Security audit

Alibabacloud Polardbx Ai Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Alibaba Cloud PolarDB-X diagnostic assistant, but its setup instructions use unsafe remote installers and persistent global CLI/plugin changes that users should review before installing.

Install only after replacing the pipe-to-shell installer steps with a pinned, verified Aliyun CLI installation method. Use a dedicated least-privilege Aliyun profile with DAS read-only permissions, avoid entering long-lived access keys in an agent session or shell command history, and do not enable global automatic plugin installation or update unrelated plugins unless you explicitly accept that broader supply-chain risk.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:43
Finding: Unverified Remote Installer Execution via curl-to-Bash Pipeline
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:43, SKILL.md:68; repeated as installation guidance in scripts/call_yaochi_agent.sh:65
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Vulnerable Code

SKILL.md:41-44:

bash
> **Pre-check: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions.

SKILL.md:66-69:

bash
# Install aliyun CLI curl -fsSL https://aliyuncli.alicdn.com/install.sh | bash aliyun version # Verify >= 3.3.3

scripts/call_yaochi_agent.sh:62-67:

bash
if ! command -v aliyun &>/dev/null; then echo "Error: aliyun CLI not found, please install (>= 3.3.3)" >&2 echo "Install: curl -fsSL https://aliyuncli.alicdn.com/install.sh | bash" >&2 echo "See: references/cli-installation-guide.md" >&2 exit 1 fi

The shell script only prints the installation command; the executable instructions are in SKILL.md.

Technical Analysis

The installation instructions send mutable content retrieved from an external HTTPS endpoint directly into Bash. There is no version pinning, checksum verification, digital-signature validation, or opportunity to inspect the retrieved script before execution.

HTTPS protects the connection in transit but does not establish that a mutable installer is the same artifact reviewed with this Skill. If the hosting origin, publishing process, CDN, DNS/TLS trust path, or installer account is compromised, the downloaded content can be replaced without changing the audited project.

Immediate shell execution is not necessary for the declared diagnostic functionality. The included installation guide already ...[truncated 1472 chars]
Remediation: View remediation
Remediation Suggestions

Remove all pipe-to-shell installation commands from SKILL.md and the error message in scripts/call_yaochi_agent.sh.

Prefer a trusted operating-system package manager, such as Homebrew, where package metadata and update behavior are independently managed.

If direct download is necessary:

Pin an explicit Aliyun CLI version instead of using mutable latest, setup.sh, or install.sh endpoints.

Download the artifact to a local file rather than piping it to a shell.

Verify a vendor-published cryptographic signature or pinned SHA-256 checksum.

Abort installation when verification fails.

Inspect the script before executing it.

Do not run the installer with administrative privileges unless installation into a protected path is explicitly required.

Document the expected download URL, version, checksum source, and verification procedure.

Require explicit user approval before executing any downloaded installer.

T08 · Insecure Dependencies

Warning

Location: SKILL.md:46
Finding: Global Automatic Installation and Unpinned Update of Aliyun CLI Plugins
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:46-48, SKILL.md:71-75
Vulnerability Type: Unpinned executable dependencies and unnecessarily broad plugin updates
Risk Level: Medium

Vulnerable Code

SKILL.md:46-48:

bash
> **Pre-check: Aliyun CLI plugin update required** > **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > **[MUST]** run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

SKILL.md:71-75:

bash
# Enable automatic plugin installation aliyun configure set --auto-plugin-install true # Install DAS plugin (get-yao-chi-agent requires plugin for Signature V3 support) aliyun plugin install --names aliyun-cli-das

Technical Analysis

The Skill requires a persistent Aliyun CLI configuration change that enables automatic plugin installation and then requires updating every existing plugin. No plugin version, checksum, or signature is pinned or verified.

The declared functionality only requires the DAS plugin providing get-yao-chi-agent. Updating unrelated plugins is outside that functional requirement and broadens the supply-chain exposure. Enabling automatic installation globally also remains effective beyond a single Skill invocation unless the user later reverses the setting.

The wrapper contains a safer runtime design at scripts/call_yaochi_agent.sh:82-88: it checks for the DAS plugin and refuses to install it automatically. That behavior conflicts with the broader mandatory installation instructions in SKILL.md.

This issue does not demonstrate dependency confusion or a currently malicious plugin. It creates an unsafe dependency acquisition path in which mutable executable components may be installed or replaced without review.

Attack Path

An attacker compromises a plugin release, plugin repository, distribution account, or update channe ...[truncated 1410 chars]
Remediation: View remediation
Remediation Suggestions

Remove the requirement to run the global aliyun plugin update command.

Do not require --auto-plugin-install true; keep automatic plugin installation disabled.

Install only the DAS plugin required by this Skill.

Pin a tested DAS plugin version where the CLI supports version selection.

Verify the plugin through a vendor signature or published cryptographic checksum before installation.

Require explicit user approval before plugin installation or replacement.

Preserve the wrapper's current fail-closed behavior: detect a missing plugin, provide safe manual instructions, and exit without downloading code.

If automatic installation must temporarily be enabled, record its prior value, limit its use to the required operation, and restore the original setting on every exit path.

