ClawHub
Back to skill

Security audit

Alibabacloud Odps Project Manage

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with Alibaba Cloud MaxCompute project management, but it uses unsafe installer and plugin-update instructions and has under-scoped cloud-resource authority that should be reviewed before installation.

Install only after reviewing the setup steps. Prefer installing Aliyun CLI through a trusted package manager or verified download, avoid piping remote scripts into bash, do not enable global automatic plugin installation unless you accept that persistent change, use least-privilege RAM credentials, and require a clear confirmation before creating any billable MaxCompute project.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:16
Finding

Unverified Remote Installation Script Is Piped Directly into Bash

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:203
Finding

Global Automatic Plugin Installation and Unpinned Plugin Updates Expand Supply-Chain Exposure

Content
View full analysis
[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ```bash # Install/Update Alibaba Cloud CLI curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash # Verify version (must be >= 3.3.3) aliyun version # Enable auto plugin installation aliyun configure set --auto-plugin-install true # Update plugins aliyun plugin update ``` ``` ### Technical Analysis The Skill requires enabling persistent automatic plugin installation and updating every existing local plugin. It does not restrict installation to the MaxCompute plugin, pin approved versions, verify plugin checksums or signatures, or request user approval for each changed component. Updating unrelated plugins exceeds the dependencies needed for MaxCompute project management. Enabling automatic installation also changes persistent CLI configuration, potentially affecting future sessions and unrelated workflows after this Skill has finished. Although plugin updates may be operationally useful, treating them as mandatory before every workflow unnecessarily enlarges the trusted supply chain. A compromised plugin repository, publisher account, or release could introduce executable code that runs in an authenticated CLI environment. ### Attack Path 1. The user invokes the Skill for a MaxCompute operation. 2. The Skill instructs the Agent to persistently enable automatic plugin installation. 3. The Agent runs `aliyun plugin update`, including updates for plugins unrelated to MaxCompute. 4. A compromised or malicious plugin release is downloaded from the configured plugin source. 5. The plugin is loaded during the curre ...[truncated 850 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:95
Finding

User-Controlled Parameters Are Interpolated into Shell Commands and JSON Without Safe Argument Handling

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/cli-installation-guide.md:39
Finding

Mutable “Latest” CLI Binaries Are Installed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (37)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to pipe a remotely fetched script directly into bash, which bypasses review and grants immediate code execution from an external source. In an agent skill, this is especially dangerous because installation steps may be treated as part of the trusted workflow and executed reflexively.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.
>
> Then [MUST] run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

Repeating the remote-script installation instruction normalizes unsafe execution of unreviewed code and increases the chance it will be followed. Because this skill otherwise focuses on cloud project management, bundling shell bootstrap execution materially broadens the attack surface beyond the business need.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md
**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.

**Pre-check: Aliyun CLI plugin update required**

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The explicit command example curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash is a textbook unsafe pattern that can lead to arbitrary code execution if the remote host, transport, or script content is compromised. The danger is elevated here because the skill presents it as a normative installation step users must perform.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

bash
# Install/Update Alibaba Cloud CLI
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

# Verify version (must be >= 3.3.3)
aliyun version

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The | bash chain converts fetched network content directly into executable shell input, eliminating any inspection point and enabling one-step compromise. In combination with a privileged CLI setup workflow, this chaining can be abused to run arbitrary commands on the local machine.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

bash
# Install/Update Alibaba Cloud CLI
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

# Verify version (must be >= 3.3.3)
aliyun version

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrase maxcompute project is broad enough to activate on general discussion, not just on an explicit request to perform cloud actions. In a skill that can create resources, ambiguous activation increases the chance of unintended operational guidance or accidental invocation in sensitive contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The instruction When user asks about MaxCompute projects lacks a clear boundary between informational conversation and an operational workflow. Because this skill includes creation of billable cloud resources, vague activation criteria make unintended use more dangerous than in a read-only skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill provides instructions to create MaxCompute projects, which are account-affecting and potentially billable, but does not include a prominent warning about cost, quota consumption, or organizational impact. Users may authorize creation without understanding the financial or operational consequences.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md
> 2. **NEVER** use hardcoded values — always ask user for parameters, then use their ACTUAL answer (not placeholder text)
> 3. **NEVER** use `aliyun configure set` with literal credential values
> 4. **NEVER** run `aliyun ram` commands
> 5. **NEVER** execute ANY command without `--user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-project-manage`
> 6. **NEVER** skip asking for RegionId — this is ALWAYS required
> 7. **NEVER** assume a default region — always ask the user
> 8. **NEVER** use uppercase API action format as CLI commands — ALWAYS use plugin format with lowercase and hyphens (e.g., `create-project`)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to enable aliyun configure set --auto-plugin-install true, which changes a global CLI setting unrelated to the narrow task of MaxCompute project management. This expands the trust boundary by allowing future plugin installation behavior account-wide, increasing supply-chain and unintended tool-execution risk beyond the immediate workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The acceptance criteria expands the skill’s operational scope to include delete-project, even though the declared skill metadata only covers creating, querying, and listing MaxCompute projects. This kind of scope drift is dangerous because downstream agents, tests, or maintainers may infer that destructive actions are intended and permitted, increasing the chance of accidental resource deletion without explicit user expectation or authorization boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document includes a destructive aliyun maxcompute delete-project command as a correct pattern without any warning, confirmation requirement, or cautionary language. In an agent skill context, presenting destructive operations as ordinary accepted behavior can normalize unsafe execution paths and lead to irreversible deletion of projects or data if an agent or user follows the example blindly.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide instructs users to place long-lived Access Key credentials directly on the command line and in persistent CLI configuration without prominently warning about secret exposure risks. Command-line arguments can leak via shell history, process inspection, automation logs, and copied config files, making credential theft more likely.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md
1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The environment-variable examples export cloud credentials without warning that such values may propagate to child processes, debugging tools, crash dumps, and CI/CD logs. In automation-heavy skill usage, this creates a realistic path for accidental credential disclosure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file belongs to a MaxCompute project-management skill, but it provides broad Aliyun CLI guidance covering ECS operations, general credential setup, debug usage, custom endpoints, proxies, and arbitrary plugin usage. In an agent-skill context, this scope expansion increases the chance that the skill will be used to perform actions outside its declared purpose, violating least privilege and enabling unintended cloud access paths.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash
# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The guide explicitly recommends installing arbitrary Alibaba Cloud product plugins such as ECS, VPC, and RDS, which are unrelated to MaxCompute project management. In a skill consumed by an agent, this broadens available functionality and may let the agent access or invoke additional services beyond the intended trust boundary.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documented API set includes DeleteProject even though the skill metadata declares only creating, querying, and listing projects. In an agent skill context, this scope mismatch can enable destructive actions that users and policy controls may not expect, increasing the risk of unauthorized or accidental deletion of cloud resources and data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The CreateProject examples show how to create persistent cloud resources without warning about side effects, billing, or environment changes. In an agent setting, omission of these caveats can cause unintended resource creation and unexpected charges because the user may interpret the example as low-risk informational output.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 435)May include surrounding context.

md
**API Endpoint:** `https://maxcompute.{regionId}.aliyuncs.com`

**API Documentation:** [CreateProject](https://api.aliyun.com/api/MaxCompute/2022-01-04/CreateProject)

### CLI Command

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 436)May include surrounding context.

md
**API Endpoint:** `https://maxcompute.{regionId}.aliyuncs.com`

**API Documentation:** [CreateProject](https://api.aliyun.com/api/MaxCompute/2022-01-04/CreateProject)

### CLI Command

Static analysis

No suspicious patterns detected.