Alibabacloud Polardb Mysql Sql Lint

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:57 AM UTC
• Version: 0.0.1

Overview

The skill has a coherent SQL-linting purpose, but its cloud diagnosis path uses unsafe local command execution, unverified installers, global CLI/plugin changes, and risky cloud credential guidance.

Review carefully before installing. Static-only linting is the lowest-risk use. Avoid running the curl-to-bash installer, avoid automatic plugin updates, do not paste cloud secrets into commands or chat, and use a tightly scoped temporary RAM role or STS credentials if DAS diagnosis is needed. The full diagnosis path should be fixed to avoid shell=True with user SQL before use on untrusted SQL.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:22

Finding

Unverified Remote Installer Executed Directly by Bash

Content

View full analysis

= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update, ``` ### Technical Analysis The installation command streams a mutable remote script directly into Bash. The payload is executed without local inspection, version pinning, cryptographic signature verification, or checksum validation. Although the URL uses HTTPS and appears to belong to Alibaba Cloud infrastructure, transport encryption alone does not establish immutable artifact integrity. The effective code executed by the Skill can change after this project has been reviewed. Compromise of the publishing system, CDN, DNS resolution, TLS trust chain, or remote script itself would turn the prerequisite into an arbitrary code-execution channel. This behavior is unnecessary for static SQL linting and exceeds the minimum privileges required by that mode. ### Attack Path 1. An attacker compromises or otherwise influences the remote `setup.sh` payload or its delivery infrastructure. 2. The user or Agent detects an absent or outdated Aliyun CLI installation. 3. Following the Skill instructions, it runs the `curl | bash` command. 4. Bash executes the retrieved content immediately under the invoking user's account. 5. The altered installer can access local files, modify tools or configuration, establish persistence, or use credentials available to the process. ### Impact Assessment Successful exploitation provides arbitrary local command execution with all privileges held by the invoking user. If the command is run from an elevated shell, the payload could obtain system-wide control. Even without elevation, it may access user-owned files, Aliyun CLI configuration, environment ...[truncated 55 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sql_lint.py:1313

Finding

Local Command Injection Through SQL and Database Parameters

Content

View full analysis

Optional[Dict]: """Run aliyun CLI command with action whitelist, response code check, and retry backoff""" parts = command.split() if len(parts) >= 3: action = parts[2] if action not in self._ALLOWED_ACTIONS: print(f"[WARN] action '{action}' not in whitelist, skipping", file=sys.stderr) return None for attempt in range(max_retries): try: result = subprocess.run( command, shell=True, capture_output=True, text=True, timeout=60 ) ``` ```python import base64 try: # Encode SQL to base64 to avoid shell escaping issues sql_bytes = sql.encode('utf-8') sql_base64 = base64.b64encode(sql_bytes).decode('utf-8') # Step 1: Create diagnostic task using CLI # Use double quotes and base64 encoded SQL create_cmd = ( f"aliyun das create-request-diagnosis " f"--endpoint {self.endpoint} " f"--instance-id {self.instance_id} " f"--database {db_name} " f"--sql \"{sql}\"" ) create_result = self._run_cli_command(create_cmd) ``` ```python for sql in statements: try: create_cmd = ( f"aliyun das create-request-diagnosis " f"--endpoint {self.endpoint} " f"--instance-id {self.instance_id} " f"--database {db_name} " f"--sql \"{sql}\"" ) create_result = self._run_cli_command(create_cmd) mid = create_result.get('Data') if create_result else None message_ids.append(mid) ``` ### Technical Analysis The code constructs shell command strings by directly interpolating user-controlled SQL and databas ...[truncated 2016 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sql_lint.py:1425

