alibabacloud-opc-deploy

• Outcome: Review
• Latest audit: Sep 1, 2026 · 12:56 PM UTC
• Version: 0.0.2

Overview

This skill has clear deployment safety checks, but it also changes local tooling and agent behavior in ways users should review before installing.

Review this skill before installing if you are not comfortable with it modifying your local AI tool and Alibaba Cloud CLI setup. Only proceed if you understand that it can create paid cloud resources after confirmation, install or update local tooling, enable global CLI plugin auto-install, store deployment records locally, and guide credential setup through the Aliyun CLI.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The execution index directly conflicts with the skill manifest: it says 'No SKU ⇒ STOP, never guess,' while the skill metadata explicitly states this skill must handle the no-SKU path and choose/recommend a package when the user asks. In a deployment skill, this inconsistency is dangerous because it can cause the agent to refuse intended advisory behavior, route users incorrectly, or dead-end flows before required safety and payment gates are reached.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The non-skippable SKU gate forbids 'inferring or self-selecting a SKU,' but the skill's declared purpose expressly includes selecting the appropriate OPC package when the SKU is not yet settled. This creates a core control-plane contradiction in a money-spending cloud deployment skill: the assistant may either violate its top-level contract or obey the gate and fail to serve the user, increasing the chance of unsafe fallback behavior, incorrect delegation, or bypass of intended workflow controls.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill instructs the agent to scan the local filesystem for skill directories, clone code from a remote repository, and copy it into a hidden tool directory. That is a significant expansion of privilege for a SKU-selection flow and creates a supply-chain and local-integrity risk: a compromised repo, path confusion, or mistaken target directory could modify the user's agent environment.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger criteria are broad enough to capture exploratory conversation about packages or what a user wants to build, which can route ordinary advice-seeking into a deployment-capable skill. In a skill that can eventually create billable cloud resources, over-triggering increases the chance of unintended progression into credential setup, pricing, or deployment preparation under the wrong conversational context.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: Ambiguous phrases like 'what's next?' and broad build-description triggers can cause this high-impact skill to activate outside clearly bounded deployment contexts. Because the skill governs billing-sensitive infrastructure actions, accidental invocation raises the risk of user confusion, misrouting, and premature collection of deployment-related inputs.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill directs the agent to install the Alibaba Cloud CLI automatically on the user's machine and explicitly forbids asking the user to run commands manually. This changes the local system state by downloading binaries, writing into ~/.local/bin, and updating PATH-related execution context without an explicit consent checkpoint describing those modifications.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill enables a global '--auto-plugin-install' setting so future product commands may silently download and install additional plugins on demand. Even if convenient, this expands trusted code execution and persists beyond the current step, while the user is not clearly warned that later commands can trigger automatic software installation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file hardcodes Chinese-only user-facing output, which can override the user's preferred language and reduce informed consent during a deployment flow involving billing and manual console actions. In a cloud provisioning skill, this is risk-relevant because misunderstandings about charges, fallback steps, or confirmations can cause unauthorized or mistaken resource creation.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file mandates Chinese-only output for all user-facing messages without checking the user's language preference or obtaining consent. In a payment-authorization and cloud-provisioning flow, forcing a language the user may not fully understand can invalidate informed consent, increase the risk of accidental authorization, and cause users to misunderstand security-critical details such as charges, exposed ports, and manual purchase steps.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The skill hard-codes `Default Language -> zh`, changing the user's CLI configuration without checking preference or existing locale. This is not a direct security break, but it can alter operator behavior and output parsing assumptions, which is undesirable in a credential/setup workflow.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file hard-codes `region_default: cn-beijing` for a workflow that provisions paid cloud resources, without showing any user opt-in or region suitability check in this file. In a deployment skill, silently defaulting the geography can create compliance, latency, residency, and pricing mismatches; because this skill is designed to carry resource creation end-to-end, the risk is more significant than in a read-only advisory context.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: The YAML directs users to install and use a specific Chinese desktop AI tool (QoderWork CN Pro) as the prescribed next step, without presenting neutral alternatives, locale choice, or a clear security/privacy justification. In a cloud-deployment skill, steering users toward a particular remote-management tool can create supply-chain, privacy, and lock-in risks, especially because the tool is expected to remotely access newly provisioned servers.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill performs potentially system-impacting actions—network retrieval and local filesystem writes—yet the top-level description emphasizes cloud provisioning cost confirmation and does not consistently foreground these local side effects. Users may reasonably consent to 'help choosing a package' without understanding that the agent may modify their local tool environment.

