ClawHub
Back to skill

Security audit

Alibabacloud Network Eip Associate

Security checks for vulnerabilities and agentic risk

Overview

The skill's main EIP workflow is mostly coherent, but it needs Review because it requires unsafe CLI/plugin installation steps and linked references broaden into higher-impact cloud creation and deletion.

Install only after reviewing the CLI setup steps. Prefer a verified package-manager install or pinned signed release, do not pipe remote scripts to bash, do not enable automatic plugin installation unless you accept that persistent environment change, and use tightly scoped RAM credentials. Treat linked acceptance and related API references as unsafe for production unless stripped down to EIP-only operations with explicit confirmation before any release or deletion.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:30
Finding

Unverified Remote Installation Script Executed Directly by Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:30-32
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code

bash
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.

Technical Analysis

The installation instruction downloads the current response from an external URL and passes it directly to Bash. The script is not pinned to a reviewed version, saved for inspection, or validated with a publisher signature or cryptographic checksum.

HTTPS protects transport under ordinary conditions, but it does not protect against compromise of the CDN, origin server, DNS or certificate infrastructure, nor against an authorized upstream change that occurs after this Skill has been audited. The effective code executed by the Skill can therefore change without any modification to the audited repository.

Installing the required CLI is relevant to the declared functionality, but executing an unverified remote script is not the minimum privilege or trust necessary to accomplish that installation.

Attack Path

  1. An attacker compromises the remote server, CDN delivery path, or publishing credentials used for setup.sh.
  2. The attacker replaces or modifies the installation script with a malicious payload.
  3. A user or Agent follows the Skill's pre-check instructions.
  4. curl retrieves the modified response and streams it directly to Bash.
  5. The payload executes with all permissions of the invoking account.
  6. The payload can access local files and cloud credentials, alter installed tools, or establish persistence before invoking a legitimate-looking installer.

Impact Assessment

Successful exploitation provides arbitrary code execution with the invoking ...[truncated 333 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation path.
  • Prefer an authenticated operating-system package manager with a pinned release.
  • If direct download is necessary, use an exact versioned URL rather than a mutable setup script or latest artifact.
  • Download the artifact to disk without executing it.
  • Verify a publisher-provided digital signature and a pinned SHA-256 or stronger digest.
  • Inspect the downloaded artifact before installation.
  • Request explicit user approval before executing an installer.
  • Do not run the installer with elevated privileges unless system-wide installation is necessary and separately approved.

T08 · Insecure Dependencies

Error
Location
SKILL.md:34
Finding

Mandatory Automatic Plugin Installation and Unpinned Updates

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:34-42
Vulnerability Type: Mutable and automatically installed dependencies
Risk Level: High

Vulnerable Code

bash
**Pre-check: Aliyun CLI plugin update required**
> [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date.

```bash
aliyun configure set --auto-plugin-install true
CLI_VERSION=$(aliyun version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
[ "$(printf '%s\n' "3.3.3" "$CLI_VERSION" | sort -V | head -n1)" != "3.3.3" ] && echo "❌ CLI < 3.3.3" && exit 1
aliyun plugin update
text

### Technical Analysis

The Skill requires automatic plugin installation and forces all existing plugins to update before cloud operations. It does not provide an allowlist of required plugins, pin plugin versions, or require signature and checksum verification.

This makes the execution environment non-reproducible: code reviewed during the audit may differ from code installed when the Skill runs. Updating all existing plugins also exceeds the minimum dependency scope because the declared EIP workflow needs only the relevant Alibaba Cloud product plugins, not every plugin already present in the user's environment.

The plugins execute in a context with access to configured Alibaba Cloud credentials and receive parameters for cloud-management operations.

### Attack Path

1. An attacker compromises the plugin repository, plugin publishing account, update metadata, or a plugin release.
2. The Skill enables automatic plugin installation and mandates `aliyun plugin update`.
3. The compromised plugin is downloaded or an existing plugin is replaced.
4. A subsequent `aliyun` product command loads or executes the malicious plugin.
5. The plugin reads accessible credentials or modifies c
...[truncated 484 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not enable automatic plugin installation by default.
  • Remove the mandatory update of every installed plugin.
  • Define an explicit allowlist containing only plugins required for the selected resource type.
  • Pin each plugin to a tested version.
  • Verify publisher signatures and cryptographic checksums before installation.
  • Present the exact plugin names and versions to the user and obtain approval before installation or update.
  • Perform updates as a separate maintenance action rather than as a mandatory precondition for every Skill invocation.

T08 · Insecure Dependencies

Error
Location
references/cli-installation-guide.md:39
Finding

Mutable CLI Binary Installed into System PATH Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: references/cli-installation-guide.md:39-45
Additional Locations: references/cli-installation-guide.md:22-30, 52-58, 65-71, 77-88
Vulnerability Type: Unverified binary dependency installation
Risk Level: High

Vulnerable Code

bash
**Debian/Ubuntu**
```bash
# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/
text

Equivalent unverified download and installation patterns are documented for macOS, CentOS/RHEL, ARM64 Linux, and Windows.

### Technical Analysis

The guide downloads a mutable artifact identified as `latest`, extracts it without checking its contents or integrity, and moves the executable into `/usr/local/bin` with elevated privileges. No expected digest, detached signature, signing-key verification, or exact release version is supplied.

Placing an executable in a system-wide PATH increases the impact beyond the current Skill run. A substituted binary can impersonate the legitimate `aliyun` tool whenever any user or automation subsequently invokes it. Because the CLI handles cloud credentials and authenticated API calls, it is a particularly sensitive supply-chain target.

### Attack Path

1. An attacker compromises the artifact origin, CDN, release process, or publishing account.
2. The mutable `latest` archive is replaced with an archive containing a trojanized `aliyun` executable.
3. The user downloads and extracts the archive without verification.
4. `sudo mv` installs the trojanized executable into `/usr/local/bin`.
5. Future calls to `aliyun` execute the attacker's binary.
6. The binary captures credentials, alters API requests, falsifies output, or executes additional local payloads.

### Impact Assessment

The immediate impact includes arbitrary execution under the user invoking the CLI and expos
...[truncated 262 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace latest URLs with exact, immutable release versions.
  • Publish and document expected SHA-256 or stronger hashes.
  • Require verification of a detached signature against a pinned publisher key.
  • Inspect archive paths and contents before extraction.
  • Prefer a trusted package manager that verifies package metadata and signatures.
  • Install into a user-controlled directory when system-wide installation is unnecessary.
  • Require explicit approval before using sudo.
  • Verify the installed executable's digest and version after installation.

T09 · Insecure Skill Coding Practices

Warning
Location
references/cli-installation-guide.md:103
Finding

Long-Lived Cloud Credentials Passed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: references/cli-installation-guide.md:103-108
Additional Locations: references/cli-installation-guide.md:129-134, 160-166, 175-181, 260-271, 371-382, 449-452
Vulnerability Type: Sensitive credential exposure
Risk Level: Medium

Vulnerable Code

bash
aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

Technical Analysis

The guide recommends placing the AccessKey ID and AccessKey secret directly in command-line arguments. Depending on the operating system, shell, automation environment, and logging configuration, these values may be retained in shell history, visible in process inspection, captured in terminal transcripts, or written into CI/CD and Agent logs.

The examples use placeholders rather than embedded real credentials, so the repository itself does not contain a confirmed secret. The vulnerability arises when users substitute operational credentials as instructed.

The guide also documents environment-variable credentials. While preferable to literal command arguments in some contexts, environment variables can still leak through debug output, process environments, crash reports, or CI logs and should not be presented as the strongest protection for long-lived credentials.

Attack Path

  1. A user substitutes real AccessKey credentials into the documented command.
  2. The shell records the command in history, or an automation platform records it in logs.
  3. A local user, support operator, log reader, or compromised process obtains the secret.
  4. The attacker configures a separate Alibaba Cloud client with the stolen credential.
  5. The attacker invokes any APIs permitted by the associated RAM identity until the key is disabled or rotated.

