Alibabacloud Pai Rec Diagnosis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:17 AM UTC
• Version: 0.0.3

Overview

The skill has a legitimate PAI-Rec diagnostic purpose, but its setup and handling guidance can unnecessarily expose the user's machine and cloud credentials to risk.

Install only after reviewing the setup path. Prefer a package manager or verified, pinned Aliyun CLI release; do not pipe remote scripts into bash; avoid enabling global automatic plugin installation or updating unrelated plugins from this skill. Use a dedicated least-privilege Alibaba Cloud profile, avoid entering secrets in command lines or chat, and be aware that non-JSON ConfigValue content may not be safely redacted before display.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:33

Finding

Remote installation script is executed directly without integrity verification

Content

View full analysis

Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see `references/cli-installation-guide.md` for installation instructions. ``` ```bash # references/troubleshooting-guide.md curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash ``` ### Technical Analysis The downloaded response is passed directly to Bash without pinning a release, reviewing the script, or validating a cryptographic checksum or publisher signature. The effective code executed by the Skill can therefore change after the Skill itself has been audited. The hostname appears associated with Alibaba Cloud, but domain legitimacy does not remove the risk of a compromised CDN, hosting account, DNS path, TLS trust chain, or upstream release process. The `-f` and `-s` options also reduce visible diagnostic output, making unexpected delivery behavior less apparent. This installation behavior is not the minimum privilege necessary for configuration diagnosis. The diagnostic workflow requires an Aliyun CLI, but it does not inherently require executing an unverified, mutable script. ### Attack Path 1. An attacker compromises or alters the remote `setup.sh` payload or its distribution path. 2. A user or Agent follows the documented installation or update instruction. 3. `curl` retrieves the attacker-controlled response. 4. Bash executes that response immediately, without an integrity boundary. 5. The payload runs with the privileges of the user who invoked the Skill and can access that user’s files, environment, and configured cloud credentials. ### Impact Assessment A successful at ...[truncated 528 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:38

Finding

Automatic installation and unpinned updates expose an authenticated environment to plugin supply-chain compromise

Content

View full analysis

[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ``` ### Technical Analysis The Skill requires automatic plugin installation and unconditional updates to the latest available versions. It does not pin reviewed plugin versions, define an allowlist, or require signature or checksum validation. Consequently, executable functionality outside the audited package can be introduced or changed at runtime. This is especially sensitive because the plugins operate in an environment containing configured Alibaba Cloud identities. Automatic installation and global plugin updates exceed the minimum dependency changes needed for the declared workflow. The Skill only needs specific EAS and PAI-Rec commands, not arbitrary newly published plugins or updates to every existing plugin. ### Attack Path 1. A required plugin, plugin repository, release account, or update metadata is compromised. 2. The Skill enables automatic plugin installation and updates all installed plugins. 3. The compromised component is downloaded into the local CLI environment. 4. A subsequent Aliyun command loads or invokes the compromised plugin. 5. The plugin executes in the authenticated user context and can interact with local data or cloud APIs. ### Impact Assessment A compromised plugin could execute code with the user’s local privileges, read Aliyun profiles or environment-provided credentials, alter CLI responses, and issue cloud requests within the permissions of the configured identity. The cloud permissions documented for the primary workflow are read-only, but the actual impact depends on the broa ...[truncated 138 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sanitize_config.py:108

Finding

Configuration sanitizer fails open and can print plaintext credentials

Content

View full analysis

str: """Parse and sanitize a ConfigValue JSON string.""" try: config = json.loads(config_value_str) if isinstance(config, dict): config = sanitize_dict(config) return json.dumps(config, indent=2, ensure_ascii=False) except (json.JSONDecodeError, TypeError): return config_value_str ``` The returned value is subsequently printed: ```python sanitized = sanitize_cli_output(data) print(json.dumps(sanitized, indent=2, ensure_ascii=False)) ``` ### Technical Analysis When `ConfigValue` cannot be decoded as JSON, `sanitize_config_value()` returns the original input unchanged. The caller then serializes and prints that unredacted value. This is security-sensitive because `SKILL.md` explicitly acknowledges that engine configurations may contain plaintext passwords or access keys. It also describes configuration content as potentially JSON or YAML, while this sanitizer only parses JSON. Malformed JSON, YAML, or other textual configuration formats therefore bypass recursive field-name and DSN redaction. This is a fail-open design: the exact conditions under which the sanitizer cannot understand the input cause it to disclose the original content. ### Attack Path 1. An engine configuration contains a password, access key, token, or credential-bearing connection string. 2. Its `ConfigValue` is YAML, malformed JSON, or another unsupported textual format. 3. `json.loads()` raises `JSONDecodeError` or `TypeError`. 4. `sanitize_config_value()` returns the original configuration string. 5. `main()` prints it to standard output. 6. The terminal transcript, Agent context, logs, or connected LLM receives the plaintext credential. ### Im ...[truncated 385 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:164

