Alibabacloud Pts Task

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:11 AM UTC
• Version: 0.0.1

Overview

The skill is a coherent Alibaba Cloud PTS worker, but it enables high-impact stress tests and installs mutable tooling without enough scoping or verification.

Review this skill before installing. Use it only with Alibaba Cloud profiles that have least-privilege PTS permissions, only against systems you own or are explicitly authorized to test, avoid real secrets in scene JSON/logs, and prefer verified/pinned CLI and plugin installation steps.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:84

Finding

Stress tests can target systems without verifying authorization

Content

View full analysis

**Parameter Confirmation (Smart Mode)** > > - All required parameters present → echo summary + execute immediately. No re-confirmation. > - Missing/ambiguous parameter → ask user before proceeding. > - Destructive ops (delete/stop) → ALWAYS require explicit user confirmation. ``` ```bash aliyun pts save-pts-scene --scene '{ "SceneName":"YOUR_SCENE_NAME_HERE", "RelationList":[{ "RelationName":"link-1", "ApiList":[{ "ApiName":"api-1", "Url":"http://YOUR_TARGET_URL", "Method":"GET", "TimeoutInSecond":5000 }] }], "LoadConfig":{ "TestMode":"concurrency_mode", "MaxRunningTime":1, "Configuration":{ "AllConcurrencyBegin":5, "AllConcurrencyLimit":5 } } }' --read-timeout 60 --connect-timeout 10 ``` ```text > **[MUST] Pre-flight Safety Checks** — Starting a stress test sends significant traffic to the > target system. ALL of the following checks MUST pass before executing `start-pts-scene`: > > 1. **Idempotency guard** — Run `get-pts-scene-running-status --scene-id `. > If the status is `RUNNING` or `SYNCING`, the test is already in progress — skip the start > command and proceed to monitoring. Do NOT start a duplicate test. > 2. **Retrieve and verify scene configuration** — Run `get-pts-scene --scene-id ` and > confirm the response contains a valid `SceneName`, at least one `RelationList` entry with a > non-empty `Url`, and a valid `LoadConfig` (non-zero `MaxRunningTime` and concurrency). > If any field is missing or empty, abort and notify the user. > 3. **Display test summary** — Present the following to the user: > - Target URL(s) > - Concurrency level > - Test duration > - Test mode (concurrency / TPS) > > If all values ...[truncated 2387 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:42

Finding

Mutable remote CLI binaries and plugins are installed without integrity verification

Content

View full analysis

**Pre-check: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > see [references/cli-installation-guide.md](references/cli-installation-guide.md) > for safe step-by-step installation (do NOT pipe remote scripts directly into a shell). > Then **[MUST]** run `aliyun plugin install pts` to install the PTS plugin. > **[MUST]** run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date. ```bash # Verify CLI version aliyun version # Install PTS plugin (explicit, no auto-install) aliyun plugin install pts aliyun plugin update ``` ``` ```bash # Download wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz # Extract and install to user-local bin (no sudo required) tar -xzf aliyun-cli-linux-latest-amd64.tgz mkdir -p ~/.local/bin install -m 755 aliyun ~/.local/bin/ ``` Equivalent mutable `latest` downloads are also documented for macOS, Linux ARM64, and Windows. ### Technical Analysis The installation guide downloads archives identified by a mutable `latest` URL and installs the extracted executable without checking a cryptographic digest or publisher signature. HTTPS protects the transport connection but does not establish that the downloaded artifact is the exact version reviewed or expected by the skill. The mandatory commands `aliyun plugin install pts` and `aliyun plugin update` also retrieve executable plugin components without pinning versions or verifying an expected digest. The unscoped update operation modifies all existing local plugins rather than only the PTS component needed for this task. Because the CLI subsequently operates with the user's Alibaba Cloud credentials, compromise of the distr ...[truncated 1645 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/pts-scene-json-reference.md:319

Finding

Predictable shared temporary file can expose or alter PTS scene data

Content

View full analysis

/tmp/scene.json << 'EOF' { "SceneName": "my-test", "RelationList": [{ "RelationName": "link-1", "ApiList": [{ "ApiName": "api-1", "Url": "https://example.com", "Method": "GET", "TimeoutInSecond": 10 }] }], "LoadConfig": { "TestMode": "concurrency_mode", "MaxRunningTime": 1, "Configuration": { "AllConcurrencyBegin": 10, "AllConcurrencyLimit": 10 } } } EOF aliyun pts save-pts-scene --scene "$(cat /tmp/scene.json)" ``` ### Technical Analysis The recommended shell workflow uses the fixed path `/tmp/scene.json`. On typical multi-user Unix systems, `/tmp` is shared and predictable. Shell redirection does not safely create a unique temporary file and follows symbolic links. The documentation does not set a restrictive `umask`, verify ownership, atomically create the file, or remove it after use. Although the minimal example is not secret, the same reference supports headers, request bodies, file addresses, and `GlobalParameterList` values. Real scene payloads may consequently contain bearer tokens, API keys, credentials, session data, or private endpoint details. There is also a time-of-check/time-of-use interval between writing the file and reading it for the CLI call. Another local process able to manipulate the file could replace the intended scene data before submission. ### Attack Path **Confidentiality path:** 1. A local attacker monitors or predicts `/tmp/scene.json`. 2. The skill writes a scene containing sensitive headers, body values, or global parameters. 3. The attacker reads the file before it is removed; the documented workflow does not remove it at all. 4. The attacker obtains the embedded test credentials or private configuration. **Int ...[truncated 1176 chars]

