Alibabacloud Polardb Ai Assistant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:02 AM UTC
• Version: 0.0.3

Overview

The skill is a coherent PolarDB diagnostic assistant, but it asks for broad and mutable Aliyun CLI/plugin setup while sending and logging potentially sensitive database operations data.

Review before installing. Use a test or least-privileged RAM identity, prefer temporary/OAuth credentials, avoid including secrets or raw customer data in prompts, and treat queries/session IDs as data sent to Alibaba Cloud. Verify the Aliyun CLI and DAS plugin source/version yourself and avoid broad auto-plugin updates where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:69

Finding

Unpinned Automatic Installation and Update of Aliyun CLI Plugins

Content

View full analysis

Then **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > Then **[MUST]** run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date. # Enable automatic plugin installation aliyun configure set --auto-plugin-install true # Install DAS plugin (get-yao-chi-agent requires plugin for Signature V3 support) aliyun plugin install --names aliyun-cli-das ``` ### Technical Analysis The Skill requires users to enable automatic plugin installation and update every existing Aliyun CLI plugin. The instructions do not pin the DAS plugin to a reviewed version or require verification of a checksum, package signature, or immutable artifact identifier. Automatic installation allows the effective executable dependency to change after the Skill has been audited. Running `aliyun plugin update` also affects unrelated plugins already present on the host, exceeding the minimum action necessary to invoke the DAS API. The Skill only needs a compatible DAS plugin; automatically updating all plugins is not required for its declared PolarDB diagnostic functionality. Although no malicious plugin is included in the project, these instructions create a supply-chain trust boundary outside the audited package. ### Attack Path 1. A user follows the mandatory setup instructions and enables automatic plugin installation. 2. The user runs the unversioned plugin update or installation command. 3. A compromised distribution service, publisher account, or future plugin release supplies altered plugin code. 4. The Aliyun CLI installs that code without a project-defined integrity or version check. 5. The Skill invokes `aliyun das get-yao-chi-agent`, causing the installed plugin to execute under ...[truncated 832 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/cli-installation-guide.md:41

Finding

Unverified Mutable Aliyun CLI Binary Installed into a Privileged PATH

Content

View full analysis

Remediation

View remediation

aliyun-cli-linux-amd64.tgz" | sha256sum --check - ``` 3. Prefer verification using an official detached signature and a pinned publisher key. 4. Abort installation if any integrity or signature verification fails. 5. Prefer an official trusted package manager where package signatures and version constraints are enforced. 6. Avoid elevated installation where possible; use a user-scoped binary directory with restrictive permissions. 7. Before replacing an existing executable, display its path and version and require explicit user approval. 8. Apply the same version-pinning and integrity controls to the macOS, ARM64, and Windows installation instructions. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (22)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 206)May include surrounding context.

Error: Using Python SDK to manage credentials

from alibabacloud_das20200116.client import Client as DAS20200116Client

Error: Parsing credentials from .env file

Error: Parsing credentials from ~/.alibabacloud/credentials

text

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · scripts/call_yaochi_agent.sh (reported line 44)May include surrounding context.

sh

Options:
  --session-id <id>    Session ID for multi-turn conversation
  --profile <name>     Specify aliyun CLI profile
  --debug, -d          Enable debug mode
  --help, -h           Show help information

Examples:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This guide materially expands the skill from a PolarDB-focused assistant into a general Alibaba Cloud CLI enablement document, including installation, authentication, profile management, plugin installation, and examples for unrelated services. In an agent skill, this scope expansion is dangerous because it equips the agent or user to operate broadly across cloud resources, increasing the blast radius beyond the declared product boundary and undermining least-privilege assumptions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Stating that CLI 3.3.3+ can install and use all published Alibaba Cloud product plugins introduces unnecessary cross-product capability into a PolarDB-only skill. That broadens the operational surface from database administration to arbitrary cloud service management, which can enable unintended actions if the skill is used by an agent with valid credentials.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/call_yaochi_agent.sh (reported line 243)May include surrounding context.

sh

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/call_yaochi_agent.sh (reported line 244)May include surrounding context.

sh

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The guide encourages creating long-lived AccessKey pairs and storing secrets for CLI use, which promotes persistent credential usage. While common in cloud docs, this is less safe in an agent-skill context because persistent credentials can be reused across sessions, exfiltrated from config files or environment variables, and applied far beyond PolarDB if over-privileged.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The verification and debugging workflow uses ECS commands such as describe-regions, which are unrelated to the stated PolarDB-only purpose. In a credentialed environment, these examples normalize and facilitate access to non-PolarDB services, making it easier for an agent or user to pivot into broader cloud enumeration.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The 'Next Steps' section explicitly recommends installing plugins for unrelated services and exploring commands like ECS and Function Compute. This directly conflicts with the skill's declared PolarDB-only scope and creates a pathway for broader cloud control beyond the intended domain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation directs use of APIs that send free-form natural-language queries and optional session identifiers to a remote DAS endpoint, and it explicitly documents a ReasoningContent field in streamed responses without any warning about sensitive data handling, logging, or display risks. In a database operations skill, users may include cluster details, SQL, logs, credentials, or incident context in queries, so omission of privacy and output-sanitization guidance can lead to inadvertent disclosure of sensitive operational data or exposure of internal reasoning/debug content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The verification instructions tell operators to run authenticated Alibaba Cloud API calls using their current CLI credentials, but do not clearly warn that real account context and accessible resources may be queried. In an O&M skill for PolarDB, users are especially likely to run these commands in production-capable environments, increasing the chance of unintended disclosure of inventory or metadata and normalizing execution of live-cloud checks during verification.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/call_yaochi_agent.sh (reported line 214)May include surrounding context.

sh

echo "Reference: references/ram-policies.md" >&2
    echo "Reference: references/verification-method.md" >&2
    if [[ -n "$code" ]]; then
        echo "Troubleshooting: https://api.aliyun.com/troubleshoot?q=$code" >&2
    fi
    if [[ "$DEBUG" == "true" ]]; then
        echo "RawError:" >&2

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script prints the full user query to stderr before sending it to the remote Alibaba Cloud agent. In this skill context, queries may contain cluster IDs, diagnostic details, SQL snippets, log excerpts, or other operationally sensitive data, and stderr is commonly captured by terminals, CI logs, orchestrators, or agent telemetry. That creates an avoidable disclosure channel independent of the intended API transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The document provides example CLI commands that send user-supplied queries and session identifiers to a remote Alibaba Cloud DAS endpoint, but it does not warn users that potentially sensitive operational data may be transmitted off-host. In a database operations skill, prompts can easily contain cluster identifiers, SQL snippets, logs, or incident details, so lack of disclosure increases the risk of unintended data exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The example configuration stores "language": "en" in the profile, which presents a fixed language setting in natural-language-oriented configuration content. Because the document does not mention that users may choose another language or that English is only an example, this can conflict with a policy requiring language or locale choice unless justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation instructs users to run aliyun configure get without warning that it can reveal profile configuration details on screen, which may be sensitive in shared terminals, screen recordings, logs, or support sessions. While it may not always expose full secrets, it can still disclose account identifiers, regions, profile names, or other operational metadata useful to an attacker.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.