Alibabacloud Odps Cost Analysis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:56 AM UTC
• Version: 0.0.1

Overview

This skill mostly matches MaxCompute cost analysis, but its setup can run remote code and broadly change local Alibaba Cloud tooling.

Review before installing. Use a trusted, verifiable Aliyun CLI installation method instead of piping a downloaded script into bash, avoid automatic updates of unrelated plugins, and use a dedicated least-privilege RAM user or short-lived STS profile for MaxCompute read/summary actions. Avoid entering long-lived access keys directly on command lines or enabling debug logs where history or logs are retained.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:31

Finding

Mutable Remote Installation Script Is Executed Directly Through a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-34
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code:

markdown

**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.

Technical Analysis

The Skill instructs the Agent to download a mutable shell script from an external URL and pipe it directly into bash. The downloaded content is executed before the user or Agent can inspect it. No fixed version, expected SHA-256 checksum, cryptographic signature, or authenticated release manifest is specified.

The domain appears related to Alibaba Cloud, but domain reputation alone does not establish the integrity of content that may change after this Skill has been reviewed. Compromise of the hosting infrastructure, CDN, publishing account, DNS/TLS trust chain, or installation script could therefore transform an apparently legitimate prerequisite step into arbitrary local code execution.

Installing or updating Aliyun CLI may be necessary for the declared cost-analysis functionality, but immediate pipe-to-shell execution is not the minimum-risk installation mechanism. The project already provides manual package and binary installation alternatives, making this unsafe execution method unnecessary.

Attack Path

1. A user invokes the Skill for MaxCompute cost analysis.
2. The Agent determines that Aliyun CLI is absent or older than the required version.
3. Following the Skill instructions, the Agent requests https://aliyuncli.alicdn.com/setup.sh.
4. The response body is passed directly to bash without inspection or integrity verification.
5. If the remote response has been maliciously altered, arbitrary shell comman ...[truncated 1258 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl ... | bash instruction entirely.
2. Prefer an operating-system package manager with a trusted repository, such as a pinned Homebrew package version where supported.
3. If direct binary installation is required:
   • Download a versioned artifact rather than a mutable latest URL.
   • Download the checksum and signature separately.
   • Validate the publisher's cryptographic signature.
   • Compare the artifact against a documented SHA-256 checksum.
   • Abort installation if verification fails.
4. Separate download and execution into distinct, user-visible steps so the artifact can be inspected before use.
5. Require explicit user consent before installing or replacing host-level software.
6. Perform installation using the least-privileged account possible and elevate only for the narrowly required file operation.
7. Document the exact supported CLI version and trusted release source to make the installed payload reproducible and auditable.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36

Finding

Mandatory Unscoped Plugin Update Modifies Unrelated Local Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 36
Vulnerability Type: Unpinned and unnecessarily broad dependency update
Risk Level: Medium

Vulnerable Code:

markdown

> Then [MUST] run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

Technical Analysis

The mandatory aliyun plugin update command updates all applicable plugins already installed on the user's machine rather than limiting changes to the MaxCompute plugin required by this Skill. This exceeds the minimum dependency scope needed for MaxCompute cost analysis.

The instruction does not pin a plugin version or require checksum, signature, or provenance verification. Consequently, execution depends on mutable upstream plugin releases that may differ from those reviewed or previously trusted. Updating unrelated plugins also expands the supply-chain attack surface and can introduce compatibility changes outside the Skill's declared functionality.

This finding concerns unsafe dependency management rather than evidence that the current plugin repository is malicious. Exploitation requires an upstream plugin release, distribution channel, or publishing account to be compromised or otherwise serve harmful content.

Attack Path

1. A user invokes the Skill.
2. The Agent follows the mandatory prerequisite and runs aliyun plugin update.
3. The CLI contacts its configured plugin source and retrieves current plugin releases.
4. All eligible installed plugins may be changed, including plugins unrelated to MaxCompute cost analysis.
5. If an upstream artifact or publishing channel is compromised, malicious plugin code is installed locally.
6. The altered plugin may execute during a later CLI invocation under the user's environment and authenticated CLI context.

Impact Assessment

Potential impact includes:

• Execution of compromised plugin code with the current user's pri ...[truncated 649 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the global update with a command scoped exclusively to the required MaxCompute plugin.
2. Pin the MaxCompute plugin to a tested and documented version compatible with the required API version.
3. Verify plugin integrity and publisher provenance before installation or update.
4. Do not automatically modify unrelated plugins already present on the host.
5. Ask for explicit user approval before changing locally installed tooling.
6. Prefer an isolated execution environment or dedicated CLI profile so dependency changes cannot affect unrelated workloads.
7. If automatic updates are unavoidable, record the resolved plugin version and integrity metadata in the audit output for reproducibility.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (15)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill contains a concrete curl -fsSL ... | bash command that fetches and immediately executes a remote script. If the hosting endpoint, transport, CDN path, or upstream script is compromised, the user or agent may execute attacker-controlled code on the local system with the current user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.
>
> Then [MUST] run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs users to install or update software by piping a remotely fetched script directly into bash. This creates a supply-chain and arbitrary code execution risk because the fetched content is executed without prior verification, integrity checking, or user review, and the skill frames it as a required remediation path.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

md

> **CRITICAL: Never do these:**
> 1. **NEVER** read/echo AK/SK values
> 2. **NEVER** use hardcoded values — always ask user for parameters
> 3. **NEVER** execute ANY command without `--user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-cost-analysis`
> 4. **NEVER** skip asking for RegionId
> 5. **NEVER** assume a default region
> 6. **NEVER** query time ranges exceeding 31 days in a single request

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This guide is much broader than the stated MaxCompute cost-analysis purpose and enables general Alibaba Cloud administration workflows. In an agent skill context, expansive operational guidance increases the chance the agent or user will perform unrelated cloud actions with powerful credentials, widening the attack surface beyond read-only billing analysis.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Advertising support for all published product plugins encourages arbitrary service expansion unrelated to MaxCompute cost analysis. In an agent skill, this increases the likelihood of capability creep, where a billing-focused workflow gains access to or attempts operations across unrelated cloud products.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide instructs users to place access keys directly on the command line, which can leak secrets through shell history, process listings, CI logs, and agent telemetry; it also normalizes storing long-lived secrets in plaintext config. In an automation or agent setting, these exposures are especially dangerous because commands and logs are often persisted and centrally collected.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The role-assumption sections document cross-account and elevated access patterns that are unnecessary for a cost-analysis skill. In this context, teaching users or agents to assume broader roles can normalize privilege escalation paths and materially increase blast radius if credentials are misused or the agent is induced to run unintended commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Recommending debug logging for authentication issues without caution can expose signed requests, endpoint details, credential-provider behavior, or other sensitive metadata in logs. In agent-driven and CI environments, debug output is often retained or shipped to centralized logging, increasing the risk of credential or environment disclosure.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The examples encourage plugin installation and exploration of commands outside the immediate analytics use case, which can lead users or agents into broader operational behavior. Although not directly exploit code, it is mis-scoped for a cost-analysis skill and may facilitate unnecessary privilege use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.