Impact Assessment

The attacker obtains the cloud privileges granted to the com ...[truncated 275 chars]

Remediation
View remediation

Remediation Suggestions

  • Prefer ECS RAM roles, workload identity, or another credential provider that does not require static secrets.
  • Prefer short-lived STS credentials over long-lived AccessKeys.
  • Use an interactive secret input mechanism that does not echo or retain the secret in shell history.
  • If a protected credential file is necessary, enforce restrictive permissions such as mode 0600.
  • Disable command tracing and redact secrets in CI/CD and Agent logs.
  • Do not include real secrets in terminal transcripts, tickets, or prompts.
  • Document immediate key revocation and rotation procedures for suspected exposure.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
references/acceptance-criteria.md:166
Finding

Referenced Acceptance Workflow Includes Out-of-Scope Infrastructure Deletion

Content
View full analysis

Vulnerability Details

File Location: references/acceptance-criteria.md:166-174
Additional Locations: references/acceptance-criteria.md:20-48; references/related-apis.md:7-31
Vulnerability Type: Least-privilege and declared-scope conflict
Risk Level: Medium

Vulnerable Code

text
## Cleanup Checks

- [ ] All EIPs disassociated
- [ ] All EIPs released
- [ ] ALB instance deleted
- [ ] NAT Gateway deleted
- [ ] ECS instance deleted
- [ ] Security Group deleted
- [ ] VSwitch deleted
- [ ] VPC deleted (if created in this session)

The same document also lists commands for creating and deleting VPCs, VSwitches, NAT gateways, ECS instances, security groups, and ALBs. references/related-apis.md similarly describes these APIs as commands involved in the scenario.

Technical Analysis

These reference instructions conflict with the controlling workflow in SKILL.md, which states that the Skill operates on existing resources, performs no ECS, NAT, or VPC creation, and only releases newly allocated EIPs after user confirmation.

The main RAM policy does not grant the unrelated infrastructure creation and deletion permissions, and the primary workflow does not execute these commands. Nevertheless, the reference files are part of the Skill and may be interpreted by an Agent as operative acceptance requirements. Phrases such as “all EIPs released” also conflict with the main workflow's rule never to release a user's pre-existing EIP.

This ambiguity can cause privilege expansion or destructive cleanup beyond the minimum permissions required for EIP association.

Attack Path

  1. An Agent loads the Skill and consults the linked acceptance criteria or related API reference.
  2. The Agent interprets the listed creation and cleanup checks as required workflow steps.
  3. The Agent requests or uses permissions for VPC, VSwitch, ECS, NAT, ALB, and security-group creation or deletion.
  4. Te ...[truncated 711 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove all unrelated infrastructure creation and deletion commands from this Skill's references.
  • Rewrite acceptance criteria to cover only EIP allocation, selection, association, verification, and consent-based cleanup.
  • State explicitly that pre-existing EIPs and target resources must never be deleted.
  • Track ownership of every resource created during the current invocation.
  • Permit release only when the EIP was created by the current invocation and the user explicitly confirms the exact Allocation ID.
  • Keep the RAM policy limited to the documented EIP operations and conditional read-only validation actions.
  • If broader integration tests are needed, move them into a separate test-only document clearly marked as non-executable and requiring an isolated test account.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (40)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation claims there is 'No resource creation,' but the workflow explicitly allocates new EIPs. This is a dangerous mismatch because operators may approve or invoke the skill assuming it is non-creating, while it can actually create billable internet-exposed resources and alter cloud posture.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The skill instructs the user/agent to execute a remote script via 'curl ... | bash' directly from the network. This bypasses integrity verification and turns a documentation/precheck step into arbitrary code execution risk if the distribution endpoint, network path, or fetched script is compromised.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.

**Pre-check: Aliyun CLI plugin update required**

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 489)May include surrounding context.

md
| [references/acceptance-criteria.md](references/acceptance-criteria.md) | Acceptance test criteria |

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill states it will only operate on user-provided resource IDs, but later instructs the agent to enumerate all available EIPs in a region for user selection. That creates broader-than-declared read access and may expose inventory details about unrelated cloud resources, violating least-privilege and the skill’s own safety boundary.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 389)May include surrounding context.

