alibabacloud-network-diagnose

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 0.0.1

Overview

The skill is mostly a real Alibaba Cloud network diagnosis tool, but it can expose VPN secrets and silently install CLI plugins on the host.

Review before installing. Use only a read-only RAM policy, run it in an environment where saved diagnostic output is protected, and avoid running VPN diagnostics until the PSK field is removed or redacted. Do not allow automatic CLI plugin installation in production; preinstall reviewed, pinned Alibaba Cloud CLI plugins through an administrator-controlled process.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/net_common.py:101

Finding

Automatic Installation of Unpinned Alibaba Cloud CLI Plugins

Content

View full analysis

bool: """Install a missing official CLI plugin once, then let the caller retry.""" plugin_name = f"aliyun-cli-{product}" if plugin_name not in error_text or "plugin" not in error_text.lower(): return False result = _run_subprocess( ["aliyun", "plugin", "install", "--names", plugin_name], max(timeout, 60), ) return result.returncode == 0 ``` The installation function is invoked automatically after a failed plugin-mode request: ```python result = _run_subprocess(plugin_cmd, timeout) plugin_error = result.stderr.strip() or result.stdout.strip() if result.returncode != 0 and _install_required_plugin( product, plugin_error, timeout): result = _run_subprocess(plugin_cmd, timeout) ``` ### Technical Analysis When an Alibaba Cloud CLI plugin is missing, the skill automatically executes `aliyun plugin install` using a dynamically constructed package name. The installation does not specify an exact plugin version or verify a checksum, signature, publisher identity, or immutable package digest. Consequently, the executable code used by the skill can change after the skill itself has been audited. Although the intended packages are official Alibaba Cloud CLI plugins, the trust decision is delegated entirely to the CLI's current package resolution and distribution infrastructure. The plugin is then used immediately to process cloud API operations. This makes the runtime dependency installation part of the skill's effective code-execution chain. The behavior also expands the stated standard-library-only dependency posture by installing additional executable components without explicit ...[truncated 1797 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check-write-operation.sh:14

