ClawHub
Back to skill

Security audit

Alibabacloud Openclaw Ecs Dingtalk

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Alibaba Cloud deployment guide, but it asks for broad cloud control, public exposure, and unverified remote installers that handle secrets.

Review this before installing in any real Alibaba Cloud account. Use a dedicated temporary RAM role or isolated account, restrict inbound rules especially SSH, avoid handing secrets to unverified remote scripts, rotate Bailian and DingTalk credentials after testing, and monitor billing and ActionTrail logs.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:276
Finding

Unverified NodeSource Script Is Downloaded and Executed with Administrative Privileges

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:309
Finding

Mutable OpenClaw Installer Is Executed Without Integrity Verification and Receives Deployment Secrets

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:304
Finding

Base64-Encoded Secrets Are Embedded in Cloud Assistant Command History and Process Arguments

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:124
Finding

Security Group Exposes Administrative and Web Ports to the Entire Internet

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/dingtalk-setup-guide.md:54
Finding

Unpinned npm Sources and DingTalk Connector Create Supply-Chain Exposure

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/ram-policies.md:36
Finding

Recommended RAM Policy Grants Account-Wide Remote Command and Destructive Resource Permissions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

This command chains package installation, external script retrieval, and execution in a single privileged shell command. The chaining reduces reviewability and rollback safety, and when combined with curl | bash, it creates a high-risk one-shot path to arbitrary code execution on the target instance if any upstream step is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

md
aliyun ecs RunCommand \
  --RegionId ${region} \
  --Type RunShellScript \
  --CommandContent "apt-get update -y && apt-get install -y git curl wget && curl -fsSL --connect-timeout 30 --max-time 300 https://deb.nodesource.com/setup_22.x | bash - && apt-get install -y nodejs && npm config set registry https://registry.npmmirror.com && node -v && npm -v" \
  --InstanceId.1 ${instance_id} \
  --Timeout 600 \
  --user-agent AlibabaCloud-Agent-Skills

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill initiates creation of billable ECS, EIP, networking, and publicly reachable services, but the opening description does not prominently warn users about cost exposure and internet exposure. This increases the risk of users authorizing impactful actions without informed consent, especially when the trigger phrases are broad and the workflow is automated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file defines activation triggers, so SQP-1 applies. While some triggers are specific, phrases such as "AI agent platform", "DingTalk integration", "DingTalk AI", and "DingTalk smart assistant" are broad enough to match ordinary discussion or help requests rather than an intentional invocation of this specific ECS deployment skill.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
15% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
- **Sensitive information masking**: Mask middle portion of passwords, keys, tokens, IPs, instance IDs (e.g., `ak****3d`, `i-bp1****7f2z`)
- **Input validation**: Reject shell special characters (`;`, `|`, `&`, `$`, backticks, etc.). Use parameterized API calls
- **Command injection prevention**: Encode sensitive values for Cloud Assistant RunCommand using base64
- **Network timeout**: All curl/wget operations must include `--connect-timeout` and `--max-time` parameters
- Execute steps in order; verify success after each step; inform user of current step
- If any step fails, ask user for confirmation before continuing
- Cloud Assistant `RunCommand` results: poll `DescribeInvocations` every 15+ seconds

External Script Fetching

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The skill downloads and executes a remote script from NodeSource via a shell pipeline (curl ... | bash) inside Cloud Assistant. If the remote source, transport path, DNS resolution, or hosted script is compromised, arbitrary code will run as root on the new ECS instance, leading to full system compromise.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

md
aliyun ecs RunCommand \
  --RegionId ${region} \
  --Type RunShellScript \
  --CommandContent "apt-get update -y && apt-get install -y git curl wget && curl -fsSL --connect-timeout 30 --max-time 300 https://deb.nodesource.com/setup_22.x | bash - && apt-get install -y nodejs && npm config set registry https://registry.npmmirror.com && node -v && npm -v" \
  --InstanceId.1 ${instance_id} \
  --Timeout 600 \
  --user-agent AlibabaCloud-Agent-Skills

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:305