Possible causes: Resource not exist, already has EIP bound, wrong state, invalid parameters. Cleaning up...

text
**Trigger cleanup (Phase 5).** Do NOT retry indefinitely. Fail fast and cleanup.
## Phase 4: Verify Binding
### Step 4.1: Query EIP status to confirm binding
Wait briefly (5 seconds), then query:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The acceptance criteria broaden the skill from EIP allocation/association into creating and deleting VPC, VSwitch, and NAT Gateway resources. This scope expansion increases blast radius, can incur unexpected cost, and may let an agent perform infrastructure changes the user did not intend when invoking an EIP-focused skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Requiring ECS security group creation, instance launch, and instance deletion extends the skill beyond EIP binding into compute provisioning. In practice this could trigger unintended instance deployment or teardown, with billing and availability consequences disproportionate to an EIP-association request.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The ALB criteria require creating, modifying, and deleting load balancers even though the skill is described as EIP-only. That mismatch can cause an agent to manage higher-impact resources outside expected scope, increasing operational risk and chance of accidental service disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document instructs creation and deletion of billable and potentially service-affecting cloud resources without explicit warnings about cost, downtime, or irreversible effects. In an agent context, omission of these warnings makes unsafe automation more likely because destructive actions may proceed without informed user confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation includes unbind and release EIP commands that can immediately disrupt externally reachable services and, in the case of release, relinquish a public IP resource that may be difficult or impossible to recover. In an agent skill context, presenting destructive commands without explicit warnings, confirmation requirements, or rollback guidance increases the chance of accidental operational outages.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide shows long-lived access keys passed directly on the command line and recommends non-interactive automation, but omits warnings that secrets may be exposed via shell history, process arguments, audit trails, or CI logs. In an automation-oriented skill, this is a practical secret-handling weakness that can leak cloud credentials to other users or systems.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md
1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This installation guide expands from an EIP-association skill into broad Alibaba Cloud authentication and multi-mode access configuration, including credentials, role modes, and general ECS usage. In an agent skill context, overbroad operational guidance increases the chance the agent or operator provisions capabilities unrelated to the declared scope, undermining least privilege and making misuse of cloud access more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document includes an example config file storing raw access keys at rest without clearly warning that the file is sensitive credential material. Users may copy this pattern into insecure environments, back it up broadly, or commit it accidentally, exposing persistent cloud credentials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation promotes cross-account and elevated role assumption modes for a skill whose declared function is only EIP association. Encouraging RamRoleArn usage without narrowly constraining allowed actions can enable privilege escalation or access to resources outside the intended account and service boundary.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash
# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The guide recommends or references broad permissions such as full ECS access while troubleshooting, which is inconsistent with the limited permissions needed for EIP tasks. This can lead operators to overprovision credentials, making accidental or malicious misuse significantly more damaging.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The guide instructs users to install arbitrary product plugins and explore unrelated services such as ECS and FC, which exceeds the stated EIP-only purpose of the skill. That scope creep increases the blast radius of any granted credentials and may normalize broader cloud access than necessary for the task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file lists resource-creating and resource-deleting cloud operations without warning that these actions can be destructive, incur charges, or affect production connectivity. In an agentic workflow, omission of such cautions makes it more likely that a model will treat these operations as routine steps and execute them without appropriate confirmation or environment checks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document expands an EIP-focused skill into broader infrastructure lifecycle actions such as creating and deleting VPCs, VSwitches, ECS instances, NAT gateways, security groups, and ALBs. In an agent setting, this scope creep can cause the model to propose or invoke unnecessary privileged operations, increasing the chance of destructive changes, unexpected spend, and violation of least-privilege expectations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 486)May include surrounding context.

md
| API | Documentation |
|-----|---------------|
| AllocateEipAddress | https://api.aliyun.com/document/Vpc/2016-04-28/AllocateEipAddress |
| AssociateEipAddress | https://api.aliyun.com/document/Vpc/2016-04-28/AssociateEipAddress |
| UnassociateEipAddress | https://api.aliyun.com/document/Vpc/2016-04-28/UnassociateEipAddress |
| ReleaseEipAddress | https://api.aliyun.com/document/Vpc/2016-04-28/ReleaseEipAddress |