Finding

Fail-Open and Bypassable Read-Only Command Guard

Content

View full analysis

/dev/null) if [ -z "$COMMAND" ]; then cat << 'EOF' { "safe": true, "reason": "No command was provided." } EOF exit 0 fi ``` ```bash WRITE_PATTERN='aliyun [a-z]+ (Create|Delete|Modify|Update|Enable|Disable|Add|Remove|Attach|Detach|Start|Stop|Reboot|Replace|Grant|Revoke)[A-Za-z]' if echo "$COMMAND" | grep -qE "$WRITE_PATTERN"; then MATCHED_ACTION=$(echo "$COMMAND" | grep -oE "$WRITE_PATTERN" | head -1) IS_WRITE=true DECISION_REASON="Detected write-style aliyun API call (${MATCHED_ACTION})." fi if [ "$IS_WRITE" = true ]; then cat << EOF { "safe": false, "reason": "${DECISION_REASON}" } EOF else cat << 'EOF' { "safe": true, "reason": "No write-style aliyun API call was detected." } EOF fi ``` ### Technical Analysis The command guard uses a regular-expression denylist rather than structurally parsing the command and enforcing an allowlist of approved read-only operations. The validator fails open in several cases: - Malformed JSON causes the Python parser to emit an empty string. - Missing `command` and `input` fields also produce an empty string. - An empty command is explicitly classified as safe. - The expression expects the exact structure `aliyun `. - Lowercase plugin-style actions such as `delete-instance` are not matched. - Executable paths, options placed before the product, alternate capitalization, or unusual whitespace can avoid the pattern. - The denylist cannot reliably cover all present or future mutating ...[truncated 1926 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (32)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description says the skill diagnoses Alibaba Cloud private network connectivity issues across VPC, VPN, CEN, route, SG, ACL, NAT, and related components. The supplied code does not perform any connectivity diagnosis, inspection of cloud networking resources, or troubleshooting logic. Instead, it extracts a command from JSON input and uses a regex to detect whether the command looks like a write-operation aliyun API call, returning a safety decision. That is a materially different primary purpose and an undeclared capability, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says the skill is an Alibaba Cloud private network connectivity diagnosis tool. However, the supplied code chunk does not inspect cloud networking resources, connectivity paths, routing, ACLs, security groups, VPNs, NAT, or any Alibaba Cloud APIs. It only performs a local prerequisite check to find a usable Python interpreter version >= 3.7. That is a materially different primary behavior from the declared end-user purpose. While dependency detection could be a supporting implementation detail in a larger tool, this specific chunk by itself does not implement or reflect the declared diagnostic functionality, so it should be flagged as a mismatch for this code-versus-description check.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad Alibaba Cloud private-network diagnosis tool covering many potential blockers and scenarios across ECS, VPC, cross-VPC, VPN, Express Connect, NAT Gateway, security groups, ACLs, route tables, CEN/TR, peering, and more. The supplied code chunk is much narrower: it only queries and summarizes VPN Gateway / VPN tunnel information and VBR/Express Connect-related status, BGP, and routes. There is no code for security groups, network ACLs, CEN/TR, VPC peering, NAT Gateway, or broad ECS/VPC connectivity analysis. While the implemented functions fit part of the declared scope (VPN Gateway and VBR/Express Connect), the overall description materially overstates the behavior of this code chunk, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a private network connectivity diagnosis tool used to investigate Alibaba Cloud internal networking failures and suspected blocking components. However, the supplied code does not perform diagnosis or access any Alibaba Cloud resources. It simply loads JSON input files containing precomputed analysis/context and renders a textual report with sections like conclusion, check summary, root causes, and recommendations. This is materially narrower and different from the declared primary purpose, so it is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says the skill is a private network connectivity diagnosis tool for Alibaba Cloud networking problems. The supplied code does not diagnose ECS/VPC/VPN/NAT connectivity or inspect cloud network state. Instead, it is a development-time validator for the skill repository itself. Its primary purpose is checking packaging, syntax, read-only compliance, and eval metadata. That is a materially different function from the declared operational troubleshooting purpose, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.

md

| VPC permissions missing | Skip route/ACL checks, ECS/security group only |
| CBN permissions missing | Skip CEN checks |
| Only single-endpoint info | Diagnose known endpoint only |
| Protocol/port unspecified | Display full rule tables |
| Region uncertain | Try cn-hangzhou/shanghai/beijing/shenzhen/chengdu in sequence |
| Script timeout/error | The wrapper already retried and tried the supported CLI fallback. Preserve the JSON error, continue independent script checks, and report the failed step. Never use direct `aliyun` or manual JSON. |

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/net_common.py (reported line 439)May include surrounding context.

python

TOOL_INSTALL_GUIDES = {
    "aliyun": {
        "darwin": "brew install aliyun-cli\n或访问: https://help.aliyun.com/document_detail/139508.html",
        "linux": "curl -fsSL https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz && sudo mv aliyun /usr/local/bin/",
        "win32": "访问: https://help.aliyun.com/document_detail/139508.html",
    },
}

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/net_ecs.py (reported line 343)May include surrounding context.

python

target_proto = target_proto.upper()
    if rule_proto == "ALL" or target_proto == "ALL" or not target_proto:
        return True
    return rule_proto == target_proto


def check_security_group_rules(sg_rules: dict, direction: str,

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The tool includes and prints the VPN tunnel pre-shared key (Psk) as part of diagnostic output. A connectivity diagnosis skill does not need to disclose shared secrets to the caller, and exposing PSKs can enable unauthorized VPN impersonation, lateral access, or compromise of connected environments if output is logged, shared, or viewed by low-privilege users.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs the agent to invoke shell commands and Python scripts, read and write files under ./output, and rely on environment credentials, but it does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch weakens least-privilege controls and can cause the runtime to grant broader capabilities than users or reviewers expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This instruction forces output in a specific language for cross-region CEN diagnoses regardless of the user's preferred language. That is a natural-language policy concern because the skill does not provide opt-in, fallback wording, or any documented locale-specific justification for requiring Chinese output.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 18)May include surrounding context.

