Security audit

alibabacloud-opc-deploy

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for Alibaba Cloud provisioning, but it also installs persistent agent tooling and grants broad cloud mutation/deletion authority with several unsafe or under-scoped edges.

Install only if you intentionally want this assistant to provision Alibaba Cloud resources for you. Use a dedicated least-privilege RAM role, verify the exact SKU and all charges before confirming payment, review any advisor-skill install prompt carefully, and remove or rotate the generated credentials/keys and cloud permissions when the deployment work is done.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:130
Finding: Forced SKU Interpretation Overrides the User's Actual Intent
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: references/sku-resolution.md:94
Finding: Mutable Remote Skill Is Installed into the Agent's Tool Directory
Content: View full analysis
/dev/null | head -1 TMP="$(mktemp -d)" git clone --depth 1 https://github.com/aliyun/alibabacloud-aiops-skills.git "$TMP/repo" mkdir -p "${TARGET_DIR}/alibabacloud-opc-advisor" cp -R "$TMP/repo/skills/computing/ecs/alibabacloud-opc-advisor/." \ "${TARGET_DIR}/alibabacloud-opc-advisor/" [ -n "$TMP" ] && [ -d "$TMP" ] && case "$TMP" in "${TMPDIR:-/tmp}"*) rm -rf "$TMP";; esac test -f "${TARGET_DIR}/alibabacloud-opc-advisor/SKILL.md" ``` ### Technical Analysis The installation process clones the mutable default branch of a remote GitHub repository and copies a Skill from that repository into the agent's tool-level skills directory. It does not pin an immutable commit, verify a release signature, validate a content manifest, or compare the downloaded files against reviewed hashes. The installed payload is not conventional machine code, but Skill instructions are executable control material for an AI agent. Once loaded, changed upstream instructions can alter the agent's goals, tool use, credential interactions, and handling of user requests. Therefore, copying unreviewed remote Skill content into a loadable Skill directory constitutes remote payload retrieval with a supply-chain exposure. The repository belongs to an Alibaba Cloud organization and installation requires a user confirmation according to the surrounding instructions. These factors reduce opportunistic abuse but do not provide cryptographic integrity or ensure that the installed content is the version reviewed with this project. ### Attack Path 1. A user requests package selection without supplying a recognized SKU. 2. The Skill determines that the advisor component is ...[truncated 1134 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/ram-policies.md:126
Finding: Teardown Role Can Delete Unrelated Cloud Resources
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/provision.md:23
Finding: SSH Private Key Is Written Before Secure Permissions Are Enforced
Content: View full analysis
/dev/null || stat -c '%a' ~/.ssh/opc-deploy.pem)" = "600" \ || chmod 600 ~/.ssh/opc-deploy.pem HEAD=$(head -c 32 ~/.ssh/opc-deploy.pem) TAIL=$(tail -c 32 ~/.ssh/opc-deploy.pem) SIZE=$(wc -c < ~/.ssh/opc-deploy.pem) echo "${HEAD} ${TAIL}" ``` ### Technical Analysis Python's regular `open(..., 'w')` creates the private-key file using permissions derived from the process umask. The restrictive `chmod 600` operation occurs only after the complete private key has been written. On a system with a permissive umask, the file may temporarily be readable by other local users or processes. The file is also created at a predictable path without exclusive-create semantics. An existing symbolic link or unexpected file at that path is not checked before writing. This creates the possibility of overwriting another file accessible to the agent or redirecting key material to an unintended destination. Finally, the workflow deliberately reads and prints the first and last 32 bytes of the private key. Although most of the middle is hidden, the output may contain base64-encoded key material in addition to the PEM delimiters. Printing any private-key bytes contradicts the stated objective that the key never enter logs or conversation output. Generating or importing an SSH key is relevant to ECS provisioning, but the implementation exceeds minimum safe handling because neither partial display nor a permission race is necessary. ### Attack Path ...[truncated 1264 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (90)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
See `references/iron-rules.md` (35 iron rules + credential safety rules).

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 333)May include surrounding context.
md
See `references/iron-rules.md` (35 iron rules + credential safety rules).