Ssd 3

Low

• Confidence: 81% confidence
• Finding: The skill explicitly asks the user to paste the RAM role ARN into chat. A role ARN is not a secret like an access key, but it is still account identity metadata that need not be transmitted to the agent if the CLI or local validation can consume it directly.

Session Persistence

Medium

• Category: Rogue Agent

Content

VER="$(read [cli_meta].min_version)"
      SHA="$(read [cli_meta].sha256_darwin_arm64)"  # or darwin_amd64
      TOFU_FILE="$HOME/.opc/cli-tofu-${VER}-darwin-arm64.sha256"
      mkdir -p ~/.local/bin ~/.opc
      curl -fLo /tmp/aliyun-cli.tgz --connect-timeout 15 --max-time 300 "https://aliyuncli.alicdn.com/aliyun-cli-darwin-arm64-${VER}.tgz"
      # SHA256 three-tier verification
      ACTUAL_SHA="$(shasum -a 256 /tmp/aliyun-cli.tgz | awk '{print $1}')"

• Confidence: 88% confidence
• Finding: The skill intentionally creates persistent directories and records a TOFU hash file under ~/.opc, leaving durable artifacts on the user's machine. In this context, persistence is not inherently malicious, but it is a real security-relevant behavior because it stores trust state and modifies the local environment without a distinct consent/retention explanation.

Session Persistence

Medium

• Category: Rogue Agent

Content

Reference script names (copy these, do not re-coin): `01-cli-setup.sh` · `02-credential-list.sh` · `03-identity-check.sh` · `04-permission-check.sh` · `05-price-inquiry.sh` · `06-image-resolve.sh` · `07-network-check.sh`.

     **The two that slip through most often — check yourself against them**: a state JSON written with `"mode": "StsToken"`, and a `ran_scripts/README.md` carrying `三个只读探针` or `StsToken`. Both are rows in the table above, so both are avoidable by substituting **at write time**. The gap is never the check itself — it is that nobody re-opens a written file to sanitize it afterwards. Substitute as you type.

     **`ran_scripts/README.md` — reuse the plan wording, do not invent a second vocabulary.** Its only job is one table of `脚本名` → `这一步做了什么` → `结果`, and the middle column must be **copied from the plan-item table in Hard Gate #6** (`SKILL.md`) — that table is already the approved plain-language phrasing for exactly these steps, so `权限检查：ECS / VPC / ESA 三个只读探针` should have read `先试一下权限够不够（只读、不花钱）`. Nothing in this file needs a word the substitution table above does not already cover — if you find yourself reaching for one, you are recording internal machinery the reader does not need.
7. **Database passwords never hit disk**: after generation the password is **shown once in the conversation only**; the state file records only `password_set: true` + `set_at`, and it is never written to any state/log/yaml. If the user loses the password → reset via RDS `ResetAccountPassword`, never recover from history. AccessKeys are likewise never displayed, stored, or echoed (see iron-rule #15).

• Confidence: 73% confidence
• Finding: The skill explicitly requires writing execution records and a persistent state file to disk, including resource IDs, timestamps, credential-type metadata, and deployment history. Although it forbids storing raw secrets, this still creates durable local artifacts that can expose infrastructure inventory and operational context if the workspace or host is later accessed by another process or user. In a cloud-deployment skill, persistent records are more sensitive than in a low-risk domain because they map directly to billable resources and management surfaces.

Static analysis

No suspicious patterns detected.