Alibabacloud Opensearch App Manage

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:09 AM UTC
• Version: 0.0.2

Overview

The skill matches its OpenSearch management purpose, but it needs Review because setup instructions run mutable remote installers and globally update CLI plugins before authenticated, potentially billable cloud actions.

Review this skill before installing. Use only least-privilege Alibaba Cloud RAM credentials, prefer dry-run first, confirm all cost-related parameters before creating resources, and avoid running the provided curl-to-bash or unverified latest-archive install steps unless you independently trust and verify the installer. Be aware that enabling auto plugin installation and updating all Aliyun CLI plugins changes local CLI state beyond this one skill.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:37

Finding

Unverified Remote Installer Is Piped Directly into Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:37 and SKILL.md:45-46
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code:

bash

# Install/Upgrade Aliyun CLI
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

The same command is also presented inline at line 37:

bash

curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

Technical Analysis

The command retrieves mutable content from an external URL and sends it directly to Bash. The payload is neither pinned to a reviewed version nor saved for inspection. No cryptographic signature, trusted checksum, or content validation is performed before execution.

HTTPS protects the transport connection but does not establish that the current script is identical to the version reviewed with this Skill. Compromise or unexpected modification of the CDN, origin server, DNS path, publishing account, or installer could result in arbitrary commands being executed under the Agent's operating-system identity.

The source appears related to the Aliyun CLI distribution infrastructure, but source affiliation does not eliminate the risk created by immediate, unverified execution. The behavior is also unnecessary when a compatible Aliyun CLI is already installed.

Attack Path

1. An attacker compromises or gains publishing access to the remote installer, its origin, or a relevant distribution component.
2. The attacker modifies setup.sh to include arbitrary commands.
3. The Skill determines that Aliyun CLI is absent or older than the required version.
4. The Agent follows the installation instruction and runs the curl | bash command.
5. Bash executes the modified response immediately, without a review or integrity-verification stage.
6. The payload operates with all permissions available to the Agent process and can retrieve further payloads or modify local state.

Impact Ass

...[truncated 758 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions that pipe downloaded content directly into a shell.
2. Prefer an operating-system package manager or another trusted distribution mechanism that verifies package provenance.
3. If manual installation is required:
   • Select and pin an explicit Aliyun CLI version.
   • Download the installer or archive to a local file.
   • Obtain the expected checksum or signature through an independently trusted channel.
   • Verify the SHA-256 checksum or publisher signature before execution.
   • Inspect the downloaded script when a script-based installer is unavoidable.
   • Request explicit user approval immediately before executing it.
4. Do not automatically reinstall or upgrade the CLI if the installed version already satisfies the requirement.
5. Run installation without elevated privileges where possible and document every filesystem location that will be modified.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

Global Automatic Plugin Installation and Unpinned Plugin Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:40-53
Vulnerability Type: Unsafe and unpinned dependency installation
Risk Level: Medium

Vulnerable Code:

bash

**Pre-check: Aliyun CLI plugin update required**
> [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date.

# Enable auto plugin installation
aliyun configure set --auto-plugin-install true

# Update plugins
aliyun plugin update

Technical Analysis

The Skill requires enabling automatic plugin installation globally and updating existing plugins without pinning approved versions. This introduces mutable third-party executable components into subsequent authenticated CLI operations.

A blanket plugin update is broader than the declared OpenSearch create, list, and describe functionality. It may update unrelated plugins and alter the behavior of other Aliyun CLI workflows. Enabling automatic installation also persists as a CLI configuration change beyond the immediate operation unless explicitly reverted.

No provenance validation, integrity verification, version allowlist, or review step is documented. The behavior therefore expands both supply-chain exposure and the scope of local configuration changes beyond the minimum necessary privileges.

Attack Path

1. A plugin distribution account, repository, release process, or delivery channel is compromised.
2. A malicious or altered plugin version is published.
3. The Skill enables global automatic plugin installation and invokes the blanket update command.
4. The Aliyun CLI downloads and installs the changed plugin without a Skill-level version or integrity check.
5. A subsequent CLI operation loads or invokes the plugin.
6. The plugin executes in the authenticated CLI context and gains access to the local permissions and cloud-authorized ...[truncated 727 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not require global automatic plugin installation.
2. Determine whether the required OpenSearch command is already available before modifying plugin configuration.
3. Install only the specific OpenSearch plugin required for the declared workflow.
4. Pin the plugin to a reviewed version instead of automatically selecting the latest release.
5. Verify package provenance and cryptographic integrity where the CLI ecosystem supports it.
6. Obtain explicit user consent before installing or updating executable dependencies.
7. Avoid updating unrelated plugins.
8. If automatic installation must be enabled temporarily, record the previous setting and restore it after the operation.
9. Run plugin operations under a non-privileged operating-system account.

