Alibabacloud Pts Ops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:33 AM UTC
• Version: 0.0.1

Overview

The skill appears to be a legitimate Alibaba Cloud PTS helper, but it asks for persistent plugin installation behavior and enables high-impact stress tests without enough containment.

Review carefully before installing. Prefer a verified, pinned Aliyun CLI installation method, avoid enabling global automatic plugin installation unless you accept that persistent trust expansion, use a narrowly scoped RAM role, and only run tests against systems you own or are explicitly authorized to test. Avoid real credentials in scenario JSON and redact debug logs before sharing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:49

Finding

Automatic Installation of Unpinned Remote CLI Plugins

Content

View full analysis

**Pre-check: Aliyun CLI >= 3.3.1 required** > Run `aliyun version` to verify >= 3.3.1. If not installed or version too low, > see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions. > Then **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. ```bash # Verify CLI version aliyun version # Enable auto plugin installation aliyun configure set --auto-plugin-install true ``` ``` ### Technical Analysis The skill mandates enabling automatic plugin installation globally in the Aliyun CLI configuration. After this setting is enabled, subsequent CLI commands may retrieve and install executable plugins without a separate review or approval step. The instructions do not constrain plugin versions, pin an expected artifact digest, define an approved plugin allowlist, or require the user to review the plugin before installation. The setting also persists beyond the immediate skill operation, expanding the trust boundary of future Aliyun CLI commands. This creates a dependency supply-chain risk. If the plugin repository, publishing account, name-resolution path, distribution infrastructure, or plugin selection mechanism is compromised, an affected plugin could execute with the local privileges and cloud credentials available to the Aliyun CLI process. ### Attack Path 1. An attacker compromises a plugin publishing account, plugin repository, distribution endpoint, or another component in the plugin delivery chain. 2. The attacker publishes or substitutes a malicious plugin for a product command that the skill will invoke. 3. A user loads the skill and follows the mandatory instruction to enable `--auto-plugin-install`. 4. The user or agent ex ...[truncated 1089 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:40

Finding

Unverified Mutable CLI Archive Is Installed into a Privileged Executable Path

Content

View full analysis

Remediation

View remediation

other

Error

• Location: SKILL.md:215

Finding

Stress Tests Can Be Started Against Arbitrary Targets Without Authorization Validation

Content

View full analysis

**[MUST] Pre-flight Safety Checks** — Starting a stress test sends significant traffic to the > target system. ALL of the following checks MUST pass before executing `start-pts-scene`: > > 1. **Idempotency guard** — Run `get-pts-scene-running-status --scene-id `. > If the status is `RUNNING` or `SYNCING`, the test is already in progress — skip the start > command and proceed to monitoring. Do NOT start a duplicate test. > 2. **Retrieve and verify scene configuration** — Run `get-pts-scene --scene-id ` and > confirm the response contains a valid `SceneName`, at least one `RelationList` entry with a > non-empty `Url`, and a valid `LoadConfig` (non-zero `MaxRunningTime` and concurrency). > If any field is missing or empty, abort and notify the user. > 3. **Display test summary and require explicit user confirmation** — Present the following to > the user and wait for explicit approval (e.g., "yes" / "确认"): > - Target URL(s) > - Concurrency level > - Test duration > - Test mode (concurrency / TPS) > > Do NOT proceed without the user's explicit "go-ahead" confirmation. ``` The scene format accepts a user-selected URL and multiple HTTP methods, while the pre-flight checks only establish that the URL is non-empty and that the requesting user approves the operation. They do not establish that the user owns or is authorized to test the target. ### Technical Analysis Alibaba Cloud PTS is capable of sending significant distributed traffic to a configured target. The skill recognizes this risk and requires confirmation, but confirmation by the requesting user is not equivalent to authorization from the target owner. No documented check requires proof of domain ownership, a target-side verification token, an organizational ...[truncated 2321 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 424)May include surrounding context.

md

Delete scenarios when no longer needed.

> **[MUST] Pre-delete Safety Checks** — Before deleting any scenario, ALL of the following
> checks MUST pass:
>
> 1. **Idempotency guard** — Using the target **`SceneId`** (not name), verify it still exists

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest trigger list includes generic terms such as "PTS", "性能测试", "stress testing", and "performance testing" without any limiting context or exclusion conditions. These phrases can plausibly appear in normal conversation or unrelated discussions, making activation scope ambiguous for a markdown/manifest file.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 179)May include surrounding context.

aliyun pts get-pts-scene --scene-id $SCENE_ID --user-agent AlibabaCloud-Agent-Skills

text

### ❌ INCORRECT: No Verification

```bash
# Wrong: no verification after creation

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 182)May include surrounding context.

❌ INCORRECT: No Verification

bash

# Wrong: no verification after creation
aliyun pts create-pts-scene --scene '...' --user-agent AlibabaCloud-Agent-Skills
# Immediately proceeding without checking if creation succeeded

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 184)May include surrounding context.

bash

# Wrong: no verification after creation
aliyun pts create-pts-scene --scene '...' --user-agent AlibabaCloud-Agent-Skills
# Immediately proceeding without checking if creation succeeded

---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 217)May include surrounding context.

md

### 1. Use RAM Users (Not Root Account)

❌ **Don't**: Use Aliyun root account credentials
✅ **Do**: Create RAM users with specific permissions in the RAM console

### 2. Principle of Least Privilege

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 248)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This reference teaches users how to create stress-testing scenarios but does not warn that load tests can degrade, disrupt, or take down target systems if run against production or unauthorized endpoints. In a performance-testing skill, omission of safety guidance materially increases the chance of accidental denial-of-service against real services.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/pts-scene-json-reference.md (reported line 69)May include surrounding context.

md

"ApiList": [
        {
          "ApiName": "login-api",
          "Url": "https://api.example.com/login",
          "Method": "POST",
          "Body": {
            "ContentType": "application/json",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/pts-scene-json-reference.md (reported line 283)May include surrounding context.

md

"ApiList": [
        {
          "ApiName": "login-api",
          "Url": "https://api.example.com/login",
          "Method": "POST",
          "Body": {
            "ContentType": "application/json",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The examples include a username, password, and token-shaped values in request bodies and global parameters without clearly warning users not to place real credentials, API keys, or session tokens into scenario JSON. In documentation for a cloud-based load-testing system, this can normalize embedding secrets in test configs that may be stored, shared, logged, or uploaded to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document provides ready-to-run commands for starting PTS and JMeter stress tests but does not warn that these actions generate live traffic against target systems and can disrupt services, consume resources, or violate authorization boundaries if used improperly. In a skill specifically designed to create and run performance tests, omission of safety and authorization guidance makes accidental misuse substantially more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document recommends using --log-level debug and explicitly states that output includes request/response headers and body content, but it does not warn that these logs can capture sensitive material such as authentication tokens, cookies, endpoint details, request payloads, or proprietary test data. In a cloud operations and performance-testing context, operators are likely to run these commands against real services, making accidental exposure through terminal history, CI logs, ticket attachments, or shared troubleshooting artifacts a realistic risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The guide links specifically to the Chinese-language Aliyun CLI documentation (/zh/cli/) as the canonical reference without indicating alternatives or that the locale is intentional. This can violate language/locale policy expectations when users are not given a choice or opt-in for Chinese-language materials.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The references list points users to a Chinese-language official documentation URL without explaining the locale constraint or providing alternatives. Because this is user-facing instructional text, it should avoid imposing a language choice by default unless clearly justified.

Content

No source excerpt is available for this finding.