T03 · Remote Payload Retrieval and Execution
Error
- Location
references/cli-installation-guide.md:41- Finding
Unverified Mutable CLI Binary Installed into a Privileged Executable Path
- Content
View full analysis
- Remediation
View remediation
Security audit
Alibabacloud Oss Manage Cron Upload
Security checks for vulnerabilities and agentic risk
Overview
The skill’s OSS scheduled upload purpose is coherent, but it includes under-scoped installation, persistence, and local/cloud mutation steps that users should review before installing.
Review this skill carefully before installing. It is not evidence of malware, but use it only with a least-privilege Alibaba Cloud profile, avoid global auto-plugin installation, verify any downloaded CLI binary, inspect scheduler changes before applying them, and do not let it create or upload placeholder data when the real local source path is missing.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:34- Finding
Global Automatic Plugin Installation Introduces Unpinned Executable Dependencies
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:299- Finding
Non-Interactive Cron Installation Can Replace the Entire Existing Crontab
- Content
View full analysis
> /var/log/oss-sync-cron.log 2>&1 ``` ``` ### Technical Analysis `crontab -` installs its standard input as the complete crontab for the current user. Supplying only the new OSS synchronization line does not append it safely; it replaces all existing entries. The guidance does not require reading and preserving the current crontab, creating a backup, checking for an existing managed entry, or obtaining confirmation before replacement. Although scheduled execution is legitimate for the declared recurring-sync function, destructive replacement of unrelated jobs is unnecessary. ### Attack Path 1. The user already has scheduled backup, monitoring, certificate-renewal, or maintenance jobs. 2. The Agent follows the suggested non-interactive pattern and pipes only the OSS entry into `crontab -`. 3. Cron accepts the supplied content as the user's complete new crontab. 4. All pre-existing entries are removed. 5. The deletion may remain unnoticed until a critical scheduled operation fails to run. ### Impact Assessment The direct impact is loss of unrelated scheduled jobs under the affected user account. This can disable backups, monitoring, renewals, cleanup tasks, or other operational controls. If the command is run as a privileged account, the availability and security impact can extend across the host. The issue does not inherently grant new privileges, but it can remove defensive or administrative tasks and create persistent operational disruption. ]]>- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:230- Finding
Missing Source Paths Cause Arbitrary Local File Creation and Fabricated Uploads
- Content
View full analysis
**If `LocalSourcePath` does not exist** in the current environment (e.g., container or CI runner), create it under the current working directory with a small test file, then run the upload command against it and verify with `aliyun ossutil ls`. This proves the upload path works end-to-end. Do **not** skip the upload test just because the directory is absent — create it and validate connectivity, permissions, and command correctness: > ```bash > mkdir -p "${LocalSourcePath}" && echo "test" > "${LocalSourcePath}/test.txt" ``` ### Technical Analysis A missing requested source directory should be treated as a failed prerequisite. Instead, the Skill instructs the Agent to create the absolute user-supplied path and write `test.txt` into it. The redirection truncates an existing `test.txt` if path state changes between validation and execution. It may also follow filesystem links. If the process has elevated permissions, the operation can create directories or overwrite files in locations unavailable to an ordinary user. The fabricated file is then uploaded to OSS, producing a misleading end-to-end result that does not validate the user's real source data. This instruction also conflicts with later project guidance that prohibits simulated test data when prerequisites are missing. ### Attack Path 1. The source path is incorrect, absent, or attacker-influenced. 2. The Skill validates it syntactically but does not require the path to exist as the intended directory. 3. `mkdir -p` creates the supplied absolute path using the Agent's filesystem privileges. 4. Shell redirection creates or truncates `test.txt`; link resolution may redirect the write. 5. The generated data is uploaded using the configured Alibaba Cloud credentials. 6. Verification reports the fabrica ...[truncated 561 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:167- Finding
Mandatory Account-Wide Bucket Enumeration Exceeds Target-Specific Least Privilege
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (30)
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
md tion must include: > `--user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload` Required local tools: | Tool | Required | Purpose | Verify | | --- | --- | --- | --- | | `aliyun` CLI | Yes | Credential gate, command discovery, and integrated `ossutil` upload/list surface | `aliyun version` and `aliyun ossutil --help` | | `cron` or `schtasks` | Yes | Local recurring execution | `crontab -l` or `schtasks /Query /TN "OSS Scheduled Sync"` | Use `references/cli-installation-guide.md` only for CLI installation and plugin setup. For this skill, use the integrated `aliyun ossutil` command surface — do **not** require standalone `ossutil` installation or bare `ossutil` commands. ## Environment Variables No extra cloud-specific environment variables are required beyond an already configured Alibaba Cloud profile. Optional local variables used in examples: | Variable | Required/Optional | Description | Default Value | | --- | --- | --- | --- | | `ALIBABA_CLOUD_PROFILE` |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
schtasks /Delete removes a scheduled task and is a destructive system operation affecting host persistence and potentially business-critical backups. If task names collide or the user misunderstands the target, the skill could delete a legitimate scheduled job without adequate confirmation.