T08 · Insecure Dependencies

Warning

• Location: references/cli-installation-guide.md:67

Finding

Mutable CLI Archives Are Installed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: references/cli-installation-guide.md:50-56, 67-71, 80-84, 93-97, and 103-119
Vulnerability Type: Unverified binary dependency installation
Risk Level: Medium

Representative Vulnerable Code:

bash

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Equivalent instructions are provided for macOS, CentOS/RHEL, ARM64 Linux, and Windows. They use mutable latest archives and do not provide a checksum or signature-verification step.

Technical Analysis

These installation paths download executable archives identified as latest, extract them, and place the resulting binary in an executable search path. Some variants use sudo to write to /usr/local/bin, increasing the consequence of a substituted binary.

Running aliyun version after installation confirms only that the downloaded file can execute and report a version. It does not validate publisher identity or prove that the binary matches a reviewed release.

The approach is less immediately dangerous than piping a response into Bash because the archive is saved first. Nevertheless, it still trusts mutable remote content without cryptographic verification and ultimately executes the resulting binary in authenticated workflows.

Attack Path

1. An attacker compromises the archive publishing process, storage origin, CDN, or another relevant distribution component.
2. The attacker replaces a latest archive with one containing a modified aliyun executable.
3. A user or Agent follows the installation guide and downloads the altered archive.
4. The archive is extracted without validating a checksum or publisher signature.
5. The binary is moved into /usr/local/bin, potentially with elevated privileges.
6. Future aliyun commands inv ...[truncated 1024 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mutable latest URLs with explicit, reviewed version numbers.
2. Publish the expected SHA-256 checksum or signing key information in the guide.
3. Verify the archive checksum or cryptographic signature before extraction.
4. Abort installation if verification fails.
5. Prefer signed packages from trusted operating-system package managers where available.
6. Extract archives into a non-privileged staging directory and inspect their contents before installation.
7. Avoid sudo unless system-wide installation is necessary and explicitly approved by the user.
8. Prefer a user-owned executable directory when a system-wide installation is not required.
9. Document safe rollback procedures and verify the installed binary against the expected signed release rather than relying only on aliyun version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (24)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill instructs piping a remotely fetched script directly into bash, which executes unverified code from the network with the user's privileges. In an agent/tooling context this is especially dangerous because it normalizes supply-chain execution before cloud operations, and compromise of the download endpoint, DNS, TLS trust, or distribution path could lead to arbitrary code execution and credential theft.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

> **Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions.

**Pre-check: Aliyun CLI plugin update required**

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This executable example repeats the same unsafe pattern by directly streaming a remote installer into bash. Because the skill also asks users to enable auto-plugin installation and then interact with cloud credentials, exploitation could lead to full local compromise and interception or abuse of Alibaba Cloud access.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

bash

# Install/Upgrade Aliyun CLI
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash
aliyun version  # Ensure >= 3.3.3

# Enable auto plugin installation

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The explicit shell pipe into bash is a command-chaining pattern that turns downloaded content into immediate code execution, eliminating opportunities for validation or review. Within this skill, the risk is elevated because the resulting environment is then used for authenticated cloud-management commands, magnifying post-compromise impact.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

bash

# Install/Upgrade Aliyun CLI
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash
aliyun version  # Ensure >= 3.3.3

# Enable auto plugin installation

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/verification-method.md (reported line 275)May include surrounding context.