Finding

Second-Order Command Injection Through API-Derived Message IDs

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/sql_lint.py:1292

Finding

Automatic Installation and Updating of Unpinned CLI Plugins

Content

View full analysis

[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ``` ```python @classmethod def _ensure_cli_plugins(cls): if cls._plugins_ensured: return try: subprocess.run( 'aliyun plugin install --name aliyun-cli-das', shell=True, capture_output=True, text=True, timeout=60 ) verify = subprocess.run( 'aliyun plugin list', shell=True, capture_output=True, text=True, timeout=30 ) if 'das' in (verify.stdout or ''): cls._plugins_ensured = True else: print("[WARN] das plugin install could not be verified", file=sys.stderr) ``` ### Technical Analysis The Skill requires automatic plugin installation and updates, and the Python implementation attempts to install the DAS plugin implicitly when `DASDiagnoser` is initialized. No dependency version is pinned, and the project does not verify a publisher signature or expected cryptographic digest. Installing the newest available dependency at runtime makes execution non-reproducible and allows the effective executable code to change after the Skill has been audited. If the upstream plugin repository, publishing account, distribution infrastructure, or dependency resolution process is compromised, the Skill may retrieve and execute a malicious component. The script also does not check the plugin installation subprocess return code before proceeding to verification. Searching for the substring `das` in plugin-list output is not a strong integrity or identity check. Automatic install ...[truncated 1087 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:103

Finding

Long-Lived Cloud Credentials Exposed Through Command-Line Configuration Examples

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` ```bash aliyun configure set \ --mode AK \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` ```bash aliyun configure set \ --mode StsToken \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --sts-token v1.0:XXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` The RAM policy guide similarly instructs users to place `YOUR_ACCESS_KEY_ID` and `YOUR_ACCESS_KEY_SECRET` directly in `aliyun configure set` arguments. ### Technical Analysis The referenced documentation recommends passing cloud AccessKey material directly as command-line arguments. Literal secrets supplied this way may be retained in shell history, CI logs, terminal recordings, process-monitoring systems, audit telemetry, or Agent transcripts. On systems where process arguments are visible to other users, they may also be exposed while the command is running. This guidance contradicts the primary Skill instructions at `SKILL.md:34-36`, which state that the Agent must never ask for AK/SK values directly or use `aliyun configure set` with literal credential values. Because the Skill explicitly points users to the installation guide, the contradictory examples create a realistic secret-handling hazard. The displayed values appear to be placeholders rather than confirmed live credentials; the vulnerability is the recommended handling method, not a hardcoded active secret ...[truncated 1142 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (32)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs the agent to execute a remote script fetched via curl and pipe it directly into bash, which is a classic supply-chain and arbitrary code execution risk. If the remote host, transport path, or served script is compromised, the agent would immediately run attacker-controlled code on the local environment.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions.

**Pre-check: Aliyun CLI plugin update required**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md

python3 scripts/sql_lint.py --sql "YOUR_SQL"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md

python3 scripts/sql_lint.py --sql "YOUR_SQL"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md

python3 scripts/sql_lint.py --sql "YOUR_SQL"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md

python3 scripts/sql_lint.py --sql "YOUR_SQL"

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/sql_lint.py (reported line 1129)May include surrounding context.

python

SchemaRules.BackwardIncompatibleChange(),
            SchemaRules.MergeAlterTable(),
        ]
        return rules
    
    def lint_sql(self, sql: str, context: Optional[Dict] = None) -> List[Dict]:
        """

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

Using subprocess.run with shell=True for plugin installation is an unnecessary expansion of tool capability beyond SQL linting and can be abused in environments where shell access should not be granted to the skill. Even with a fixed command, it normalizes privileged host actions and increases operational risk.

Content

Scanner excerpt · scripts/sql_lint.py (reported line 1298)May include surrounding context.

python

if cls._plugins_ensured:
            return
        try:
            subprocess.run(
                'aliyun plugin install --name aliyun-cli-das',
                shell=True, capture_output=True, text=True, timeout=60
            )

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This plugin-listing subprocess uses shell=True, giving the skill unnecessary shell execution capability for a non-core task. The immediate command is fixed, so exploitability is limited, but the pattern still weakens execution boundaries and contributes to undisclosed host interaction.