- Content
Windows Task Scheduler
[OS-local]:bat schtasks /Delete /TN "OSS Scheduled Sync" /FOptional OSS test cleanup
[aliyun CLI / integrated ossutil]:
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 87% confidence
- Finding
The cleanup command performs object deletion in OSS based on concatenated bucket and prefix parameters. Even with some validation, destructive operations against cloud storage are high risk because prefix handling mistakes, empty values, or user misunderstanding can remove the wrong object or normalize to a different target than intended.
- Content
Optional OSS test cleanup
[aliyun CLI / integrated ossutil]:bash aliyun ossutil rm "oss://${BucketName}/${TargetOssPrefix}test-object.txt" --region "${RegionId}" \ --read-timeout 60 --connect-timeout 30 \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md See `references/related-apis.md` for the command inventory, OSS capability notes, and validation notes. That file is reference metadata only.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md See `references/related-apis.md` for the command inventory, OSS capability notes, and validation notes. That file is reference metadata only.
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document first says agents must never execute credential-setting commands, then states that non-interactive credential configuration is recommended for agent-driven automation. That contradiction can cause an agent or operator to treat dangerous secret-injection commands as acceptable in automation, leading to credential exposure, persistence, or misuse.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 87% confidence
- Finding
The documented
aliyun ossutil rm "oss://${BucketName}/${TargetOssPrefix}test-object.txt"command performs object deletion using interpolated bucket and prefix parameters. If those parameters are malformed, empty, or attacker-influenced, the deletion target could expand beyond the intended test artifact, causing unintended data loss in OSS.- Content
md | `aliyun` CLI | `aliyun ossutil cp --help` | Verify the integrated upload command surface | Not validated locally because `aliyun` was not installed in this repository | | `aliyun` CLI | `aliyun ossutil cp "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}" -r -u --max-age "${MaxAge}" --region "${RegionId}" --read-timeout 300 --connect-timeout 30 --user-agent AlibabaCloud-Agent-Skills` | Canonical incremental upload command via integrated ossutil | Not validated locally because `aliyun` was not installed in this repository, and not executed against a live bucket here | | `aliyun` CLI | `aliyun ossutil ls "oss://${BucketName}/${TargetOssPrefix}" --region "${RegionId}" --read-timeout 60 --connect-timeout 30 --user-agent AlibabaCloud-Agent-Skills` | Verify uploaded objects under the target prefix | Not validated locally because `aliyun` was not installed in this repository, and not executed against a live bucket here | | `aliyun` CLI | `aliyun ossutil rm "oss://${BucketName}/${TargetOssPrefix}test-object.txt" --region "${RegionId}" --read-timeout 60 --connect-timeout 30 --user-agent AlibabaCloud-Agent-Skills` | Optional cleanup for test artifacts | Not validated locally because `aliyun` was not installed in this repository | | Local OS | `crontab -l` | Verify cron registration on Linux/macOS | Validated locally | | Local OS | `schtasks /Query /TN "OSS Scheduled Sync" /V /FO LIST` | Verify Task Scheduler registration on Windows | Not validated locally in this macOS repository |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
In the capability notes, the same
