Alibabacloud Network Ga Deploy Acceleration

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:14 AM UTC
• Version: 0.0.1-beta.1

Overview

The skill largely matches its Alibaba Cloud GA deployment purpose, but its CLI installation and credential guidance creates real risk around unpinned executable/plugin installation and possible credential exposure.

Install only if you are comfortable auditing the Aliyun CLI source and plugin installation path yourself. Prefer a trusted package manager or verified pinned release, disable automatic plugin installation unless needed, configure credentials outside the agent session, avoid putting secrets in command-line arguments, and use a least-privilege RAM role or user limited to the intended GA resources.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/cli-installation-guide.md:41

Finding

Unverified Mutable CLI Binaries and Automatically Installed Plugins

Content

View full analysis

Remediation

View remediation

aliyun-cli-linux-amd64.tgz" | sha256sum --check - ``` 4. Prefer vendor-provided digital signature verification when signing keys and signatures are available. 5. Document the trusted source and expected signing-key fingerprint. 6. Disable automatic plugin installation by default. 7. Pin required plugin names and versions, and require explicit user approval before installing them. 8. Verify plugin checksums or signatures before loading them. 9. Prefer a trusted operating-system package manager with repository signature validation where available. 10. Avoid immediately placing an unverified executable in a system-wide path with `sudo`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:104

Finding

Alibaba Cloud Credentials Exposed Through Command-Line Arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` ```markdown All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` The same pattern is repeated for long-lived access keys, STS credentials, multiple profiles, credential rotation, and expired-token recovery. For example: ```bash aliyun configure set --mode StsToken \ --access-key-id XXXX --access-key-secret XXXX \ --sts-token XXXX --region cn-hangzhou ``` ### Technical Analysis The guide recommends placing access-key IDs, access-key secrets, and STS tokens directly in command-line arguments. When users replace the placeholders with real values, those secrets may be exposed through: - Shell history files. - Process-list or process-inspection interfaces available to other local users or monitoring agents. - CI/CD command logs. - Terminal recording and session transcripts. - Agent-generated command histories. - Debugging, auditing, or observability systems that capture process arguments. This guidance conflicts with the safer credential rules in `SKILL.md:88-100`, which prohibit asking users to enter AK/SK values directly in the conversation or command line and prohibit using `aliyun configure set` with literal credential values. The examples do not contain actual committed credentials. Exploitation becomes possible when a user follows the instructions and substitutes valid secrets. ### Attack Path 1. A user follows the insta ...[truncated 1395 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose says this skill deploys Alibaba Cloud Global Accelerator acceleration services. However, the code only implements a command-line UDP RTT test tool. It accepts destination IP/port and packet parameters, sends random UDP payloads, listens for matching replies, and prints timing and packet-loss statistics. There is no Alibaba Cloud SDK usage, no API calls, no deployment logic, no resource configuration, and nothing specific to Global Accelerator. This is a clear material mismatch in primary purpose and capabilities.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements a generic UDP ping/probing utility rather than functionality for deploying or configuring Alibaba Cloud Global Accelerator resources. In a deployment skill, unexplained network-scanning capability is dangerous because it enables arbitrary outbound probing of user-supplied hosts and ports, creating dual-use behavior inconsistent with the declared purpose and increasing the risk of misuse or hidden reconnaissance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Including the generic trigger phrase "GA" makes accidental invocation much more likely because it can match many unrelated user intents, including non-Alibaba contexts or ordinary abbreviations. In an execution-capable skill that can create cloud resources and incur charges, unintended activation increases the risk of unnecessary privileged actions or misleading workflow steering.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

md

|      actual usage and provides better cost-effectiveness and elastic scaling.
  |      To continue, please switch the billing mode to pay-as-you-go + CDT and re-confirm the configuration."
  |   - DO NOT proceed to ask for execution confirmation; return to Step 4 for user to adjust parameters
  |-- DO NOT proceed to execute any commands until the user explicitly confirms
  |-- Present all information from Step 6 and ask the user: "Please confirm to proceed with execution"
  +-- Only after receiving explicit user confirmation (e.g., "确认", "执行", "proceed", "yes"), move to Step 8
      |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill is described as deploying Alibaba Cloud Global Accelerator services, but this file provides a general-purpose Aliyun CLI authentication and profile management guide covering all CLI auth modes, reusable credentials, and cross-account role access. That behavior/documentation materially exceeds GA-specific deployment guidance and broadens the skill from GA setup into general cloud account configuration.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Several sections discuss non-GA service usage, such as ECS-specific roles, ECS read-only/full-access examples, ECS metadata, and custom ECS endpoints. For a skill whose stated purpose is deploying Global Accelerator, documenting cross-service access patterns and permissions is broader than the manifest suggests.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

Before generating CLI commands, retrieve API parameter definitions via the following URL to verify accuracy:

text

https://api.aliyun.com/meta/v1/products/GA/versions/2019-11-20/apis/{api_name}/api.json

3.2 Common Parameter Description

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 411)May include surrounding context.

Before generating CLI commands, retrieve API parameter definitions via the following URL to verify accuracy:

text

https://api.aliyun.com/meta/v1/products/GA/versions/2019-11-20/apis/{api_name}/api.json

3.2 Common Parameter Description

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/related-apis.md (reported line 87)May include surrounding context.

Before generating CLI commands, retrieve API parameter definitions via the following URL to verify accuracy:

text

https://api.aliyun.com/meta/v1/products/GA/versions/2019-11-20/apis/{api_name}/api.json

3.2 Common Parameter Description

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file documents creation, modification, and deletion commands for GA resources, including billable actions such as CreateAccelerator with AutoPay enabled and destructive actions such as DeleteAccelerator/DeleteListener/DeleteEndpointGroup, but it provides no explicit warning, confirmation guidance, or cost/irreversibility notice. In an agent skill context, these examples can be operationalized directly by an LLM or user with minimal scrutiny, increasing the risk of unintended resource creation, service disruption, or unexpected charges.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script accepts arbitrary destination IP/hostname and port values and continuously sends UDP payloads, effectively providing a flexible network probing tool. Although not an exploit by itself, this capability can be abused for unauthorized reconnaissance or traffic generation, and it is especially suspicious because the surrounding skill is supposed to deploy GA services, not perform arbitrary packet-level testing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The sample configuration sets "language": "en", which is a natural-language locale choice embedded in the guide. Because the document does not offer an alternative or explain why English is required, it can be read as prescribing a fixed language setting without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file says the verification command aliyun ga ListAccelerateAreas should return a JSON array of regions, but the shown sample contains RegionEndpoint values pointing to ECS endpoints like ecs.cn-hangzhou.aliyuncs.com. That example output contradicts the documented intent of verifying GA accelerate areas and appears to describe a different service's response.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.