Content

Scanner excerpt · scripts/sql_lint.py (reported line 1302)May include surrounding context.

python

'aliyun plugin install --name aliyun-cli-das',
                shell=True, capture_output=True, text=True, timeout=60
            )
            verify = subprocess.run(
                'aliyun plugin list', shell=True, capture_output=True, text=True, timeout=30
            )
            if 'das' in (verify.stdout or ''):

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This generic subprocess wrapper executes arbitrary assembled commands with shell=True and is later fed strings containing externally influenced parameters. In the context of a skill that accepts SQL and connection-related inputs, this creates a direct path to command execution on the host, making the skill materially more dangerous than a normal static linter.

Content

Scanner excerpt · scripts/sql_lint.py (reported line 1323)May include surrounding context.

python

for attempt in range(max_retries):
            try:
                result = subprocess.run(
                    command, shell=True, capture_output=True, text=True, timeout=60
                )

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code comments claim SQL is base64-encoded to avoid shell escaping issues, but the actual command embeds raw SQL directly inside a shell command string. This is especially dangerous because SQL comes from user input and can contain quotes or shell metacharacters, enabling command injection while creating a false sense of safety for maintainers.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes shell commands, reads local files under references/, and relies on local scripts, but it does not declare any explicit tool scope or allowed-tools boundaries. That increases the chance an agent runtime will grant broader capabilities than necessary, making misuse or accidental execution of sensitive local commands more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation description lists a wide range of requests such as reviewing SQL statements, assessing SQL quality, optimizing queries, validating DDL changes, and analyzing execution plans, but it does not clearly define what specific phrasing or constraints should trigger this skill versus other SQL-related skills. Because the trigger scope is expansive and lacks exclusion examples, it risks unintended invocation for general database assistance requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown states that the DAS endpoint is 'always fixed' and marks other regional endpoints as incorrect. That imposes a specific locale/region policy in natural language without explaining why the skill must be restricted to cn-shanghai or giving the user a choice.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide recommends passing long-lived access keys directly on the command line in non-interactive mode, which exposes secrets to shell history, process listings, CI logs, and agent telemetry. In an automation-oriented skill, this is especially risky because users may copy the pattern into scripts or autonomous runs where secret leakage is persistent and hard to detect.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The examples normalize plaintext storage of access keys in config files and environment variables without an immediate warning about local compromise, accidental disclosure, or inheritance into child processes. Although placeholders are used, the pattern encourages insecure credential handling in real deployments and can lead to credential theft on shared hosts or misconfigured CI runners.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This reference file expands the skill's operational scope from PolarDB SQL linting into general Aliyun CLI plugin installation and account usage. In an agent skill context, unrelated cloud CLI management guidance can enable capability creep, causing an agent or user to provision broader cloud access than is necessary for SQL review and increasing the blast radius if credentials are available.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The notes state that the DAS endpoint is always das.cn-shanghai.aliyuncs.com and explicitly instruct maintainers not to parameterize it by region. This is a natural-language locale/region constraint that forces a specific regional service endpoint without user opt-in or a documented policy justification in the file.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The extended policy expands permissions well beyond basic SQL linting by granting instance enumeration, slow-log access, storage analysis, diagnosis task creation, and script execution on all resources. In a skill whose primary purpose is pre-release SQL assessment, documenting a broadly permissive recommended policy increases the chance that operators overprovision credentials, enabling unnecessary data access or more powerful actions if the skill or its credentials are misused.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Describing hdm:ExecuteScript as 'read-only' is misleading because the action name indicates code or script execution capability, which is materially more dangerous than passive inspection. This can cause reviewers or operators to approve a permission they believe is harmless, potentially enabling active operations against database-related infrastructure if abused.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.