alibabacloud-pai-dlc-job

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:49 AM UTC
• Version: 0.0.2

Overview

The skill is mostly coherent for Alibaba Cloud PAI-DLC job management, but its install, credential, and permission guidance is too broad and risky for default use.

Install only if you are comfortable reviewing the referenced setup docs first. Prefer a package manager or verified pinned Aliyun CLI release, avoid auto plugin updates unless you accept new remote code, configure credentials outside the agent using short-lived or least-privileged identities, and narrow RAM permissions to the specific workspace/job operations you actually need.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:41

Finding

Unverified Privileged Installation of a Mutable CLI Binary

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:50

Finding

Automatic and Unpinned Aliyun Plugin Installation and Update

Content

View full analysis

/dev/null 2>&1 || aliyun plugin install --names aliyun-cli-aiworkspace aliyun plugin update ``` A further unpinned installation fallback appears in `references/verification-method.md:103-105`: ```bash aliyun aiworkspace --help >/dev/null 2>&1 \ || aliyun plugin install --names aliyun-cli-aiworkspace ``` ### Technical Analysis The skill enables automatic plugin installation and directs the user to install or update plugins without specifying an approved version or performing an independent authenticity check. This makes the runtime behavior dependent on whatever plugin release the remote distribution channel serves at execution time. The unconditional `aliyun plugin update` command can replace previously reviewed components with newer, unreviewed code. Enabling `--auto-plugin-install true` further reduces visibility by permitting dependencies to be installed implicitly when commands are invoked. ### Attack Path 1. An attacker compromises the plugin repository, plugin publisher account, update metadata, or distribution channel. 2. A malicious release is published under the expected plugin name. 3. The skill enables automatic plugin installation or executes the unpinned install/update command. 4. The malicious plugin is loaded by the legitimate Aliyun CLI. 5. The plugin executes in the user's context and can access cloud configuration, command parameters, and API responses. 6. It can modify intended API requests, capture credentials or tokens, or invoke unauthorized cloud operations. ### Impact Assessment The resulting code executes with the local privileges of the user running the skill and within a process that has access to configured Alibaba Cloud authe ...[truncated 213 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/cli-installation-guide.md:121

Finding

Cloud Credentials Exposed Through Command-Line Arguments and Environment Variables

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` The guide repeats this pattern with credential-shaped examples at lines 147-151, 178-183, and 193-197. It also recommends exported credentials at lines 246-260: ```bash export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret export ALIBABA_CLOUD_REGION_ID=cn-hangzhou ``` ```bash export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token export ALIBABA_CLOUD_REGION_ID=cn-hangzhou ``` These instructions conflict with the security rules in `SKILL.md:119-122`, which prohibit asking for credentials directly or using `aliyun configure set` with literal credential values. ### Technical Analysis Supplying an access-key secret or STS token as a command-line argument can expose it through: - Shell history files. - Process listings and process-inspection interfaces. - Terminal session recording. - CI/CD command tracing. - Debug and audit logs. - Error-reporting or telemetry systems. Exporting credentials as environment variables causes them to be inherited by child processes. Depending on the platform and process permissions, other local processes, diagnostic tools, crash handlers, or compromised dependencies may be able to inspect them. Although the examples use placeholders, they explicitly direct users to substitute real credentials into these unsafe channels. ### Attack Path 1. A user follows the guide and replaces the placeholders with valid Alibaba Cloud credentials. 2. The command is recorded in shell history, process monitoring, CI lo ...[truncated 870 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/ram-policies.md:37

Finding

Account-Wide Job Management and Terminal Permissions in the Standard RAM Policy

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description limits scope to PAI-DLC job CRUD, monitoring, and GPU sanity check, but the documented workflow also includes AIWorkSpace discovery calls such as listing workspaces, images, datasets, and code sources. Those cross-product operations are treated as required steps for create-job in the body of the skill, so the manifest understates actual operational scope.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is described as managing PAI-DLC jobs, monitoring them, and listing GPU sanity check results, but this file instructs users to configure multiple global Aliyun authentication modes, ECS RAM roles, custom ECS endpoints, proxy settings, and to run generic ECS commands such as describe-regions. Those capabilities are broader than what is justified for a narrowly scoped PAI-DLC job-management skill and encourage account-wide cloud access setup rather than service-specific usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The examples place long-lived secrets directly on the command line via --access-key-id and --access-key-secret. In many environments, command-line arguments can be exposed through shell history, process listings, CI logs, or telemetry, which can leak cloud credentials and enable unauthorized access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 135)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 421)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest advertises triggers for core PAI-DLC job operations, logs, events, and sanity checks, but the skill also documents use of commands like list-workspaces, list-image-labels, list-images, list-datasets, list-code-sources, and list-ecs-specs. While related to job creation, these capabilities broaden the practical behavior beyond what the manifest says is covered.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.