Security audit

Alibabacloud Oss Manage Metaquery

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a real Alibaba Cloud OSS MetaQuery/search helper, but it needs Review because setup and workflows include unsafe remote installation, persistent CLI/plugin changes, and powerful OSS deletion/access operations.

Install only if you are comfortable granting an agent Alibaba Cloud OSS authority. Use a test bucket or tightly scoped RAM role, avoid long-lived AccessKeys when possible, do not run the curl-to-bash installer without independent verification, disable automatic plugin installation after setup, and require exact bucket/object confirmation before any delete, close-index, upload, or presigned-link operation.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:20
Finding: Unverified Remote Installer Is Piped Directly to Bash
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, line 20
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

Technical Analysis

The installation instruction downloads a mutable shell script from an external URL and immediately passes it to Bash. The script is neither pinned to a specific release nor verified with a cryptographic checksum or signature before execution.

HTTPS protects the connection in transit under normal conditions, but it does not establish payload immutability. The effective code executed can change after this Skill has been reviewed. A compromise of the remote host, CDN, publishing process, DNS or certificate infrastructure could therefore turn this prerequisite into an arbitrary-code execution channel.

This behavior is not necessary for the declared OSS and MetaQuery functionality. The included CLI installation guide already documents a safer download-and-extract workflow, so directly executing network content exceeds the minimum mechanism required to install the CLI.

Attack Path

A user or agent follows the prerequisite instruction in SKILL.md.

The command requests setup.sh from the external distribution endpoint.

The endpoint or its delivery infrastructure returns a modified installer.

The pipe sends the response directly to Bash without prior inspection or integrity verification.

The modified script executes with the privileges of the user who invoked the command.

The payload can access that user's files, processes, environment, and locally available credentials, including Alibaba Cloud configuration accessible to the account.

If the command is invoked from a privileged account, the payload inherits that elevated scope.

Impact Assessment

Successful exploitation permits arbitrary command execution with the invoking user's ...[truncated 563 chars]
Remediation: View remediation
Remediation Suggestions

Remove the curl | bash installation instruction.

Pin the CLI to a reviewed, explicit version rather than using a mutable installer or latest artifact.

Download the release artifact to disk without executing it.

Verify an independently published cryptographic signature or SHA-256 checksum before extraction.

Abort installation if verification fails.

Extract the verified artifact into a staging directory and inspect the expected files before installation.

Prefer a trusted operating-system package manager where available.

Install into a user-owned directory when possible; request administrative privileges only if installation into a system directory is explicitly necessary.

Disable automatic plugin installation by default and pin reviewed plugin versions where the CLI supports this, reducing related mutable supply-chain exposure.

Document the expected download origin, version, checksum, installation destination, and rollback procedure.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (41)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The implementation uses oss2.models.MetaQuery with a raw scalar query string and sorts results by file size. This is standard metadata/scalar retrieval over OSS object metadata, not AI content awareness or semantic/vector retrieval. The declared description emphasizes OSS semantic search, vector search, and multimodal text-to-image/video search, but none of those capabilities appear in the code. The code also does not enable or configure indexing; it only submits a bucket meta query and prints file attributes. Therefore the declared purpose materially overstates and misrepresents the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description focuses on AI-powered OSS content awareness features: enabling and querying semantic/vector search and related retrieval functions. The actual code only closes/disables the OSS MetaQuery feature on a specified bucket. That is a materially different primary purpose: an administrative shutdown action rather than search, query, or enablement of AI content awareness. While MetaQuery is mentioned in the description, this script does the opposite of 'enabling and querying' and does not provide any of the advertised search capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description focuses on OSS AI Content Awareness features such as semantic search, vector search, text-to-image/video search, and MetaQuery/data indexing. The actual code does none of these. It parses region/bucket/endpoint arguments, authenticates to OSS, constructs a bucket client, and calls create_bucket(). That is an OSS infrastructure management capability, not AI content understanding or search. This is a material purpose mismatch, not just a supporting detail.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description centers on OSS AI Content Awareness and semantic/vector search features: enabling indexing/content understanding and querying by text or multimodal search. The actual code chunk does none of that. It only validates arguments, checks local file existence, authenticates to OSS, and uploads a file with an x-oss-tagging header containing a creation timestamp. While tagging could be a supporting step for later search workflows, this chunk’s primary behavior is straightforward object upload, which is a materially different purpose from enabling or querying AI content awareness/search. Therefore the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: Piping a remotely fetched script directly into bash is dangerous because it executes unverified code from the network with the user's privileges, enabling supply-chain compromise, man-in-the-middle tampering, or malicious upstream changes. In a skill context, this is especially risky because users may run the command verbatim and agents may normalize such unsafe bootstrap patterns.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
If Aliyun CLI is already installed, ossutil does not need to be installed separately. > Run the following command to verify the version: `aliyun version` > If not installed or the version is below 3.3.3, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or refer to [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions. > > Then [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: The documented delete-bucket command is inherently destructive and parameter-sensitive: if an agent substitutes the wrong bucket name, the entire bucket can be irreversibly removed. Even with a confirmation note, including powerful deletion primitives in a broad skill materially increases the chance of catastrophic data loss from prompt confusion, parameter injection, or user misunderstanding.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
md
## Dangerous Operation Confirmation Before executing any of the following dangerous operations, **you MUST confirm with the user first** and obtain explicit consent before proceeding: - **Delete Bucket**: `aliyun ossutil rm oss://<bucket-name> -b --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Deletes the entire Bucket, irreversible - **Delete Object**: `aliyun ossutil rm oss://<bucket-name>/<object-key> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Deletes a specific file - **Batch Delete Objects**: `aliyun ossutil rm oss://<bucket-name>/ --recursive --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Recursively deletes all files in the Bucket - **Close MetaQuery**: `aliyun ossutil api close-meta-query --bucket <bucket-name> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Closes the metadata index; all indexed data will be cleared

