Alibabacloud Pai Dlc Job Diagnostics

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:55 AM UTC
• Version: 0.0.1

Overview

The skill is mostly a real read-only Alibaba Cloud diagnostics runbook, but its setup and credential guidance are broader and riskier than the stated scope.

Install only after reviewing the setup path. Use a dedicated least-privilege read-only RAM identity, avoid pasting secrets into command lines or shared logs, avoid broad existing cloud profiles, and prefer pinned or verified CLI/plugin versions with auto-plugin installation disabled unless you explicitly accept that supply-chain risk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:39

Finding

Unpinned and Unverified Executable Dependencies

Content

View full analysis

/dev/null 2>&1 || aliyun plugin install --names aliyun-cli-paistudio aliyun configure ai-mode enable aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-pai-dlc-job-diagnostics" # After session: aliyun configure ai-mode disable ``` `references/cli-installation-guide.md:37-45`: ```bash # Download wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz # Extract and install tar -xzf aliyun-cli-linux-latest-amd64.tgz mv aliyun /usr/local/bin/ # Verify aliyun version ``` `references/cli-installation-guide.md:64-71`: ```bash # Download ARM64 version wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz # Extract and install tar -xzf aliyun-cli-linux-latest-arm64.tgz mv aliyun /usr/local/bin/ ``` ### Technical Analysis The Skill installs executable components through several mutable supply-chain channels: 1. The `npx skills add` commands do not pin the `skills` package, repository revision, release tag, or downloaded Skill version. 2. `--auto-plugin-install true` permits future commands to install plugins implicitly without a separate integrity-re ...[truncated 2204 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:102

Finding

Cloud Credentials Exposed Through Command Arguments and Environment Variables

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` ```text All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` `references/cli-installation-guide.md:130-136`: ```bash aliyun configure set \ --mode AK \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` `references/cli-installation-guide.md:161-166`: ```bash aliyun configure set \ --mode StsToken \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --sts-token v1.0:XXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` `references/cli-installation-guide.md:227-243`: ```bash export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret export ALIBABA_CLOUD_REGION_ID=cn-hangzhou ``` ```bash export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token export ALIBABA_CLOUD_REGION_ID=cn-hangzhou ``` ### Technical Analysis The guide recommends supplying access-key secrets and STS tokens through command-line flags and describes this approach as suitable for scripts, CI/CD sy ...[truncated 2615 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (14)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest-style description advertises triggers such as "diagnose", "inspection", and "health check", which are generic phrases that could appear in many unrelated conversations. The file does not provide exclusion conditions or scope constraints to narrow when this skill should activate versus other diagnostic skills.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs users to install and run a remote package via npx skills without pinning an exact version. That creates a supply-chain risk: a later compromised or maliciously updated package could be fetched and executed at runtime, and the command is presented as a prerequisite step users may follow directly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This is a second unpinned npx skills installation command, again allowing execution of the latest available package code from the registry. Because the skill is an operational runbook, users are likely to copy-paste it, making accidental execution of unreviewed remote code more plausible.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This guide substantially expands beyond a read-only PAI-DLC diagnostics skill by teaching broad Aliyun CLI installation, authentication, service usage, and plugin operations. In an agent-skill context, embedding general cloud-operational instructions increases the chance the skill is used to obtain or exercise capabilities unrelated to diagnostics, weakening the claimed read-only boundary.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The quick-start configuration example instructs users to set persistent credentials with a write-capable CLI despite the skill being described as a read-only diagnostic companion. That mismatch is dangerous because it normalizes provisioning reusable cloud credentials and broad CLI access where only constrained inspection access should be necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide shows users how to place access keys directly into CLI arguments and persistent configuration without an immediate, prominent warning about local credential exposure. Secrets passed on the command line and stored in config files can be exposed via shell history, process listings, backups, or accidental file disclosure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The examples include realistic-looking plaintext credential fields in commands and JSON, which can normalize unsafe secret handling and increase the chance users paste real values into documentation, tickets, or logs. While the shown values appear illustrative rather than live secrets, the presentation still models insecure operational behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Documenting cross-account and elevated authentication modes such as RamRoleArn and RamRoleArnWithEcs is not justified for a read-only diagnostics skill and can enable broader privilege acquisition. Because these modes facilitate role assumption and privilege escalation pathways, their inclusion materially increases risk if the skill guidance is followed in production environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The environment variable examples normalize exporting long-lived credentials without warning that such values may leak through CI logs, debugging output, inherited environments, crash reports, or host-level process inspection. For an automation-oriented skill, that omission is especially risky because CI/CD and agent environments often propagate env vars widely.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The plugin installation section encourages installing arbitrary product plugins such as ECS, VPC, and RDS, which are unrelated to narrow PAI-DLC diagnostics. In a skill package, this broadens the operator's available command surface and can facilitate lateral use of the CLI for non-diagnostic cloud actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The instruction to "NEVER use hedging words" imposes a fixed communication policy on the generated report. This is a natural-language constraint that removes flexibility in phrasing without offering the user a choice or documenting why this language restriction is required.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Line L05 says the purpose is merely "Skill testing acceptance criteria," but the documented scenarios in this file and the provided manifest describe a real operational diagnostics skill for PAI-DLC jobs. This is an active contradiction in documentation intent rather than a simple omission, because it characterizes the skill as test-only while the surrounding content specifies production diagnostic behavior.

Content

No source excerpt is available for this finding.