Finding

User-controlled parameters are interpolated into shell command templates without quoting or validation

Content

View full analysis

\ --service-name \ --keyword \ --page-size 500 ``` Additional affected command: ```bash aliyun pairecservice get-engine-config \ --instance-id \ --engine-config-id > "$WORKDIR/raw_engine_config.json" 2>&1 ``` Experiment-derived identifiers are handled similarly: ```bash aliyun pairecservice get-experiment-group \ --instance-id \ --experiment-group-id > "$WORKDIR/experiment_group_.json" 2>&1 ``` ### Technical Analysis The Skill instructs the Agent to substitute user-provided or API-derived parameters into shell command templates. The placeholders are not quoted, and the Skill does not prescribe identifier-specific allowlist validation. If an Agent constructs a shell command through textual replacement, whitespace, command separators, command substitution, redirection operators, or other shell metacharacters in a value can alter the intended command. Confirmation by the user does not make an unsafe value syntactically safe. The risk applies to service names, cluster IDs, request IDs, instance IDs, configuration names, engine configuration IDs, and experiment-derived IDs. ### Attack Path 1. An attacker provides a crafted parameter such as a service name or request ID containing shell syntax. 2. The Agent confirms the value but does not validate or encode it. 3. The Agent substitutes the value into the documented shell command. 4. A shell interprets the injected syntax rather than treating the entire value as one argument. 5. The injected command executes with the Agent process’s local privileges. Exploitati ...[truncated 594 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:39

Finding

Mutable latest-release binaries are installed into a privileged executable path without verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:101

Finding

Credential configuration guide recommends exposing secrets through command-line arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` The guide then states: ```text All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` It also provides STS and role-assumption examples containing secret arguments: ```bash aliyun configure set \ --mode StsToken \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --sts-token v1.0:XXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` ### Technical Analysis Passing access-key secrets and STS tokens directly as command-line arguments can expose them through shell history, process inspection interfaces, CI logs, command tracing, terminal capture, or Agent transcripts. Recommending this method for Agent-driven automation conflicts with the safer rules in `SKILL.md`, which prohibit asking for credentials in the conversation and prohibit using `aliyun configure set` with literal credential values. Although the examples use placeholders, users are instructed to replace those placeholders with real secrets. ### Attack Path 1. A user follows the guide and substitutes real credentials into the command. 2. The shell records the command in its history, or an automation platform logs it. 3. While the command runs, another authorized local process may inspect its argument list. 4. An attacker later gains access to the history, transcript, CI output, or process telemetry. 5. The attacker extracts and reuses the access key or STS token. ...[truncated 378 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description says the skill diagnoses PAI-Rec engine interface issues and validates engine configurations. However, the supplied code does neither diagnosis nor validation: it does not check correctness, detect interface issues, call Alibaba Cloud APIs, or assess configuration validity. Its primary function is to sanitize configuration data by redacting passwords, keys, tokens, secrets, and embedded DSN credentials. While this is related to PAI-Rec configurations, it is a materially different purpose from diagnosis/validation, so the description does not accurately represent the code's actual behavior.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill instructs users to execute a remote script via curl ... | bash, which creates a classic supply-chain and arbitrary code execution risk. If the remote host, CDN path, transport, or script content is compromised, the user may run attacker-controlled code on their machine with their local privileges.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.

**Pre-check: Aliyun CLI plugin update required**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 474)May include surrounding context.

md

(see Core Workflow preamble). The skill does NOT delete `$WORKDIR` automatically
— the OS-level temp policy reclaims it (macOS reaps `/tmp` periodically; most
Linux distros reap on reboot or via `systemd-tmpfiles`). To free disk space
sooner, manually run `rm -rf /tmp/pairec-diag-*` outside the workflow.

