Alibabacloud Oss Manage Network Probe

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:14 AM UTC
• Version: 0.0.2

Overview

The skill is mostly an OSS network diagnostic helper, but it includes unsafe handling of presigned URLs plus broad CLI installation, plugin update, credential, and delete-permission guidance that should be reviewed before use.

Install only if you are comfortable granting the selected Alibaba Cloud profile access to the target OSS bucket. Prefer a least-privilege, test-only bucket or prefix; avoid copying Resource '*' policies into production; do not let the agent handle raw AK/SK values; verify CLI binaries/plugins through trusted package channels; and avoid the documented fixed /tmp presigned-URL script pattern unless it is replaced with a private temporary directory or pipe-based handling.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/cli-installation-guide.md:24

Finding

Unpinned CLI Binary and Plugin Installation Without Integrity Verification

Content

View full analysis

Remediation

View remediation

' 'aliyun-cli-linux-amd64.tgz' | sha256sum --check - ``` 3. Prefer vendor-signed packages and verify the signature against a pinned, authenticated vendor public key. 4. Abort installation if checksum or signature verification fails. 5. Extract the archive into a private temporary directory and inspect the expected file type and archive contents before installation. 6. Avoid enabling unrestricted automatic plugin installation. Install only the required `ossutil` plugin at a pinned version where the CLI supports version selection. 7. Replace broad `aliyun plugin update` behavior with an explicit, reviewed update procedure. 8. Record the installed CLI and plugin versions in probe results to support reproducibility and incident investigation. 9. Use the least privilege required for installation. Prefer a user-owned installation directory when system-wide installation is unnecessary. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:180

Finding

Predictable Temporary Files Expose Presigned URLs and Permit Symlink or Script-Replacement Attacks

Content

View full analysis

/" \ --expires-duration 1h \ --region "" \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-network-probe > /tmp/_presign_url.txt ``` ```bash # Step 2 — Create a probe script that reads the URL from the file and runs the download probe: cat > /tmp/_run_presign_probe.sh << 'PROBE_SCRIPT' #!/bin/bash PRESIGN_URL=$(cat /tmp/_presign_url.txt) aliyun ossutil probe \ --download \ --url "$PRESIGN_URL" \ "" \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-network-probe PROBE_SCRIPT bash /tmp/_run_presign_probe.sh ``` The associated fallback states: ```text If `/tmp/` is not writable, use the current workspace directory for the temporary file and script instead. ``` ### Technical Analysis The workflow uses two fixed, globally predictable paths: - `/tmp/_presign_url.txt` - `/tmp/_run_presign_probe.sh` The signed URL is a time-limited bearer capability that can grant access to a private OSS object. The instructions do not create a private temporary directory, set a restrictive `umask`, atomically create files, validate ownership, reject symbolic links, or remove the sensitive files after execution. On a multi-user system, another local user can pre-create either pathname. Shell redirection follows symbolic links, so pre-creating `/tmp/_presign_url.txt` as a symlink can redirect the presign output to another writable target. Depending on the process umask, the URL file may also be readable by other local users. The script presents an additional time-of-check/time-of-use risk. It is written to a predictable path and subse ...[truncated 2345 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (18)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 381)May include surrounding context.

md

For all commands, underlying OSS capability mappings, and which steps are local client-side logic only, see `references/related-apis.md`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 402)May include surrounding context.

md

For all commands, underlying OSS capability mappings, and which steps are local client-side logic only, see `references/related-apis.md`.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The skill includes a destructive command example, aliyun ossutil rm, as a supported pattern. Even though it appears in a probe-cleanup context, it normalizes deletion capability within the workflow and could be misapplied to real user objects if bucket/object values are substituted unsafely or executed without explicit confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 171)May include surrounding context.

aliyun ossutil stat "oss://examplebucket/big/test.bin" --user-agent AlibabaCloud-Agent-Skills aliyun ossutil presign "oss://examplebucket/private/test.bin" --expires-duration 1h --user-agent AlibabaCloud-Agent-Skills aliyun ossutil cp "/tmp/test.bin" "oss://examplebucket/probe/test.bin" --user-agent AlibabaCloud-Agent-Skills aliyun ossutil rm "oss://examplebucket/probe/test.bin" --user-agent AlibabaCloud-Agent-Skills

text

Why correct:

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This section includes credential provisioning and management instructions, including non-interactive aliyun configure set examples with access keys, STS tokens, and role modes. Even though the text warns agents not to execute them, embedding credential setup inside a skill for network diagnostics normalizes sensitive operations and creates a path for credential capture, persistence, or misuse in an agent-assisted workflow.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/ram-polices.md (reported line 23)May include surrounding context.