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 92% confidence
Finding: Single-object deletion remains dangerous because object keys are attacker-controllable strings in many workflows and may be selected incorrectly by an agent or user. In a storage-management context, exposing direct delete primitives alongside search features increases the chance of accidental or manipulated deletion of valuable data.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
## Dangerous Operation Confirmation Before executing any of the following dangerous operations, **you MUST confirm with the user first** and obtain explicit consent before proceeding: - **Delete Bucket**: `aliyun ossutil rm oss://<bucket-name> -b --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Deletes the entire Bucket, irreversible - **Delete Object**: `aliyun ossutil rm oss://<bucket-name>/<object-key> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Deletes a specific file - **Batch Delete Objects**: `aliyun ossutil rm oss://<bucket-name>/ --recursive --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Recursively deletes all files in the Bucket - **Close MetaQuery**: `aliyun ossutil api close-meta-query --bucket <bucket-name> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Closes the metadata index; all indexed data will be cleared - **Open MetaQuery**: `python scripts/open_metaquery.py --region <your-region> --bucket <your-bucket-name> --endpoint <your-endpoint>` -- Opens the metadata index; existing data will start being indexed. If the bucket has more than 1000 objects, confirm with the user first.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: Recursive bucket deletion is the highest-risk command in the file because a wrong bucket or prefix can wipe large datasets irreversibly. This is especially dangerous in agent-driven workflows where parameter confusion, prompt injection, or misresolution of placeholders can transform a search/indexing task into mass destructive action.
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
md
Before executing any of the following dangerous operations, **you MUST confirm with the user first** and obtain explicit consent before proceeding: - **Delete Bucket**: `aliyun ossutil rm oss://<bucket-name> -b --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Deletes the entire Bucket, irreversible - **Delete Object**: `aliyun ossutil rm oss://<bucket-name>/<object-key> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Deletes a specific file - **Batch Delete Objects**: `aliyun ossutil rm oss://<bucket-name>/ --recursive --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Recursively deletes all files in the Bucket - **Close MetaQuery**: `aliyun ossutil api close-meta-query --bucket <bucket-name> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Closes the metadata index; all indexed data will be cleared - **Open MetaQuery**: `python scripts/open_metaquery.py --region <your-region> --bucket <your-bucket-name> --endpoint <your-endpoint>` -- Opens the metadata index; existing data will start being indexed. If the bucket has more than 1000 objects, confirm with the user first. - **Create Bucket**: `aliyun ossutil api put-bucket --bucket <bucket> --region <region-id> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Creates a Bucket

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes a skill for enabling and querying OSS semantic search and AI-powered content understanding. This file performs the opposite administrative action by calling close_bucket_meta_query(), which turns the MetaQuery capability off rather than enabling or querying it.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This script performs bucket creation, which is a privileged infrastructure-management action outside the stated purpose of an OSS semantic search/metaquery skill. In an agent context, exposing create operations under a search-oriented skill can enable unintended resource provisioning, policy bypass of least privilege, and abuse of configured cloud credentials if invoked by prompts that appear related to search.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill expands beyond its stated semantic-search purpose into broader bucket administration, deletion, and data-access operations. Broad operational scope increases the chance that an agent using this skill performs destructive or unnecessary actions under the guise of a search workflow, especially because the same document includes irreversible delete commands and presigned URL generation.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: The skill enables persistent configuration changes on the host CLI, including AI mode and automatic plugin installation, and relies on cleanup instructions to revert them later. Persistent state changes are risky because failures, interruptions, or partial execution can leave the environment altered, affecting later commands, trust boundaries, or telemetry behavior beyond the intended session.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
- **Batch Delete Objects**: `aliyun ossutil rm oss://<bucket-name>/ --recursive --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Recursively deletes all files in the Bucket - **Close MetaQuery**: `aliyun ossutil api close-meta-query --bucket <bucket-name> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Closes the metadata index; all indexed data will be cleared - **Open MetaQuery**: `python scripts/open_metaquery.py --region <your-region> --bucket <your-bucket-name> --endpoint <your-endpoint>` -- Opens the metadata index; existing data will start being indexed. If the bucket has more than 1000 objects, confirm with the user first. - **Create Bucket**: `aliyun ossutil api put-bucket --bucket <bucket> --region <region-id> --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-metaquery` -- Creates a Bucket When confirming, explain the following to the user: 1. The specific operation to be performed

