Alibabacloud Network Reachability Analysis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:13 AM UTC
• Version: 0.0.1

Overview

The skill mostly matches its network-diagnostics purpose, but its included setup guide gives unsafe cloud-credential and privileged CLI-install instructions, and its read-only wording understates NIS task creation.

Review before installing. Use a least-privilege RAM role or temporary credentials, do not paste access keys or tokens into an agent session or command line, prefer a trusted package manager or verified pinned CLI download, and confirm whether NIS analysis tasks persist, appear in audit logs, or count against quotas.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/cli-installation-guide.md:85

Finding

Cloud credentials exposed through command-line arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` The guide also presents concrete credential-shaped examples: ```bash aliyun configure set \ --mode AK \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` ### Technical Analysis The installation guide recommends non-interactive command-line flags and repeatedly instructs users to pass Alibaba Cloud access-key secrets and STS tokens as command arguments. Depending on the operating environment, these values can be retained in: - Interactive shell history - CI/CD job definitions and build logs - Terminal recording or audit systems - Process execution telemetry - Debugging and command tracing output - Agent conversation or tool-call records This guidance directly conflicts with the security requirements in `SKILL.md`, lines 65-68, which prohibit asking users to supply access keys directly and prohibit using `aliyun configure set` with literal credential values. An access-key secret or STS token is an authentication credential rather than ordinary configuration data. Passing it through a command line unnecessarily increases the number of systems and users that may be able to observe it. ### Attack Path 1. A user follows the referenced installation guide and substitutes real access-key or STS values into the example command. 2. The shell, CI platform, terminal recorder, or process telemetry captures the complete command. 3. An attacker with access to command history, logs, backups, or monitoring records extracts the crede ...[truncated 912 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:34

Finding

Unverified mutable CLI binary installed into a privileged system path

Content

View full analysis

Remediation

View remediation

' 'aliyun-cli-linux-amd64.tgz' \ | sha256sum --check - ``` 4. Prefer a publisher-signed artifact and verify its signature using a pinned, independently obtained publisher key. 5. Prefer trusted package-manager installation where repository metadata and package signatures are verified. 6. Download to a newly created restricted temporary directory and inspect archive entries before extraction to prevent unsafe paths or unexpected files. 7. Verify the binary before moving it into a system-wide path. Do not treat `aliyun version` as an integrity check because a malicious binary can forge that output. 8. Avoid executing downloaded content with elevated privileges. If administrative installation is necessary, elevate only the final copy operation after verification. 9. Document the expected version and checksum in the Skill so future changes to the remote artifact require an explicit review. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide recommends non-interactive use in scripts, CI/CD, and agent-driven automation while showing secrets passed as command-line arguments. This is dangerous because command-line secrets may be exposed through shell history, process listings, build logs, audit tooling, or captured agent transcripts, especially in multi-user or hosted automation environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill repeatedly represents itself as read-only and states that no resources are created, yet it explicitly instructs use of CreateAndAnalyzeNetworkPath, which creates analysis tasks in Alibaba Cloud NIS. This mismatch can mislead operators, reviewers, or higher-level agents into granting broader trust or skipping change-control for an action that has side effects, even if those side effects are limited to diagnostic task creation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The cleanup section claims no cloud resources are created and therefore no cleanup is required, but the workflow requires CreateAndAnalyzeNetworkPath, which creates analysis artifacts/tasks. Even if these artifacts are transient, denying their existence can cause resource-accounting gaps, quota surprises, or inaccurate security review of the skill's operational footprint.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The quick-start example instructs users to configure long-lived access keys directly, but it does not warn at the point of use that the CLI stores credentials in a local configuration file. In an agent/automation context, this can lead users to persist sensitive credentials on disk without understanding the exposure or applying compensating controls.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting