installed plugin.
6. Prefer trusted operating-system package managers with signed repository metadata where available.
7. Perform updates before credentials are made available, then run the inspection in a constrained environment with a dedicated least-privilege cloud profile.
8. Document the expected version, checksum, source URL, and verification procedure directly in the installation guide.

T09 · Insecure Skill Coding Practices

Error

• Location: references/cli-installation-guide.md:110

Finding

Alibaba Cloud Secrets Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: references/cli-installation-guide.md:110-118, 136-154, 167-171, 181-185, 267-276, 379, 386-388, 455-458
Vulnerability Type: Insecure credential handling and plaintext secret exposure
Risk Level: High

Vulnerable Code

references/cli-installation-guide.md:110-118:

bash

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

text

All `aliyun configure` commands support non-interactive flags, which is the recommended approach —
it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

references/cli-installation-guide.md:136-140:

bash

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

references/cli-installation-guide.md:167-172:

bash

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

These instructions conflict with SKILL.md:49-52, which explicitly forbids requesting credentials directly or using aliyun configure set with literal credential values.

Technical Analysis

Command-line arguments are not an appropriate secret-delivery mechanism. Literal access-key secrets and STS tokens may be retained or exposed through:

• Interactive shell history
• CI/CD command logs
• Agent execution transcripts
• Terminal recording and monitoring systems
• Process inspection facilities
• Debug logs and error reports
• Wrapper scripts or command auditing systems

Recommending non-interactive secret-bearing flags for scripts, CI/CD pipelines, and agent automation materially increases the likelihood that credentials ...[truncated 1866 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all examples that pass access-key secrets, private keys, or STS tokens directly as command-line arguments.
2. Remove the recommendation to use secret-bearing non-interactive flags in scripts, CI/CD systems, or agent-driven automation.
3. Align the guide with SKILL.md: credential configuration must occur outside the agent session, and the Skill should only use aliyun configure list to confirm that a valid profile exists.
4. Prefer credential mechanisms that do not require long-lived static secrets, including ECS RAM roles, workload identity, OAuth/device authorization, or short-lived role credentials.
5. For CI/CD environments, retrieve short-lived credentials from the platform’s protected secret manager and ensure masking is enabled. Do not interpolate secrets into logged command lines.
6. If an interactive configuration method is required, use a no-echo prompt and explicitly warn that credentials must not be pasted into chat, agent prompts, command history, or source files.
7. Use a dedicated RAM identity with only the documented MSE and ARMS read permissions.
8. Add incident guidance requiring immediate key revocation and rotation if a real credential has already been entered on a command line.
9. Review whether aliyun configure get or debug logging can reveal sensitive configuration, and warn users not to share unredacted output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest says the skill triggers when the user needs to perform a 'health inspection, capacity assessment, or usage check' on MSE Nacos instances, which is broader than a tightly scoped invocation phrase list. Although examples are provided, the activation condition itself remains open-ended and lacks negative examples or explicit exclusion conditions, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 124)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 410)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/verification-method.md (reported line 59)May include surrounding context.

Expected result: Returns details including HttpApiInterUrl (public) and/or HttpApiIntraUrl (internal).

Use curl to test API reachability:

bash

curl -s "${PROMETHEUS_URL}/api/v1/query_range?query=up&start=$(date +%s -d '5 minutes ago')&end=$(date +%s)&step=60s&timeout=10000" --max-time 120

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill claims to perform read-only inspection, but it instructs the operator to enable automatic plugin installation and force plugin updates on the local CLI. That expands execution beyond read-only cloud API calls into local code acquisition and modification, creating a supply-chain and unexpected local state change risk if a plugin source is compromised or an update is malicious or unstable.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest describes batch inspection and usage checking of Nacos instances, but does not mention creating local files. Step 5.3 explicitly adds file-generation behavior by requiring a .md inspection report file, which is a local write side effect beyond the described inspection behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The sample config.json sets "language": "en", which presents a fixed language setting in natural-language-facing configuration. Because the guide does not mention that users may choose another language or that English is only an example, this can be read as forcing a specific locale without opt-in.

Content

No source excerpt is available for this finding.