Run the Skill with a dedicated Aliyun profile containing only the documented DAS read permissions rather than a broadly privileged default profile.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (21)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs users to fetch and immediately execute a remote script via curl piped to bash. This is dangerous because any compromise of the remote host, CDN path, TLS interception point, or published script content results in arbitrary code execution on the user's machine, and this skill already operates in a cloud-admin context where credentials and CLI state may be present.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
> **Pre-check: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions. > **Pre-check: Aliyun CLI plugin update required**

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: This command again downloads and executes a remote installer in one step, creating arbitrary code execution risk. Because the skill is for database operations and relies on existing Alibaba Cloud credentials, successful exploitation could expose cloud access, alter local CLI plugins, or persist malicious tooling in an administrative environment.
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
bash
# Install aliyun CLI curl -fsSL https://aliyuncli.alicdn.com/install.sh | bash aliyun version # Verify >= 3.3.3 # Enable automatic plugin installation

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The use of a pipeline into bash is a classic command-chaining pattern that bypasses opportunities for validation between download and execution. In this skill's context, that makes the risk more severe because the environment may contain cloud CLI credentials and plugin trust settings, allowing a malicious installer to immediately leverage privileged access.
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
bash
# Install aliyun CLI curl -fsSL https://aliyuncli.alicdn.com/install.sh | bash aliyun version # Verify >= 3.3.3 # Enable automatic plugin installation

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/acceptance-criteria.md (reported line 196)May include surrounding context.
Error: using Python SDK for credentials

from alibabacloud_das20200116.client import Client as DAS20200116Client

Error: parsing credentials from .env file

Error: parsing credentials from ~/.alibabacloud/credentials

text

Instruction Override

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · scripts/call_yaochi_agent.sh (reported line 45)May include surrounding context.
sh
Options: --session-id <id> Session ID for multi-turn conversation --profile <name> Specify aliyun CLI profile --debug, -d Enable debug mode --help, -h Show help information Examples:

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: The script recommends a classic 'curl | bash' installation pattern for the aliyun CLI, which encourages fetching and immediately executing remote code without integrity verification. In an O&M/database-admin context, users are likely to run this with elevated privileges on sensitive hosts, so compromise of the download source, transport, or copied command could lead to arbitrary code execution and credential theft.
Content: Scanner excerpt · scripts/call_yaochi_agent.sh (reported line 65)May include surrounding context.
sh
check_dependencies() { if ! command -v aliyun &>/dev/null; then echo "Error: aliyun CLI not found, please install (>= 3.3.3)" >&2 echo "Install: curl -fsSL https://aliyuncli.alicdn.com/install.sh | bash" >&2 echo "See: references/cli-installation-guide.md" >&2 exit 1 fi

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes shell commands extensively, including package installation, plugin management, and script execution, but declares no explicit tool scope such as allowed-tools or permissions. This weakens containment and reviewability because an agent may be granted broader shell access than users or orchestration systems expect, increasing the blast radius if the skill is misused or combined with prompt injection.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The authentication section says to stop when no valid profile exists, but later includes direct credential configuration examples using access-key-id and access-key-secret. In practice, this contradiction can cause agents or users to proceed with in-session credential setup despite the earlier safety rule, increasing the risk of secret entry, logging, or unsafe handling of long-lived cloud credentials.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.
md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.
md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.
md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/call_yaochi_agent.sh (reported line 74)May include surrounding context.
sh
tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/call_yaochi_agent.sh (reported line 75)May include surrounding context.
sh
tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH sudo mv aliyun /usr/local/bin/ # Verify aliyun version

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text
### Windows

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.
Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text
### Windows

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The guide instructs users to pass access keys and secrets directly as command-line flags, which can expose credentials through shell history, process listings, terminal logging, CI logs, and agent telemetry. In a skill intended for automation and agent-driven operations, this increases the likelihood of secret leakage substantially.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.
md
1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once ### Configuration Modes

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document shows credentials stored in ~/.aliyun/config.json, including an example containing the access_key_secret, without an immediate warning that this file contains sensitive material and must be protected. Presenting the secret inline normalizes plaintext secret storage and may lead users to leave the file readable, copied into backups, or committed accidentally.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.
bash
# Restrict permissions chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest scopes the skill to PolarDB-X cluster management, diagnostics, security audit, backup/restore, and related O&M tasks. This guide instructs users to install arbitrary product plugins such as ECS, VPC, and RDS, and to explore unrelated service command sets including Function Compute, which extends well beyond what is justified for a PolarDB-X-focused assistant.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The verification steps instruct the user to perform authenticated Alibaba Cloud API calls and invoke a script that will send prompts and likely account or environment context to external services, but they do not explicitly warn that credentials, instance identifiers, session context, and diagnostic data may be transmitted. In a cloud operations skill, this omission can lead users to disclose production metadata or interact with real resources during 'verification' without understanding the exposure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

External Script Fetching

External Script Fetching

Chaining Abuse

Credential Access

Error: using Python SDK for credentials

Error: parsing credentials from .env file

Error: parsing credentials from ~/.alibabacloud/credentials

Instruction Override

External Script Fetching

Undeclared Tool Scope

Intent-Code Divergence

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Extract and install

Sudo/Root Execution

Extract and install

Missing User Warnings

Session Persistence

Missing User Warnings

Sudo/Root Execution

Troubleshooting

Context-Inappropriate Capability

Missing User Warnings

Static analysis