rmpattern is presented as an available deletion capability, which normalizes destructive behavior without strong constraints. In a skill that automates uploads and verification, exposing a delete command tied to variable path components increases the chance of misuse or unsafe parameter propagation into a destructive operation.- Content
md | `aliyun ossutil stat "oss://${BucketName}" --region ... --output-format json` | Bucket metadata lookup | Used to verify bucket metadata and region | | `aliyun ossutil cp ... -r -u --max-age ... --region ...` | Object upload plus object comparison/listing for incremental behavior | Official scenario command through integrated `aliyun ossutil`; permissions align with object upload, read, and list needs | | `aliyun ossutil ls "oss://${BucketName}/${TargetOssPrefix}" --region ...` | Object listing under the target prefix | Post-upload verification under the target prefix | | `aliyun ossutil rm "oss://${BucketName}/${TargetOssPrefix}test-object.txt" --region ...` | Object deletion | Optional cleanup for test artifacts only | ## RAM/IAM Notes
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md > **Parameter Extraction** — Extract all user-customizable parameters directly from the user's request. > When the user's message already specifies values (such as region, bucket name, paths, schedule, or MaxAge), > use those values directly without asking for re-confirmation. > Only ask the user for clarification when a **required** parameter is genuinely missing from their request > and cannot be reasonably inferred from context.
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill contradicts its own boundary about not creating fake local artifacts when prerequisites are missing, then instructs the agent to create a local directory and test file automatically. That can misrepresent the user's real backup source, modify the local filesystem without explicit consent, and lead to uploads of unintended placeholder data that appear to validate the workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instructions direct the agent to run mkdir and write a file to the user-specified LocalSourcePath when that path does not exist, without an explicit warning or approval for local state changes. This creates unauthorized filesystem modifications and may write into sensitive or unexpected locations if the path was misunderstood but still passes validation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
The skill instructs adding cron entries, which creates persistence on the host by scheduling recurring execution. Even though this matches the business purpose, it is still a security-relevant state change because it can continue running after the session and repeatedly access local data and cloud resources if created without explicit approval.
- Content
If
systemctl start crondfails (e.g., no systemd in containers), you can still add cron entries viacrontab— the cron daemon is not strictly required for entry registration, only for actual execution. In such cases, document the cron entry for the user to deploy on their production host, and do not let the missing daemon block the rest of the workflow.bash crontab -eExample entry (use
echo ... | crontab -for non-interactive installation):
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The schtasks /Create command establishes persistent scheduled execution on Windows, which is a security-sensitive host modification. Although aligned with the skill's purpose, it can create unintended long-lived access to files and cloud credentials if executed automatically without a clear opt-in and preview.
