ClawHub
Back to skill

Security audit

Alibabacloud Pai Resource Group Management

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Alibaba Cloud PAI resource-group management guide with explicit confirmation gates, though users should be cautious about the mutable CLI/plugin installation steps.

Install only from trusted Alibaba Cloud sources, prefer pinned and checksum-verified Aliyun CLI/plugin versions where possible, and use least-privilege RAM policies. Review each resolved plan carefully before sending any CONFIRM token because this skill can create, update, or delete cloud ResourceGroups.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/cli-installation-guide.md:20
Finding

Unverified Installation of Mutable Aliyun CLI and Plugin Dependencies

Content
View full analysis

Vulnerability Details

File Location: references/cli-installation-guide.md, lines 20–23 and 48–53
Vulnerability Type: Supply-chain exposure through unpinned, unverified executable dependencies
Risk Level: Medium

Vulnerable Code

bash
curl -L -o aliyun-cli.tgz https://github.com/aliyun/aliyun-cli/releases/latest/download/aliyun-cli-linux-amd64.tgz
tar -xzf aliyun-cli.tgz
sudo mv aliyun /usr/local/bin/aliyun
aliyun version
bash
aliyun configure --auto-plugin-install true
aliyun plugin update
aliyun plugin list | grep paistudio

The guide states that the plugin is fetched automatically when an aliyun paistudio command is first run.

Technical Analysis

The Linux installation procedure downloads the mutable latest release archive, extracts it, and places the resulting executable in the privileged /usr/local/bin path without validating a cryptographic checksum or signature. A TLS connection protects data in transit but does not independently establish that the downloaded artifact is the specific version reviewed or approved by the user.

The plugin workflow likewise enables automatic installation and performs an unrestricted update without pinning or integrity verification. This allows the effective executable components used by the skill to change after the skill package itself has been audited.

This is a supply-chain weakness rather than evidence that the current Aliyun artifacts are malicious. Exploitation requires compromise or unauthorized replacement of the release asset, plugin distribution mechanism, associated publishing account, or another trusted delivery component.

Attack Path

  1. An attacker compromises or replaces the mutable release asset or plugin artifact served through a trusted distribution channel.
  2. A user follows the documented installation procedure.
  3. The mutable archive is downloaded without version pinning, checksum verification, or signature verification.
  4. The extracted executable is ...[truncated 1097 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the mutable latest URL with an explicitly approved and pinned CLI version.
  2. Obtain the checksum through an authenticated official channel and verify it before extraction, for example with sha256sum --check.
  3. Prefer vendor-provided cryptographic signatures and validate the signing key and signature before installation.
  4. Abort installation immediately if the checksum, signature, filename, architecture, or expected version does not match.
  5. Extract into a temporary staging directory and validate the archive contents before copying the executable into an executable search path.
  6. Avoid privileged installation where practical; otherwise, perform integrity verification before the sudo step.
  7. Disable automatic plugin installation and pin an approved paistudio plugin version.
  8. Document a controlled plugin upgrade process that verifies provenance and integrity before activation.
  9. Record the installed CLI and plugin versions so deployments can be reproduced and audited.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (20)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
Permission failure handling: see `references/validation-rules.md` §5.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md
Permission failure handling: see `references/validation-rules.md` §5.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md
Permission failure handling: see `references/validation-rules.md` §5.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
Permission failure handling: see `references/validation-rules.md` §5.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

md
Permission failure handling: see `references/validation-rules.md` §5.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

md
Permission failure handling: see `references/validation-rules.md` §5.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

md
Permission failure handling: see `references/validation-rules.md` §5.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 371)May include surrounding context.

md
Permission failure handling: see `references/validation-rules.md` §5.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md
> Read-only operations (`list-*`, `get-*`) do NOT require this gate. Full rules: `references/confirmation-gate.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md
> Read-only operations (`list-*`, `get-*`) do NOT require this gate. Full rules: `references/confirmation-gate.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

md
> Read-only operations (`list-*`, `get-*`) do NOT require this gate. Full rules: `references/confirmation-gate.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

md
> Read-only operations (`list-*`, `get-*`) do NOT require this gate. Full rules: `references/confirmation-gate.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 373)May include surrounding context.

md
> Read-only operations (`list-*`, `get-*`) do NOT require this gate. Full rules: `references/confirmation-gate.md`.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 22)May include surrounding context.

bash
curl -L -o aliyun-cli.tgz https://github.com/aliyun/aliyun-cli/releases/latest/download/aliyun-cli-linux-amd64.tgz
tar -xzf aliyun-cli.tgz
sudo mv aliyun /usr/local/bin/aliyun
aliyun version

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md
3. Ask for the confirmation token.
4. **STOP. END THE TURN.**

Skipping the `--cli-dry-run` step is a **critical workflow violation**, equivalent to executing without confirmation.

## Gate procedure

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/confirmation-gate.md (reported line 64)May include surrounding context.

md
3. Ask for the confirmation token.
4. **STOP. END THE TURN.**

Skipping the `--cli-dry-run` step is a **critical workflow violation**, equivalent to executing without confirmation.

## Gate procedure

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md
- ✅ User cancellation (CONFIRM token mismatch, user replied "no" / "cancel").
- ✅ `🛑 Precondition Not Met` block printed (Branch 2 exit).
- ✅ `⚠️ Input Conflict` block printed and turn ended waiting for user re-fill (Branch 1 exit).
- ✅ Read-only inspection complete (no mutation, no confirmation gate, but at least one business API call was issued — every such call must have carried `--user-agent`).
- ✅ Tool call error / unexpected exception bubbled up.

## The 7-point exit checklist (verbatim)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/confirmation-gate.md (reported line 28)May include surrounding context.

md
- ✅ User cancellation (CONFIRM token mismatch, user replied "no" / "cancel").
- ✅ `🛑 Precondition Not Met` block printed (Branch 2 exit).
- ✅ `⚠️ Input Conflict` block printed and turn ended waiting for user re-fill (Branch 1 exit).
- ✅ Read-only inspection complete (no mutation, no confirmation gate, but at least one business API call was issued — every such call must have carried `--user-agent`).
- ✅ Tool call error / unexpected exception bubbled up.

## The 7-point exit checklist (verbatim)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/confirmation-gate.md (reported line 57)May include surrounding context.

md
- ✅ User cancellation (CONFIRM token mismatch, user replied "no" / "cancel").
- ✅ `🛑 Precondition Not Met` block printed (Branch 2 exit).
- ✅ `⚠️ Input Conflict` block printed and turn ended waiting for user re-fill (Branch 1 exit).
- ✅ Read-only inspection complete (no mutation, no confirmation gate, but at least one business API call was issued — every such call must have carried `--user-agent`).
- ✅ Tool call error / unexpected exception bubbled up.

## The 7-point exit checklist (verbatim)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/exit-checklist.md (reported line 23)May include surrounding context.

md
- ✅ User cancellation (CONFIRM token mismatch, user replied "no" / "cancel").
- ✅ `🛑 Precondition Not Met` block printed (Branch 2 exit).
- ✅ `⚠️ Input Conflict` block printed and turn ended waiting for user re-fill (Branch 1 exit).
- ✅ Read-only inspection complete (no mutation, no confirmation gate, but at least one business API call was issued — every such call must have carried `--user-agent`).
- ✅ Tool call error / unexpected exception bubbled up.

## The 7-point exit checklist (verbatim)

Static analysis

No suspicious patterns detected.