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
| 3 | `provision.md` | Create resources (💰 paid) | `按顺序开通资源，每扣一笔都告诉你` | Execute in order per `references/sku-params/<sku>.yaml` steps. AFTER EACH create call: (

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.
md
| 3 | `provision.md` | Create resources (💰 paid) | `按顺序开通资源，每扣一笔都告诉你` | Execute in order per `references/sku-params/<sku>.yaml` steps. AFTER EACH create call: (

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.
md
See `references/sku-params-format.md`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 347)May include surrounding context.
md
See `references/sku-params-format.md`.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to install and upgrade the Alibaba Cloud CLI directly on the user's machine and explicitly forbids handing commands to the user for review. That is a host-modifying action outside the narrow need of package selection, and it increases risk by downloading and executing installer content plus altering local binaries and PATH state before the user has explicitly approved those changes.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The phase index states 'No SKU ⇒ STOP, never guess,' while the skill metadata explicitly says this skill must handle users who have not yet settled a package and should pick/recommend an OPC package. This contradiction creates unsafe control-flow ambiguity: the agent may either refuse legitimate package-selection requests or, worse, bypass the documented gate and infer/select a paid SKU without a consistent authorization process. In a cloud-provisioning skill, such ambiguity directly increases the risk of unauthorized charges and deployment of unintended resources.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The 'SKU GATE' forbids inferring or self-selecting a SKU, but the skill description says the skill must take over when the user asks which package is suitable and must not let a general assistant answer that question. This is a real policy contradiction in a money-spending workflow: an implementation may resolve the conflict by violating one side, leading to unsupported recommendations, accidental package selection, or fee-incurring actions based on inferred user intent rather than explicit consent. Because the skill provisions cloud resources, the inconsistency materially raises the chance of financial and operational harm.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill metadata says it should both recommend/select an OPC package and provision it, while the iron rules explicitly forbid deploy from choosing a SKU and require a separate advisor/bootstrap path until the user supplies a valid SKU. In a purchasing workflow, this contradiction is dangerous because an agent may autonomously steer the user into a paid package and then execute the purchase, collapsing the intended separation between recommendation and execution.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation contradicts itself on whether the skill may select a package, creating ambiguous control flow in a money-spending context. When instructions conflict, implementations often follow the more permissive path, which can lead to unauthorized recommendations, upselling, or purchases without the intended safeguard of a separate SKU-resolution process.
Content: No source excerpt is available for this finding.

Cloud Metadata Access

High

Category: Server-Side Request Forgery
Confidence: 85% confidence
Finding: Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.
Content: Scanner excerpt · references/network.md (reported line 104)May include surrounding context.
md
# Auto-detect the user's egress IP (prefer an Alibaba Cloud-owned probe endpoint, # fall back to ifconfig.me/ipinfo.io, and if all fail have the user type it in, to avoid writing a garbage value into the allowlist) # Note: the Alibaba Cloud ECS metadata 100.100.100.200 is only reachable inside ECS, not from a local terminal. # Here we use a lightweight aliyun CLI call instead; the CLI carries its own Signature and the response can yield RemoteAddr (some versions). # The most robust is still the third-party + user-input three-tier fallback. MY_IP=""

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The instruction to detect ~/.ssh/id_ed25519.pub similarly directs the agent to inspect a standard credential-related directory on the user's machine. Although the public key itself is less sensitive than a private key, automated discovery of authentication assets broadens the agent's access scope and increases the risk of over-collection, accidental logging of key metadata, or future extension to more sensitive files.
Content: Scanner excerpt · references/provision.md (reported line 23)May include surrounding context.
text
Before running RunInstances: 1. Detect whether the user's local ~/.ssh/id_rsa.pub or ~/.ssh/id_ed25519.pub exists - exists → ImportKeyPair (upload the public key to Alibaba Cloud; no private key touches disk) - not exists → CreateKeyPair + **private key NEVER enters conversation/state**: # CreateKeyPair has no --output-file option; the private key is in the response PrivateKeyBody field — pipe it straight to disk, never echo to stdout/log (iron-rule #30)

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The instruction to detect ~/.ssh/id_ed25519.pub similarly directs the agent to inspect a standard credential-related directory on the user's machine. Although the public key itself is less sensitive than a private key, automated discovery of authentication assets broadens the agent's access scope and increases the risk of over-collection, accidental logging of key metadata, or future extension to more sensitive files.
Content: Scanner excerpt · references/provision.md (reported line 23)May include surrounding context.
text
Before running RunInstances: 1. Detect whether the user's local ~/.ssh/id_rsa.pub or ~/.ssh/id_ed25519.pub exists - exists → ImportKeyPair (upload the public key to Alibaba Cloud; no private key touches disk) - not exists → CreateKeyPair + **private key NEVER enters conversation/state**: # CreateKeyPair has no --output-file option; the private key is in the response PrivateKeyBody field — pipe it straight to disk, never echo to stdout/log (iron-rule #30)