- Content
Windows Task Scheduler via local CLI:
bat schtasks /Create /SC DAILY /ST 03:00 /TN "OSS Scheduled Sync" /TR "C:\tools\oss-sync-upload.bat"Label this step clearly as OS-local. It is not an Alibaba Cloud API action. Keep the scheduler output minimal and directly actionable; do not explode this step into extra README files, XML exports, PowerShell wrappers, demo payloads, or other auxiliary artifacts unless the user explicitly asks for them.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md Cleanup is optional because this skill is intended for recurring sync, but test artifacts and scheduler entries can be removed safely. **Linux/macOS cron** `[OS-local]`: - remove the cron line with `crontab -e` - delete the local script and log file only if the user explicitly wants rollback **Windows Task Scheduler** `[OS-local]`:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/
text ### Windows
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once ### Configuration Modes
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file is attached to an OSS scheduled-upload skill, but it provides a broad, general-purpose Aliyun CLI guide covering many authentication modes, ECS operations, plugin installation, debugging, custom endpoints, and other non-OSS workflows. In an agent-skill context, this scope expansion increases the chance an agent or user is guided into unnecessary capabilities and higher-risk actions outside the intended upload-only task boundary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The environment-variable examples and nearby credential-setting patterns normalize placing long-lived secrets directly in shell commands and environment configuration without consistently warning about shell history, process visibility, inherited environments, and persistence in user profiles or CI logs. In an automation-oriented skill, that omission materially increases the chance of credential leakage.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Restrict permissions chmod 600 ~/.aliyun/config.jsonTroubleshooting
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide explicitly encourages installing arbitrary Aliyun product plugins and exploring unrelated service commands. For a narrowly scoped OSS scheduled-sync skill, this broadens available functionality and can steer automation toward unintended cloud services and actions, violating least-privilege and least-capability expectations.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md | `aliyun` CLI | `aliyun ossutil cp "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}" -r -u --max-age "${MaxAge}" --region "${RegionId}" --read-timeout 300 --connect-timeout 30 --user-agent AlibabaCloud-Agent-Skills` | Canonical incremental upload command via integrated ossutil | Not validated locally because `aliyun` was not installed in this repository, and not executed against a live bucket here | | `aliyun` CLI | `aliyun ossutil ls "oss://${BucketName}/${TargetOssPrefix}" --region "${RegionId}" --read-timeout 60 --connect-timeout 30 --user-agent AlibabaCloud-Agent-Skills` | Verify uploaded objects under the target prefix | Not validated locally because `aliyun` was not installed in this repository, and not executed against a live bucket here | | `aliyun` CLI | `aliyun ossutil rm "oss://${BucketName}/${TargetOssPrefix}test-object.txt" --region "${RegionId}" --read-timeout 60 --connect-timeout 30 --user-agent AlibabaCloud-Agent-Skills` | Optional cleanup for test artifacts | Not validated locally because `aliyun` was not installed in this repository | | Local OS | `crontab -l` | Verify cron registration on Linux/macOS | Validated locally | | Local OS | `schtasks /Query /TN "OSS Scheduled Sync" /V /FO LIST` | Verify Task Scheduler registration on Windows | Not validated locally in this macOS repository | ## OSS Capability Notes
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md | `aliyun` CLI | `aliyun ossutil cp "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}" -r -u --max-age "${MaxAge}" --region "${RegionId}" --read-timeout 300 --connect-timeout 30 --user-agent AlibabaCloud-Agent-Skills` | Canonical incremental upload command via integrated ossutil | Not validated locally because `aliyun` was not installed in this repository, and not executed against a live bucket here | | `aliyun` CLI | `aliyun ossutil ls "oss://${BucketName}/${TargetOssPrefix}" --region "${RegionId}" --read-timeout 60 --connect-timeout 30 --user-agent AlibabaCloud-Agent-Skills` | Verify uploaded objects under the target prefix | Not validated locally because `aliyun` was not installed in this repository, and not executed against a live bucket here | | `aliyun` CLI | `aliyun ossutil rm "oss://${BucketName}/${TargetOssPrefix}test-object.txt" --region "${RegionId}" --read-timeout 60 --connect-timeout 30 --user-agent AlibabaCloud-Agent-Skills` | Optional cleanup for test artifacts | Not validated locally because `aliyun` was not installed in this repository | | Local OS | `crontab -l` | Verify cron registration on Linux/macOS | Validated locally | | Local OS | `schtasks /Query /TN "OSS Scheduled Sync" /V /FO LIST` | Verify Task Scheduler registration on Windows | Not validated locally in this macOS repository | ## OSS Capability Notes
Static analysis
Detected: suspicious.generated_source_template_injection
User-controlled placeholder is embedded directly into generated source code.
Critical
- Code
- suspicious.generated_source_template_injection
- Location
- SKILL.md:251