Alibabacloud Pai Quota Management

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:20 AM UTC
• Version: 0.0.1

Overview

This is a coherent Alibaba Cloud PAI quota-management skill with powerful cloud mutation capabilities that are disclosed and gated by dry-run plus explicit user confirmation.

Install only if you intend an agent to manage Alibaba Cloud PAI quotas and workspace bindings with your Aliyun profile. Prefer least-privilege RAM scoped to the needed region, quotas, and workspaces; in production, pin and verify the Aliyun CLI/plugins instead of relying on mutable latest downloads or automatic plugin updates; keep the documented dry-run and exact-token confirmation gates for all create, update, scale, delete, and detach actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:20

Finding

Unverified Installation and Automatic Update of Mutable CLI Dependencies

Content

View full analysis

Vulnerability Details

File Location: references/cli-installation-guide.md:20-23, references/cli-installation-guide.md:48-53, and SKILL.md:57-59
Vulnerability Type: Supply-chain risk caused by unpinned and unverified executable dependencies
Risk Level: High

Vulnerable Code

references/cli-installation-guide.md:20-23:

bash

curl -L -o aliyun-cli.tgz https://github.com/aliyun/aliyun-cli/releases/latest/download/aliyun-cli-linux-amd64.tgz
tar -xzf aliyun-cli.tgz
sudo mv aliyun /usr/local/bin/aliyun
aliyun version

references/cli-installation-guide.md:48-53:

bash

aliyun configure --auto-plugin-install true
aliyun plugin update
aliyun plugin list | grep -E "paistudio|aiworkspace"

SKILL.md:57-59:

bash

aliyun plugin update

Technical Analysis

The installation procedure retrieves the mutable GitHub latest release and installs the downloaded executable into /usr/local/bin without verifying a cryptographic signature or a pinned checksum. Because latest can resolve to different content over time, the executable reviewed today is not necessarily the executable installed later.

The procedure also enables automatic plugin installation and recommends updating plugins without pinning their versions or validating their integrity. These plugins execute in the authenticated Aliyun CLI environment and may therefore access the same local configuration and cloud permissions available to the CLI process.

HTTPS protects transport integrity under normal circumstances, but it does not mitigate compromise of the upstream repository, release account, build pipeline, plugin distribution service, or signing infrastructure. There is no evidence that the referenced official Alibaba sources are currently malicious; the vulnerability is the absence of controls that would detect a substituted or compromised artifact.

Attack Path

1. An attacker compromises an upstream rel ...[truncated 1616 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest URL with an explicitly pinned, reviewed Aliyun CLI version.
2. Publish the expected SHA-256 or stronger digest through a separately authenticated channel and verify it before extraction:

   bash

   echo '<EXPECTED_SHA256>  aliyun-cli.tgz' | sha256sum --check -
   

3. Prefer vendor-provided cryptographic signatures and verify the signing key fingerprint through an independent trusted source.
4. Pin the paistudio and aiworkspace plugin versions where supported. Do not update them automatically during normal Skill execution.
5. Disable --auto-plugin-install in security-sensitive environments. Require an administrator-controlled dependency approval and installation process.
6. Perform updates as a separate, explicit maintenance operation rather than as a one-time action in every agent session.
7. Download and verify artifacts as an unprivileged user. Use elevated privileges only for the final installation of an already verified file.
8. Install into a versioned path and use an atomic, auditable symlink update rather than blindly replacing /usr/local/bin/aliyun.
9. Record the installed CLI and plugin versions and compare them against an approved allowlist before executing authenticated cloud operations.
10. Where available, use a trusted operating-system package repository that provides signed metadata, fixed versions, and rollback support.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 347)May include surrounding context.

md

| `references/acceptance-criteria.md` | Correct / incorrect CLI command patterns. |

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The delete-workspace-resource entry states --option DetachAndDelete is the default, but it does not prominently warn that the default behavior is destructive. This is especially dangerous in an agent-facing skill because a caller who intends a safe detach could omit the flag and trigger deletion of the underlying binding or resource association unintentionally.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

>
> **Mandatory dry-run before Update / Scale / Delete / Detach:**
>
> Before asking for the confirmation token, the agent **MUST** first execute the command with `--cli-dry-run` and show the output to the user. This is non-negotiable — **no dry-run, no confirmation prompt, no execution**. The sequence is:
> 1. Run `<command> ... --cli-dry-run` to preview the resolved request payload.
> 2. Show the dry-run output to the user.
> 3. Ask for the confirmation token.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

> 3. Ask for the confirmation token.
> 4. **STOP. END THE TURN.**
>
> Skipping the `--cli-dry-run` step is a **critical workflow violation**, equivalent to executing without confirmation.
>
> **Confirmation tokens:**
> - **Create** (`create-quota`): `CONFIRM-CREATE <QUOTA_NAME>` — print resolved parameters (ResourceGroupIds, ResourceType, QuotaName, Min, etc.), then ask: `Type "CONFIRM-CREATE <QUOTA_NAME>" to continue; any other input cancels.` **STOP HERE. END THE TURN. WAIT FOR USER INPUT.**

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 82)May include surrounding context.

md

- ✅ Before `create-quota` (root) and before `scale-quota` (when `--resource-group-ids` changes), call the **`pai-resource-group-management`** skill (or `aliyun paistudio list-resource-groups` + `get-resource-group`) to enumerate and inspect every candidate RG.
- ✅ Print a per-RG validation table showing `ClusterId`, `GpuType`, and (for ECS) `UserVpc.{VpcId,SwitchId,SecurityGroupId}` before issuing the create/scale call.
- ❌ Issuing `create-quota --resource-group-ids rg-aaa rg-bbb` without first calling `get-resource-group` on each id.
- ❌ Trusting user-supplied RG IDs without verification — a wrong / non-existent RG ID surfaces as an opaque CLI error after the homogeneity step is skipped.

## RG homogeneity (root `create-quota` / root `scale-quota`)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 22)May include surrounding context.

bash

curl -L -o aliyun-cli.tgz https://github.com/aliyun/aliyun-cli/releases/latest/download/aliyun-cli-linux-amd64.tgz
tar -xzf aliyun-cli.tgz
sudo mv aliyun /usr/local/bin/aliyun
aliyun version

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents aliyun paistudio delete-quota as a routine command but does not explicitly warn that deleting a quota is destructive and may disrupt workloads, capacity planning, or dependent workspace/resource relationships. In an agent skill intended for end-to-end quota lifecycle management, omission of impact warnings increases the chance an automation or operator will invoke deletion without informed confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The guide enables aliyun configure --auto-plugin-install true without warning that future aliyun paistudio ... or aliyun aiworkspace ... commands may automatically fetch and install executable plugins from remote sources. In an agent skill context, this increases supply-chain risk because plugin installation can occur implicitly during normal task execution, reducing user visibility and review before code is installed.

Content

No source excerpt is available for this finding.