md

| `probe --probe-item download-speed --bucket <bucket> --object <object>` | `oss:GetObject` | Repeatedly downloads the object and measures throughput |
| `probe --probe-item download-time --bucket <bucket> --object <object>` | `oss:GetObject` | Downloads and calculates elapsed time |
| `ossutil cp <local_file> oss://<bucket>/<object>` | `oss:PutObject` | Prepares test objects |
| `ossutil rm oss://<bucket>/<object>` | `oss:DeleteObject` | Cleans up explicitly created test objects |
| `ossutil stat oss://<bucket>/<object>` | `oss:GetObject` | Views object metadata |
| `ossutil ls oss://<bucket>/<prefix>` | `oss:ListObjects` | Lists objects to confirm paths |
| `ossutil presign oss://<bucket>/<object>` | Usually none extra for single object; `oss:ListObjects` if recursive/batch | Local signing; listing is required for recursive operations |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/related-apis.md (reported line 31)May include surrounding context.

md

| Download time probe | `aliyun ossutil probe --probe-item download-time --bucket <bucket> --object <object> --user-agent AlibabaCloud-Agent-Skills` | Timed download with optional part size and parallelism | `oss:GetObject` | `--parallel` / `--part-size` only valid for this mode |
| Optional prep upload | `aliyun ossutil cp "<local_file>" "oss://<bucket>/<object>" --user-agent AlibabaCloud-Agent-Skills` | Upload local file to OSS | `oss:PutObject` | Prepares test objects for `download-speed` |
| Optional presigned URL | `aliyun ossutil presign "oss://<bucket>/<object>" --expires-duration 1h --user-agent AlibabaCloud-Agent-Skills` | Local signing for a specific OSS object URL | Usually no additional OSS call for a single object URL | May require `oss:ListObjects` for recursive/batch URL generation |
| Optional cleanup | `aliyun ossutil rm "oss://<bucket>/<object>" --user-agent AlibabaCloud-Agent-Skills` | Delete probe object | `oss:DeleteObject` | Only used when the user confirms deletion of explicitly created test objects |

## Important Notes

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 224)May include surrounding context.

md

#### INCORRECT
- Only CLI help output is shown without actual probe results
- After an error, still claiming the probe succeeded, or describing a failure as "task completed successfully"
- Retaining or deleting user test objects without confirmation
- Writing the full presigned URL, STS token, or local credential file contents in logs or the final answer
- After `NoSuchBucket` / `AccessDenied`, enumerating unconfirmed regions, buckets, or endpoints and drawing conclusions from them
- In a `cycle-symlink` scenario, writing a complete cyclic chain as verified fact when supplementary forensics did not actually read a particular segment's target

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file is scoped as an OSS network-probe skill, but the guide provides broad Aliyun CLI installation, authentication, plugin, and multi-service operational guidance far beyond OSS diagnostics. In an agent setting, this unnecessary expansion increases attack surface and can enable unrelated cloud administration actions if the agent or user follows the document too broadly.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The guide instructs users to create and retain long-lived AccessKey material and then persist it in CLI configuration, which establishes durable credential presence on disk. For a skill intended only for OSS network diagnostics, encouraging creation and storage of reusable credentials increases risk of credential leakage, lateral use, and unintended session persistence beyond the task scope.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 126)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The latter half of the guide promotes unrelated service operations such as ECS API calls, plugin installation, and broader CLI exploration, none of which are necessary for OSS probing. In skill context, this broadens capability discovery and may steer an agent or user into executing cloud-management actions outside the intended diagnostic scope.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 413)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document provides example policies and workflows that include oss:PutObject and oss:DeleteObject for temporary-object and troubleshooting probes, but the example section does not prominently warn that these operations can modify bucket contents or delete objects if users scope permissions or target paths incorrectly. In a troubleshooting skill, this omission can lead operators to grant destructive permissions broadly and run cleanup commands against business data without fully understanding the risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The optional cleanup section instructs deletion of an OSS object with aliyun ossutil rm, which introduces a state-changing and potentially destructive action into a verification workflow that is otherwise diagnostic. If the bucket/object parameters are incorrect, reused from production, or influenced by prior context, this can cause unintended data loss beyond the scope of network probing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example configuration stores the CLI setting as "language": "en", which communicates a fixed language preference in the guide. Because the document does not present this as optional or offer a locale choice, it can be read as endorsing a mandatory language setting.

Content

No source excerpt is available for this finding.