alibabacloud-polardb-mysql-inspection

• Outcome: Review
• Latest audit: Oct 9, 2026 · 8:03 AM UTC
• Version: 0.0.2

Overview

The skill mostly matches its PolarDB inspection purpose, but it under-discloses persistent local CLI/plugin changes and a non-read-only backend task permission.

Review this before installing if you do not want an agent changing your Aliyun CLI setup. Use a least-privilege RAM role, be aware the skill can scan all PolarDB MySQL instances available to that profile, and treat generated reports as sensitive because they may include slow SQL, alerts, storage details, and live session information. Prefer manually verified CLI installation and plugin setup over the provided curl-to-shell or automatic update flow.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (44)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a comprehensive PolarDB MySQL health inspection/reporting capability, including performance metrics, storage analysis, slow SQL statistics, alert history, and HTML report generation. The supplied code does none of that. Its sole purpose is to find the region of a specified PolarDB cluster by iterating through a hardcoded region list and calling aliyun CLI APIs for cluster attribute lookup. It prints basic cluster metadata to stdout and exits. This is a materially different primary purpose from the declared inspection/reporting functionality, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code is clearly related to PolarDB health inspection reporting, so the general domain matches the description. It renders many of the described report contents: CPU/memory/connection usage, disk/space analysis, top tables, slow query statistics, alert history, and active sessions. However, the declared description specifically emphasizes generating visual HTML reports, while this file explicitly implements a 'text renderer' (render_text) and outputs Unicode box-drawn plain text. Additionally, the broader description mentions support for multiple inspection modes, but this chunk contains no logic for single-instance, multi-instance, or account-wide inspection workflows—only formatting of an already assembled data structure. This is a partial but material mismatch between declared purpose and actual behavior of the supplied code chunk.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill recommends piping a remote script directly into bash to install or update software. This is a classic supply-chain and arbitrary code execution hazard because it executes network-fetched code without independent verification, which is especially dangerous when embedded in an agent skill that may automate commands.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

**Installation Verification:**
> **Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.
> Then [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> Then [MUST] run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The skill instructs the agent to enable automatic plugin installation, update plugins, and perform CLI self-upgrade on the local machine. That crosses from read-only inspection into software modification and supply-chain risk, allowing code changes on the host outside the user’s original task and expanding the attack surface significantly.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

> or see `references/cli-installation-guide.md` for installation instructions.
> Then [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> Then [MUST] run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.
> Routine CLI self-update (>= 3.3.5): `aliyun upgrade`

---

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

aliyun version

text

### Self-Update (CLI >= 3.3.5)

Once the CLI is at version 3.3.5 or newer, routine updates can use the built-in self-update subcommand instead of re-running the install script:

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 73)May include surrounding context.

Self-Update (CLI >= 3.3.5)

Once the CLI is at version 3.3.5 or newer, routine updates can use the built-in self-update subcommand instead of re-running the install script:

bash

aliyun upgrade

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill requires broad capabilities including shell, network, file read/write, and environment access, but it does not declare an explicit tool scope or allowed-tools policy. That makes the effective execution boundary unclear and increases the chance an agent can perform unintended actions beyond read-only inspection, especially because the skill also instructs local installs, updates, and report writes.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

## How to Use This Skill

**You do not need to run any scripts manually!** This is an AI Agent skill — simply describe your needs in natural language.

### Example Conversations

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill writes reports to user-specified output paths but does not clearly warn that files may be created or overwritten locally. In an agent context, this can lead to unintended local file modification, clobbering existing files, or writing sensitive report data into unsafe locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guide recommends piping a remotely fetched shell script directly into bash without any integrity verification or explicit warning. If the hosting endpoint, transport, or upstream content is compromised, users could execute arbitrary code immediately on their systems.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 37)May include surrounding context.

x86_64

bash

wget --connect-timeout=10 --read-timeout=120 --tries=3 -qO- https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz
sudo mv aliyun /usr/local/bin/

ARM64

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 43)May include surrounding context.

x86_64

bash

wget --connect-timeout=10 --read-timeout=120 --tries=3 -qO- https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz
sudo mv aliyun /usr/local/bin/

ARM64

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 99)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 391)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is described as a health inspection tool for PolarDB MySQL instances and report generation, but this file instructs users to install arbitrary Alibaba Cloud product plugins and explore unrelated service commands such as ECS and FC. That expands the apparent operational scope from PolarDB inspection into general-purpose cloud CLI enablement.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document explicitly states the skill uses read-only APIs only, but it also requests das:CreateStorageAnalysisTask, which is not read-only because it initiates a server-side task. This mismatch can mislead reviewers and operators into granting broader privileges than intended, weakening least-privilege review and masking operational side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Claiming the skill is read-only while silently requesting a task-creation permission hides a write-like side effect from users and security reviewers. Even if the action only creates an analysis job, undisclosed state-changing permissions undermine informed consent, increase privilege creep, and may trigger billable or operationally sensitive backend activity.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/check-write-operation.sh (reported line 124)May include surrounding context.

sh

"hookSpecificOutput": {
    "hookEventName": "PreToolUse",
    "permissionDecision": "allow",
    "permissionDecisionReason": "Read operation API ($ACTION), no confirmation needed."
  }
}
EOF

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/find-instance-region.py (reported line 37)May include surrounding context.

python

cmd.extend([f'--{key}', str(value)])

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        if result.returncode == 0:
            return json.loads(result.stdout)
    except (subprocess.TimeoutExpired, json.JSONDecodeError):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/find-instance-region.py (reported line 82)May include surrounding context.

python

# Check if aliyun CLI is available
    try:
        result = subprocess.run(['aliyun', 'version'], capture_output=True, text=True, timeout=5)
        if result.returncode != 0:
            raise FileNotFoundError
    except (FileNotFoundError, subprocess.TimeoutExpired):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/hi_main.py (reported line 113)May include surrounding context.

python

# Check if aliyun CLI is available
    try:
        result = subprocess.run(['aliyun', 'version'], capture_output=True, text=True, timeout=5)
        if result.returncode != 0:
            raise FileNotFoundError
    except (FileNotFoundError, subprocess.TimeoutExpired):

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The code actively enumerates live MySQL session data through DAS APIs, including per-node session details, which goes beyond simple aggregate health metrics and can expose sensitive operational information such as active connections and session state. In a health-inspection skill this may be partly relevant, but collecting detailed live session data expands data access and privacy risk if reports are shared, logs are retained, or the function is invoked more broadly than expected.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/hi_config.py (reported line 78)May include surrounding context.

python

cmd.extend([f'--{key}', str(value)])

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0:
            return json.loads(result.stdout)
        else:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a read-oriented health inspection/reporting tool, but it also modifies the user's local Alibaba CLI environment by installing missing plugins. That mismatch between declared purpose and actual behavior is security-relevant because it violates least surprise and expands the tool's capabilities from inspection into software/environment management.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/hi_main.py (reported line 32)May include surrounding context.

python

and exits on failure so later API calls never hit cryptic 'Tip' errors.
    """
    try:
        result = subprocess.run(
            ['aliyun', 'plugin', 'list'],
            capture_output=True, text=True, timeout=15,
        )

Static analysis

No suspicious patterns detected.