ClawHub
Back to skill

Security audit

Alibabacloud Pai Feature Store Featuredb Usage Query

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a read-only Alibaba Cloud usage-query helper, but its installation path requires unsafe remote execution and broad persistent plugin changes.

Review before installing. The query workflow is narrowly aimed at FeatureDB usage data, but do not run the curl | bash installer as written, do not enable global automatic plugin installation unless you accept that persistent change, and avoid unscoped plugin updates. Use a dedicated least-privilege Alibaba Cloud identity, keep credentials out of chat, shell history, and logs, and treat command output as potentially sensitive account metadata.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:29
Finding

Unverified Remote Installation Script Is Executed Directly by Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:29-32
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.

Technical Analysis

The Skill pipes an HTTP response directly into Bash. The downloaded content is not saved for review, pinned to an immutable version, or verified using a cryptographic signature or checksum before execution.

HTTPS protects the connection in transit but does not establish that the mutable script remains safe after the Skill has been reviewed. A compromise of the origin, CDN, DNS resolution, TLS trust chain, or vendor publishing account could replace the installer with arbitrary shell commands.

This execution mechanism is unnecessary for the Skill's declared read-only usage-query functionality. Installation should be a separate, user-controlled prerequisite using a verifiable distribution mechanism.

Attack Path

  1. The user invokes the Skill on a system where Aliyun CLI is absent or below the required version.
  2. The Skill follows the documented update instruction.
  3. Bash receives the current response from https://aliyuncli.alicdn.com/setup.sh.
  4. A compromised upstream service or publishing process returns attacker-controlled shell commands.
  5. Bash executes those commands immediately without inspection or integrity verification.
  6. The payload accesses or modifies any resources available to the invoking user.

Impact Assessment

A malicious response would obtain arbitrary code execution with the privileges of the user running the command. This could permit access to local files, Aliyun configuration and credentials, environment variables, cloud API tokens, network-accessible services, and other ...[truncated 295 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash instruction entirely.
  2. Prefer an operating-system package manager or another trusted installation mechanism.
  3. If direct download is unavoidable:
    • Pin an explicit CLI version rather than using a mutable latest-version endpoint.
    • Download the artifact to a local file without executing it.
    • Obtain the expected checksum or signature through an independently authenticated vendor channel.
    • Verify the checksum and cryptographic signature before installation.
    • Present the source, version, and verification result to the user.
    • Require explicit user approval before execution or installation.
  4. Perform installation outside the authenticated Skill workflow.
  5. Execute installation with the least-privileged account possible and never request administrative privileges unless strictly required.

T08 · Insecure Dependencies

Error
Location
SKILL.md:34
Finding

Mandatory Automatic Plugin Installation and Unscoped Plugin Updates Expand the Supply-Chain Boundary

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:34-40
Vulnerability Type: Insecure dependency management
Risk Level: High

bash
> Then **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> **[MUST]** run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

**[MUST] CLI User-Agent** — Every `aliyun` CLI command invocation must include:
`--user-agent AlibabaCloud-Agent-Skills/alibabacloud-pai-feature-store-featuredb-usage-query`

The PAI-FeatureStore CLI plugin will be automatically installed when first used if auto-plugin-install is enabled.

Technical Analysis

The Skill requires a persistent configuration change that permits automatic plugin installation. It also requires updating every existing local plugin, including plugins unrelated to FeatureDB usage queries.

No required plugin version is pinned, and no checksum, signature, provenance verification, or review step is specified. Consequently, the exact executable component used by the Skill can change after the Skill package has been audited.

Updating unrelated plugins exceeds the minimum changes necessary for the declared functionality. The Skill only needs the specific PAI-FeatureStore functionality required to issue four read-only API operations.

Attack Path

  1. The Skill enables automatic plugin installation in the user's persistent Aliyun CLI configuration.
  2. The Skill invokes the PAI-FeatureStore command or performs the mandatory global plugin update.
  3. The CLI retrieves current plugin artifacts from its configured remote source.
  4. A compromised repository, release pipeline, publishing identity, or mutable plugin release supplies altered executable content.
  5. The altered plugin executes as part of a legitimate-looking Aliyun CLI invocation.
  6. Because the CLI is authenticated, malicious plugin code runs in a process with ...[truncated 553 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the requirement to run an unscoped aliyun plugin update.
  2. Do not enable global automatic plugin installation by default.
  3. Install only the plugin required for PAI-FeatureStore operations.
  4. Pin the plugin to a reviewed version and verify its cryptographic signature or vendor-published checksum.
  5. Display the plugin name, version, source, and configuration change before installation.
  6. Require explicit user consent before modifying persistent CLI configuration.
  7. Run the plugin in a restricted environment with only the four documented read-only RAM actions.
  8. Provide a procedure to restore the previous auto-install setting after execution if a temporary setting is unavoidable.