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 474)May include surrounding context.

md

(see Core Workflow preamble). The skill does NOT delete `$WORKDIR` automatically
— the OS-level temp policy reclaims it (macOS reaps `/tmp` periodically; most
Linux distros reap on reboot or via `systemd-tmpfiles`). To free disk space
sooner, manually run `rm -rf /tmp/pairec-diag-*` outside the workflow.

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 474)May include surrounding context.

md

(see Core Workflow preamble). The skill does NOT delete `$WORKDIR` automatically
— the OS-level temp policy reclaims it (macOS reaps `/tmp` periodically; most
Linux distros reap on reboot or via `systemd-tmpfiles`). To free disk space
sooner, manually run `rm -rf /tmp/pairec-diag-*` outside the workflow.

---

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Fetching and immediately executing an external script from a URL is a classic supply-chain risk because the script is not pinned, verified, or reviewed before execution. In the context of a cloud diagnostic skill, this could compromise operator workstations, steal cloud credentials, or tamper with subsequent CLI-based diagnosis activity.

Content

Scanner excerpt · references/troubleshooting-guide.md (reported line 52)May include surrounding context.

Solution:

1. Install Aliyun CLI:

   bash

   curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash
   

2. Reload shell configuration:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | bash shell chaining removes the opportunity to validate downloaded content and turns network retrieval into immediate command execution. This is dangerous because any compromise or malicious change in the upstream script results in instant code execution in the user's environment.

Content

Scanner excerpt · references/troubleshooting-guide.md (reported line 52)May include surrounding context.

Solution:

1. Install Aliyun CLI:

   bash

   curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash
   

2. Reload shell configuration:

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The same external-script execution pattern is used for updates, preserving the same supply-chain and arbitrary code execution risks. Because updates may be run on already-configured systems with active cloud credentials, exploitation could have direct impact on account security and operational integrity.

Content

Scanner excerpt · references/troubleshooting-guide.md (reported line 80)May include surrounding context.

Solution:

1. Update Aliyun CLI:

   bash

   curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash
   

2. Verify update:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using | bash in update instructions enables the same command-chaining abuse during an operation users are likely to treat as routine and safe. In a cloud tooling context, compromise could expose configured access keys, modify shell startup files, or implant persistence on the operator host.

Content

Scanner excerpt · references/troubleshooting-guide.md (reported line 80)May include surrounding context.

Solution:

1. Update Aliyun CLI:

   bash

   curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash
   

2. Verify update:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 487)May include surrounding context.

❌ INCORRECT - Using hardcoded or assumed values

bash

# Hardcoded region without confirmation
aliyun eas describe-service \
  --cluster-id cn-hangzhou \           # Never assume
  --service-name embedding_recall

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 492)May include surrounding context.

--cluster-id cn-hangzhou \ # Never assume --service-name embedding_recall

Assumed time range without asking user

--start-time "2025-04-28T00:00:00Z" \ # Should confirm with user --end-time "2025-04-28T23:59:59Z"

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 520)May include surrounding context.

No error checking

SERVICE_INFO=$(aliyun eas describe-service --cluster-id cn-hangzhou --service-name test)

Process results without checking if command succeeded

(May fail silently or with confusing errors)

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 595)May include surrounding context.

No error checking

SERVICE_INFO=$(aliyun eas describe-service --cluster-id cn-hangzhou --service-name test)

Process results without checking if command succeeded

(May fail silently or with confusing errors)

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 590)May include surrounding context.

fi

text

#### ❌ INCORRECT - No verification

```bash
# Assume commands always succeed

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide instructs users to pass long-lived access keys directly on the command line and via environment variables. Command-line arguments can be exposed through shell history, process listings, logs, or CI job output, and the section does not place an immediate warning beside the examples about those exposure paths.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The sample config output shows the structure and presence of access_key_secret in ~/.aliyun/config.json without an immediate warning that this file contains sensitive secrets. In an automation-focused skill, this increases the risk that users or downstream agents may print, copy, commit, or mishandle the config file.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This is a JSON manifest/schema file, so vague-trigger checks apply. The 'Triggers' property is described only as an array of generic objects, with no schema for allowed trigger phrases, scope, or exclusion conditions, making activation criteria underspecified and prone to broad or inconsistent invocation behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Lines L017-L024 explicitly say fix recommendations, speculative scenarios, and tangential advice are not allowed when reporting conclusions to users. However, later sections of the guide repeatedly provide direct solution and fix guidance that would contradict that documented reporting constraint if followed literally during user-facing diagnosis, creating intent-documentation divergence within the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.