Debug Commands

bash

# Enable debug mode for detailed request/response
aliyun opensearch list-app-groups --log-level=debug --user-agent AlibabaCloud-Agent-Skills/alibabacloud-opensearch-app-manage

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

> **⚠️ CRITICAL: Handling User-Provided Credentials**
>
> If a user attempts to provide AK/SK directly (e.g., "My AK is xxx, SK is yyy"):
> 1. **STOP immediately** - Do NOT execute any command
> 2. **Reject the request politely** with the following message:
>    ```
>    For your account security, please do not provide Alibaba Cloud AccessKey ID and AccessKey Secret directly in the conversation.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The acceptance criteria includes concrete create-app-group commands that can provision billable OpenSearch resources, but it does not explicitly warn users or agents that execution may incur charges or should be confirmed first. In an agent skill context, prescriptive command examples can be copied verbatim into automation flows, increasing the chance of unintended resource creation and unexpected cost exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This guide materially exceeds the stated scope of an OpenSearch instance/app-group management skill by providing broad Aliyun CLI installation, authentication, profile management, plugin, and cross-service usage guidance. In an agent skill context, overbroad operational documentation increases the chance the agent is equipped to perform unrelated cloud actions, expanding attack surface and enabling scope creep beyond the principle of least privilege.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 56)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 84)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 97)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 189)May include surrounding context.

Managing Multiple Profiles

Create Named Profiles

Use interactive mode to create profiles securely:

bash

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 337)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly encourages installing unrelated service plugins and exploring non-OpenSearch commands such as ECS, VPC, RDS, and Function Compute. For a skill intended only for OpenSearch instance management, this broadens capabilities available to the operator or agent and can facilitate unintended or unauthorized actions across other Alibaba Cloud services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation includes a concrete example for a paid write operation that creates a cloud resource, but it does not prominently warn that running the command provisions an instance and may incur charges. In an agent-skill context, examples are often reused directly, so omission of a billing/resource-creation warning increases the risk of unintended paid actions by users or downstream agents.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/related-apis.md (reported line 179)May include surrounding context.

md

## Reference Documentation

- [CreateAppGroup API Doc](https://api.aliyun.com/document/OpenSearch/2017-12-25/CreateAppGroup)
- [ListAppGroups API Doc](https://api.aliyun.com/document/OpenSearch/2017-12-25/ListAppGroups)
- [DescribeAppGroup API Doc](https://api.aliyun.com/document/OpenSearch/2017-12-25/DescribeAppGroup)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/related-apis.md (reported line 180)May include surrounding context.

md

## Reference Documentation

- [CreateAppGroup API Doc](https://api.aliyun.com/document/OpenSearch/2017-12-25/CreateAppGroup)
- [ListAppGroups API Doc](https://api.aliyun.com/document/OpenSearch/2017-12-25/ListAppGroups)
- [DescribeAppGroup API Doc](https://api.aliyun.com/document/OpenSearch/2017-12-25/DescribeAppGroup)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/related-apis.md (reported line 181)May include surrounding context.

md

## Reference Documentation

- [CreateAppGroup API Doc](https://api.aliyun.com/document/OpenSearch/2017-12-25/CreateAppGroup)
- [ListAppGroups API Doc](https://api.aliyun.com/document/OpenSearch/2017-12-25/ListAppGroups)
- [DescribeAppGroup API Doc](https://api.aliyun.com/document/OpenSearch/2017-12-25/DescribeAppGroup)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document instructs users to run real create-app-group commands that can provision cloud resources, but it does not clearly warn that these actions may create billable OpenSearch instances. In an agent-skill context, operational verification steps are likely to be followed as written, so omission of cost and side-effect warnings can cause unintended resource creation and financial impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The full test script automates creation of a live OpenSearch instance and even notes cleanup must be done manually in the console, but it lacks an upfront safety warning about billable resource creation. This increases the likelihood that a user or agent runs the script verbatim, leading to unintended provisioning, lingering resources, and avoidable charges.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest and top-level description limit the skill to creating and querying OpenSearch instances, but the workflow guidance explicitly discusses other write operations such as restart and delete. Although these commands are not fully implemented here, the file presents them as part of the skill's operational scope, which is broader than the declared purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes an instance management skill specifically for creating and querying instances, but this section states that write-operation best practices apply to create, restart, and delete. That broadens the apparent behavior and intent of the skill beyond the documented create/query scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide directs users specifically to the Chinese-language Aliyun CLI documentation via a zh URL path. This is a natural-language locale choice embedded in the instructions, and the file does not offer an alternative language option or state that the skill is intended only for Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The references point users only to the Chinese-language official documentation (/zh/cli/). Because the guide otherwise targets a general audience, this imposes a locale preference without offering users a choice or documenting a justified regional requirement.

Content

No source excerpt is available for this finding.