bash

curl -fsSL https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz
sudo mv aliyun /usr/local/bin/

Configure Credentials

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python code emits user-facing summaries, errors, help text, and diagnostic suggestions entirely in Chinese across the CLI and result payloads. Under the policy, forcing a specific language without offering a language choice or documenting a justified locale restriction is a natural-language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/net_common.py (reported line 10)May include surrounding context.

python

_alternatives = []
    for _cmd in ("python3.13", "python3.12", "python3.11", "python3.10", "python3.9", "python3.8"):
        try:
            _r = _sp.Popen([_cmd, "--version"], stdout=_sp.PIPE, stderr=_sp.PIPE)
            _out, _ = _r.communicate(timeout=5)
            if _r.returncode == 0:
                _alternatives.append("%s (%s)" % (_cmd, _out.decode().strip()))

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The version-check failure output is hard-coded in Chinese, which imposes a specific language on users regardless of their locale. The file also contains other Chinese-only CLI descriptions and workflow prompts, with no opt-in, fallback, or documented region-specific justification.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/net_common.py (reported line 98)May include surrounding context.

python

def _run_subprocess(cmd: list, timeout: int):
    return subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)


def _install_required_plugin(product: str, error_text: str, timeout: int) -> bool:

Tainted flow: 'cmd' from os.environ.get (line 210, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/net_common.py (reported line 98)May include surrounding context.

python

def _run_subprocess(cmd: list, timeout: int):
    return subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)


def _install_required_plugin(product: str, error_text: str, timeout: int) -> bool:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill can automatically install Alibaba Cloud CLI plugins on the host when a plugin is missing. A diagnosis-only skill should not mutate the host environment or fetch and install code at runtime, because this expands the trust boundary to external package sources and creates supply-chain and persistence risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User-facing required-action text, installation guidance, and argparse descriptions are presented only in Chinese. Under the language/locale policy, forcing one language without offering user choice or documenting a justified locale restriction is a policy violation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/net_common.py (reported line 439)May include surrounding context.

python

TOOL_INSTALL_GUIDES = {
    "aliyun": {
        "darwin": "brew install aliyun-cli\n或访问: https://help.aliyun.com/document_detail/139508.html",
        "linux": "curl -fsSL https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz && sudo mv aliyun /usr/local/bin/",
        "win32": "访问: https://help.aliyun.com/document_detail/139508.html",
    },
}

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This Python file contains user-visible status and error strings in Chinese, beginning at L0063 and repeated throughout the CLI flow. Because the skill does not offer locale selection or state that it is intentionally China/Chinese-specific, it effectively forces a specific language on users, which matches the natural-language locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script performs cloud control-plane queries and emits detailed VPN/VBR configuration, including tunnel status, peer identifiers, gateway IPs, routing data, and in one path even PSKs, directly to stdout as formatted JSON. In the context of a network-diagnosis skill, this broad disclosure increases exposure of sensitive infrastructure topology and can leak into terminal history, logs, transcripts, or downstream tools without any warning or minimization.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code hard-codes user-facing status labels in Chinese, and the rest of the report content is also emitted in Chinese. For a general-purpose reporting skill, forcing a specific language without opt-in or documented locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The generated report title and metadata labels are fixed in Chinese, and similar hard-coded Chinese strings appear throughout the file. Because the skill does not expose a language choice or justify a China-specific locale restriction, it violates the language/locale policy guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This Python file contains multiple natural-language strings returned to users in Chinese, such as the route-match details text. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and this file provides no mechanism to select another language or any justification that it is region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.