T09 · Insecure Skill Coding Practices

Warning
Location
references/cli-installation-guide.md:103
Finding

Installation Guide Encourages Exposure of Long-Lived Cloud Credentials Through Command Arguments and Plaintext Configuration

Content
View full analysis

Vulnerability Details

File Location: references/cli-installation-guide.md:103-108, 129-149, 231-243, 260-271
Vulnerability Type: Unsafe credential handling
Risk Level: Medium

bash
aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

The guide also provides concrete long-lived credential examples and documents plaintext storage:

bash
aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou
json
{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

Environment-variable alternatives are also documented:

bash
export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

Technical Analysis

Passing access-key secrets as command-line arguments can expose them through shell history, terminal recording, process inspection, CI/CD logs, diagnostic output, or Agent transcripts. Environment variables may be inherited by child processes or exposed through debugging and crash diagnostics.

The guide states that credentials are stored in ~/.aliyun/config.json. Although it later recommends restrictive file permissions, the primary quick-start workflow still normalizes handling long-lived secrets in plaintext.

This guidance conflicts with the main Skill's security rules at SKILL.md:51-54, which forbid asking for AK/SK values or using aliyun configure set with literal credentials.

Attack Path

  1. A us ...[truncated 1158 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove examples that place real secrets in command-line arguments.
  2. Ensure the reference guide follows the main Skill's prohibition against requesting or entering AK/SK values through an Agent-controlled command.
  3. Prefer short-lived STS credentials, OAuth, ECS workload roles, or another managed identity mechanism.
  4. Use an interactive credential provider that suppresses secret input when static credentials are unavoidable.
  5. Keep authentication setup outside Agent conversations and captured automation logs.
  6. Document that ~/.aliyun/config.json must be owned by the user and have mode 0600 before credentials are stored.
  7. Disable shell history temporarily for unavoidable sensitive setup and ensure CI systems mask all credential variables.
  8. Add explicit instructions to redact secrets from debugging output and rotate any credential that may have appeared in arguments, logs, or transcripts.
  9. Require a dedicated identity containing only the four documented read-only PAI-FeatureStore actions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (15)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to execute a remote installer script directly via curl ... | bash, which allows arbitrary code from the remote server or any compromised delivery path to run immediately on the local machine. In the same installation flow, it also requires automatic plugin installation and plugin updates, expanding the trusted code supply chain and increasing the chance of unintended code execution.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
> **Pre-check: Aliyun CLI >= 3.3.3 required**
>
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.
>
> Then **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest trigger list includes phrases like "PAI-FeatureStore usage", "FeatureDB usage", and "FeatureDB statistics", which are broad enough to overlap with many ordinary questions about usage or statistics rather than this specific read/write-usage workflow. The file does not provide negative examples or tighter invocation constraints to clarify when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md
1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash
# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/related-apis.md (reported line 56)May include surrounding context.

md
| Instances[].GmtCreateTime | string | Creation time |
| TotalCount | int | Total number of instances |

**API Documentation**: [ListInstances](https://api.aliyun.com/api/PaiFeatureStore/2023-06-21/ListInstances)

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/related-apis.md (reported line 93)May include surrounding context.

md
| Instances[].GmtCreateTime | string | Creation time |
| TotalCount | int | Total number of instances |

**API Documentation**: [ListInstances](https://api.aliyun.com/api/PaiFeatureStore/2023-06-21/ListInstances)

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/related-apis.md (reported line 155)May include surrounding context.

md
| Instances[].GmtCreateTime | string | Creation time |
| TotalCount | int | Total number of instances |

**API Documentation**: [ListInstances](https://api.aliyun.com/api/PaiFeatureStore/2023-06-21/ListInstances)

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/related-apis.md (reported line 257)May include surrounding context.

md
| Instances[].GmtCreateTime | string | Creation time |
| TotalCount | int | Total number of instances |

**API Documentation**: [ListInstances](https://api.aliyun.com/api/PaiFeatureStore/2023-06-21/ListInstances)

---

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a skill for querying FeatureDB usage data and estimating cost. This verification document additionally instructs use of aliyun ram list-policies-for-user and aliyun ram get-policy, which inspect IAM/RAM policy configuration rather than FeatureStore usage data itself; that capability is not clearly justified by the declared purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The example configuration explicitly sets the language field to en, which imposes a specific language choice in natural-language content. The file does not indicate that this is optional, user-selectable, or required for a region-specific compliance reason, so it may conflict with locale-choice policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The document instructs users to run authenticated cloud CLI commands that print instance IDs, datasource IDs, status, timestamps, and usage-related metadata directly to the terminal without any caution about handling sensitive account information. While the commands are read-only, this can lead to unnecessary exposure of cloud resource inventory and billing-related metadata in shared shells, logs, transcripts, or CI environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.