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
md
- Option 2: Choose a new bucket name (user provides the new name) 4. **Wait for the user's response** before continuing **PROHIBITED:** - Automatically modifying the bucket name (e.g., appending `-2`, `-new`, etc.) - Using an existing bucket without asking the user ### Rule 3: Use Aliyun CLI by default for all operations except opening MetaQuery

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.
md
4. **Wait for the user's response** before continuing **PROHIBITED:** - Automatically modifying the bucket name (e.g., appending `-2`, `-new`, etc.) - Using an existing bucket without asking the user ### Rule 3: Use Aliyun CLI by default for all operations except opening MetaQuery The following operations should use Aliyun CLI by default:

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Including generic object transfer operations in the core workflow broadens the skill from query/index tasks into general data movement. In an agent context, this creates risk of copying, uploading, or overwriting data without a strict need for the declared feature, which increases the attack surface for unintended data handling.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Presigned URL generation creates direct temporary access links to bucket objects, which can expose sensitive content outside the normal access-control flow if shared, logged, or surfaced in the wrong channel. Because this capability is not essential to semantic search itself, embedding it in the skill increases risk of unintended data disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document instructs users to enable AI content awareness and semantic search over uploaded OSS objects and verify generated descriptions/summaries, but it does not warn that object contents and derived metadata may be processed, indexed, and exposed in ways that create privacy, compliance, or data-governance risk. In a storage/search skill specifically designed to analyze user files, omitting an explicit data-processing warning makes accidental ingestion of sensitive or regulated content more likely.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file is substantially broader than the stated OSS MetaQuery/semantic-search skill scope: it teaches generic Aliyun CLI installation, account configuration, credential handling, IAM modes, and unrelated service usage. In an agent skill context, this expands the operational surface area and can steer users or downstream agents into performing privileged cloud actions unrelated to the advertised capability.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide explicitly encourages installing arbitrary Alibaba Cloud product plugins and exploring unrelated service commands, which is unnecessary for an OSS semantic search skill. In an agent ecosystem this can normalize capability expansion and increase the risk of unintended access to other cloud services if users follow or automate these instructions.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 39)May include surrounding context.
Extract

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

Move to PATH

sudo mv aliyun /usr/local/bin/

Verify

aliyun version

text

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 50)May include surrounding context.
Extract

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

Move to PATH

sudo mv aliyun /usr/local/bin/

Verify

aliyun version

text

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 60)May include surrounding context.
Extract

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

Move to PATH

sudo mv aliyun /usr/local/bin/

Verify

aliyun version

text

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 70)May include surrounding context.
Extract

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

Move to PATH

sudo mv aliyun /usr/local/bin/

Verify

aliyun version

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guide shows long-lived access keys being supplied directly on the command line and stored in plaintext configuration, without prominently warning that shell history, process inspection, logs, and local files may expose secrets. In a skill context, this is especially dangerous because users may copy-paste the pattern into shared workstations, CI, or agent-driven automation where credential leakage can lead to cloud account compromise.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 87% confidence
Finding: The guidance encourages creating and preserving an AccessKey secret as part of normal setup, reinforcing use of persistent credentials for a skill that could instead emphasize temporary or role-based authentication. In the context of an OSS semantic search skill, normalizing long-lived secret retention increases the chance of credential reuse, leakage, and later misuse across broader Alibaba Cloud resources.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 105)May include surrounding context.
md
**Where to Get Access Keys** 1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once ### Configuration Modes Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Tp4

Tp4

Tp4

Tp4

External Script Fetching

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Description-Behavior Mismatch

Description-Behavior Mismatch

Description-Behavior Mismatch

Session Persistence

Autonomous Decision Making

Autonomous Decision Making

Description-Behavior Mismatch

Context-Inappropriate Capability

Missing User Warnings

Description-Behavior Mismatch

Context-Inappropriate Capability

Sudo/Root Execution

Extract

Move to PATH

Verify

Sudo/Root Execution

Extract

Move to PATH

Verify

Sudo/Root Execution

Extract

Move to PATH

Verify

Sudo/Root Execution

Extract

Move to PATH

Verify

Missing User Warnings

Session Persistence

Static analysis