Alibabacloud Pai Dsw Manage

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:26 AM UTC
• Version: 0.0.2

Overview

The skill's cloud-management purpose is legitimate, but its setup guidance asks users to run mutable installers, enable persistent automatic plugin installation, update unrelated plugins, and handle cloud credentials in unsafe ways.

Review before installing. Use a trusted package manager or a pinned, verified Alibaba Cloud CLI release instead of `curl | bash` or mutable latest archives; do not enable automatic plugin installation or update unrelated plugins unless you explicitly accept that broader change. Configure credentials outside the agent session, avoid pasting access keys or tokens into commands or chats, and use narrowly scoped RAM permissions because this skill can create, update, start, and stop billable cloud resources.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:21

Finding

Remote installation script is downloaded and executed without verification

Content

View full analysis

**Pre-check: Aliyun CLI >= 3.3.3 required** > > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update, > or see [`references/cli-installation-guide.md`](references/cli-installation-guide.md) for installation instructions. ``` ### Technical Analysis The command pipes an HTTPS response directly into Bash. Consequently, the code reviewed in this project is not the code that will necessarily execute when the Skill is used. The effective payload remains mutable and is controlled by the remote distribution endpoint. No fixed version, cryptographic checksum, signature, or local review step is required before execution. HTTPS authenticates the connection to the endpoint but does not protect against compromise of the hosting infrastructure, distribution account, DNS/TLS trust chain, or future unauthorized modification of the hosted script. Direct remote shell execution is not necessary for the declared PAI DSW management functionality. The documentation already offers package-manager and binary installation alternatives, so this behavior exceeds the minimum safe installation mechanism. ### Attack Path 1. The Aliyun CLI is absent or does not meet the required version. 2. The Agent follows the Skill's update instruction. 3. `curl` retrieves the current contents of `setup.sh` from the remote endpoint. 4. The response is passed directly to Bash without being saved or inspected. 5. Any commands in the response execute with the privileges and environment of the user running the Agent. 6. A malicious payload could modify user files, read accessible credentials, install altered tooling, or attempt to obtain additional privileges. ### Impact Assessment A malicious remote response ...[truncated 555 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:26

Finding

Mandatory automatic plugin installation and unrestricted plugin updates expand the supply-chain attack surface

Content

View full analysis

**Pre-check: Aliyun CLI plugin update required** > [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ```bash # macOS (recommended) brew install aliyun-cli # Verify version (>= 3.3.3) aliyun version # Enable automatic plugin installation aliyun configure set --auto-plugin-install true # Update existing plugins aliyun plugin update # Install pai-dsw plugin aliyun plugin install --names pai-dsw ``` ``` ### Technical Analysis The Skill mandates two broad dependency-management actions: - Enabling automatic plugin installation for future CLI commands. - Updating every existing plugin, rather than only installing or updating the plugin required by this Skill. The instructions do not pin a plugin version, verify a checksum or signature, identify an approved repository snapshot, or require explicit user confirmation before changing unrelated plugins. The resulting plugin code can therefore differ from the components reviewed during this audit. Updating all existing plugins exceeds the minimum needs of PAI DSW lifecycle management. Only the `pai-dsw` plugin is directly relevant to the declared functionality. Persistently enabling automatic installation also changes CLI behavior beyond the current operation and may cause future commands to retrieve components without a distinct approval step. ### Attack Path 1. The Agent follows the mandatory pre-check and enables automatic plugin installation. 2. The Agent invokes `aliyun plugin update`, affecting all installed plugins. 3. The CLI retrieves current plugin packages from its configured remote source. 4. A compromised repository, publishing account, distribution path, or plugin release supplie ...[truncated 818 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/cli-installation-guide.md:103

Finding

Access keys and security tokens are passed through command-line arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` The guide repeats the same pattern for literal access keys and STS tokens, including examples such as: ```bash aliyun configure set --mode StsToken \ --access-key-id XXXX --access-key-secret XXXX \ --sts-token XXXX --region cn-hangzhou ``` ### Technical Analysis Supplying secrets as command-line arguments can expose them through shell history, terminal transcripts, process inspection facilities, CI/CD logs, debugging output, command auditing systems, or Agent conversation records. The guide explicitly describes non-interactive command-line flags as the recommended approach, increasing the likelihood that users will follow this unsafe pattern in scripts and Agent-driven automation. This also conflicts with `SKILL.md:57-59`, which says never to request AK/SK values directly or use `aliyun configure set` with literal credential values. Although the examples use placeholders, they instruct users to replace those placeholders with real secrets. The vulnerability is therefore in the prescribed credential-handling workflow rather than a hardcoded project credential. ### Attack Path 1. A user follows the linked installation guide to configure authentication. 2. The user replaces the placeholders with a real access key, secret, or STS token. 3. The complete command is recorded in shell history, an Agent transcript, CI logs, or process-monitoring data. 4. Another local user, support operator, log reader, compromised process, or unauthorized log consumer obtains the credential ...[truncated 725 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:39

Finding

Mutable latest-version binaries are installed into a privileged executable path without integrity verification

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (12)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to execute a remote installation script directly via curl | bash, which runs unverified code from the network in the user's shell with their local privileges. In a cloud-management skill context, this is especially risky because the same environment may already contain authenticated Alibaba Cloud CLI profiles or other sensitive credentials, so a compromised or tampered installer could lead to credential theft or arbitrary system compromise.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

> **Pre-check: Aliyun CLI >= 3.3.3 required**
>
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see [`references/cli-installation-guide.md`](references/cli-installation-guide.md) for installation instructions.

> **Pre-check: Aliyun CLI plugin update required**

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 113)May include surrounding context.

md

if TotalCount > 0:
    print("Name already exists")  # May miss partial matches

# Wrong pattern 2: Assuming no exact match without checking
# Response: TotalCount=2, Instances=[{"InstanceName":"my_instance_v2"}, {"InstanceName":"my_instance"}]
# Agent incorrectly concludes: "ExactNameMatch: false"
# This is WRONG - must verify by iterating through ALL instances

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guide explicitly recommends non-interactive use of aliyun configure set with --access-key-id and --access-key-secret on the command line. Passing long-lived secrets as CLI arguments can expose them to shell history, CI logs, audit logs, and process listings visible to other local users, making credential theft materially easier.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 117)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document shows a config example containing plaintext access_key_id and access_key_secret in ~/.aliyun/config.json before prominently warning that the file is sensitive. This can normalize storing reusable cloud credentials on disk without adequate protection, increasing the risk of secret disclosure through weak file permissions, backups, screenshots, or accidental inclusion in support bundles.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 403)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The acceptance criteria prescribe default recommendations using Chinese-language task descriptions such as '大模型训练/深度学习' and '数据分析/轻量任务' without indicating that language or locale is optional. This can create a language/locale policy issue because the skill content implicitly assumes a specific language context rather than offering user choice or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guidance line includes Chinese-only phrases for workload recommendations, which imposes a language assumption in natural-language instructions. The file does not indicate that the user can choose their preferred language or that the skill is intentionally limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.