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
md
A token counts as stated no matter how the sentence is shaped: with no deploy verb ("starter_webui"), wrapped in a noun phrase ("帮我创建阿里云OPC套餐的lite_seed"), or phrased like an authoring task. NEVER split a token into ordinary words to re-read the intent (`lite_seed` is one package name, not "the seed of the lite package"), and NEVER read such a message as a request to edit this skill's own files just because the surrounding context mentions skill development. SKU missing or illegal (e.g. the user says only "帮我部署" with no SKU) → do NOT ask the user to pick a tier and do NOT improvise wording here: run the "Advisor bootstrap" block below, which owns

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/sku-resolution.md (reported line 37)May include surrounding context.
md
A token counts as stated no matter how the sentence is shaped: with no deploy verb ("starter_webui"), wrapped in a noun phrase ("帮我创建阿里云OPC套餐的lite_seed"), or phrased like an authoring task. NEVER split a token into ordinary words to re-read the intent (`lite_seed` is one package name, not "the seed of the lite package"), and NEVER read such a message as a request to edit this skill's own files just because the surrounding context mentions skill development. SKU missing or illegal (e.g. the user says only "帮我部署" with no SKU) → do NOT ask the user to pick a tier and do NOT improvise wording here: run the "Advisor bootstrap" block below, which owns

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Manifest 描述把“pick the package”作为本技能的核心职责之一，给人的语义预期是该技能本身会完成套餐选择与推荐。但正文后续明确规定无 SKU 时必须停在 Phase -2，且不得自行推断、猜测或推荐 SKU，还把比较套餐/推荐套餐归属给 alibabacloud-opc-advisor。这构成了技能宣称能力与实际允许行为之间的明显不一致。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file states 'All user-facing output MUST be in Chinese (zh-CN)', which is a natural-language locale policy constraint applied universally. The skill does not offer the user a language choice or explain a region-specific compliance reason that would justify mandating Chinese output.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: L22 声称“the skill owns the no-SKU path end to end”，但紧接着 L24 又声明比较/推荐套餐属于 alibabacloud-opc-advisor。后文 L30、L124-L152 进一步要求无 SKU 时不得继续任何 phase，只能转入 advisor bootstrap 并停止。这不是简单的省略，而是对职责边界的主动矛盾表述。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill says it 'MUST auto-install' the CLI via Bash and not ask the user to run commands manually, but it does not require an upfront warning that local files, binaries, and environment settings will be changed. Removing the review/consent step makes unintended host modification more likely and weakens user control over a sensitive action.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: Creating persistent directories such as ~/.local/bin and ~/.opc establishes session-spanning state on the user's machine as part of an automated setup flow. In this skill context, that persistence is security-relevant because it prepares long-lived local execution and trust material for future CLI use without a separate approval boundary.
Content: Scanner excerpt · references/cli-install.md (reported line 30)May include surrounding context.
md
VER="$(read [cli_meta].min_version)" SHA="$(read [cli_meta].sha256_darwin_arm64)" # or darwin_amd64 TOFU_FILE="$HOME/.opc/cli-tofu-${VER}-darwin-arm64.sha256" mkdir -p ~/.local/bin ~/.opc curl -fLo /tmp/aliyun-cli.tgz --connect-timeout 15 --max-time 300 "https://aliyuncli.alicdn.com/aliyun-cli-darwin-arm64-${VER}.tgz" # SHA256 three-tier verification ACTUAL_SHA="$(shasum -a 256 /tmp/aliyun-cli.tgz | awk '{print $1}')"

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The Windows WDAC/AppLocker user message is written only in Chinese, and the surrounding instructions do not indicate that the user opted into Chinese or that the skill is region-specific. The same pattern appears elsewhere in user-facing copy, creating a language policy issue because the skill imposes a specific language rather than offering a locale choice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Enabling aliyun configure set --auto-plugin-install true creates a persistent global setting that authorizes future on-demand plugin downloads and execution for product commands. This expands the trust boundary beyond the immediate task, because later commands may fetch additional code automatically without a fresh approval checkpoint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains a fixed user-facing message in Chinese: "这个 SKU 包含 ${product}..." with no indication that the user can choose another language. The policy for this audit flags natural-language locale constraints when a skill forces a specific language without user opt-in or clear documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instruction requires 'Chinese prose throughout' for every message in the session, which is a natural-language locale constraint applied to users. The file does not offer opt-in, a language choice, or a clear region-specific justification for forcing Chinese output.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.