Remediation

View remediation

"$scene_file" <<'EOF' { "SceneName": "my-test", "RelationList": [], "LoadConfig": {} } EOF aliyun pts save-pts-scene --scene "$(cat -- "$scene_file")" ``` ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (27)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md

HeaderList, CheckPointList, AdvanceSetting, file params, POST body, etc.), see [references/pts-scene-json-reference.md](references/pts-scene-json-reference.md).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 477)May include surrounding context.

md

HeaderList, CheckPointList, AdvanceSetting, file params, POST body, etc.), see [references/pts-scene-json-reference.md](references/pts-scene-json-reference.md).

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 418)May include surrounding context.

md

> - Even if `list-pts-scene` shows the scene is missing, still attempt `delete-pts-scene` — it will return gracefully if the scene no longer exists.
> - User's explicit instruction overrides any inference about scene state. The evaluation framework asserts the delete API was actually invoked.

> **[MUST] Pre-delete Safety Checks** — Before deleting any scenario, ALL of the following
> checks MUST pass:
>
> 1. **Check if the scenario is currently running** — Run

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ram-policies.md (reported line 1)May include surrounding context.

md

# PTS Verification Methods

This document provides verification steps to confirm successful execution of PTS operations.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/verification-method.md (reported line 1)May include surrounding context.

md

# PTS Verification Methods

This document provides verification steps to confirm successful execution of PTS operations.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill states that destructive operations like stop/delete always require explicit user confirmation, but later mandates unconditional stop API invocation whenever the user requests stopping a scenario regardless of status. This contradiction can cause an agent to skip confirmation logic or behave unpredictably, increasing the chance of unintended interruption of active load tests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The delete workflow contains conflicting directives: one section says to always invoke deletion unconditionally, while the safety checks say a running scenario must be stopped and fully halted before deletion. In an operational skill that can terminate or remove cloud stress-testing resources, such ambiguity can cause unsafe execution paths, accidental deletion attempts against active tests, or inconsistent agent behavior under pressure.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 179)May include surrounding context.

aliyun pts get-pts-scene --scene-id $SCENE_ID --user-agent AlibabaCloud-Agent-Skills

text

### ❌ INCORRECT: No Verification

```bash
# Wrong: no verification after creation

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 182)May include surrounding context.

❌ INCORRECT: No Verification

bash

# Wrong: no verification after creation
aliyun pts create-pts-scene --scene '...' --user-agent AlibabaCloud-Agent-Skills
# Immediately proceeding without checking if creation succeeded

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 184)May include surrounding context.

bash

# Wrong: no verification after creation
aliyun pts create-pts-scene --scene '...' --user-agent AlibabaCloud-Agent-Skills
# Immediately proceeding without checking if creation succeeded

---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 29)May include surrounding context.

md

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Install to user-local bin (no sudo required)
mkdir -p ~/.local/bin
install -m 755 aliyun ~/.local/bin/
# Ensure ~/.local/bin is in your PATH (add to ~/.zshrc or ~/.bash_profile if not):

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 47)May include surrounding context.

md

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Install to user-local bin (no sudo required)
mkdir -p ~/.local/bin
install -m 755 aliyun ~/.local/bin/
# Ensure ~/.local/bin is in your PATH (add to ~/.zshrc or ~/.bash_profile if not):

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 64)May include surrounding context.

md

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Install to user-local bin (no sudo required)
mkdir -p ~/.local/bin
install -m 755 aliyun ~/.local/bin/
# Ensure ~/.local/bin is in your PATH (add to ~/.zshrc or ~/.bash_profile if not):

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 81)May include surrounding context.

md

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Install to user-local bin (no sudo required)
mkdir -p ~/.local/bin
install -m 755 aliyun ~/.local/bin/
# Ensure ~/.local/bin is in your PATH (add to ~/.zshrc or ~/.bash_profile if not):

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Install to user-local bin (no sudo required)
mkdir -p ~/.local/bin
install -m 755 aliyun ~/.local/bin/
# Ensure ~/.local/bin is in your PATH (add to ~/.zshrc or ~/.bash_profile if not):
#   export PATH="$HOME/.local/bin:$PATH"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 32)May include surrounding context.

md

# Install to user-local bin (no sudo required)
mkdir -p ~/.local/bin
install -m 755 aliyun ~/.local/bin/
# Ensure ~/.local/bin is in your PATH (add to ~/.zshrc or ~/.bash_profile if not):
#   export PATH="$HOME/.local/bin:$PATH"
# If you prefer system-wide install, run the move command with elevated privileges manually.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 51)May include surrounding context.

md

tar -xzf aliyun-cli-linux-latest-amd64.tgz
mkdir -p ~/.local/bin
install -m 755 aliyun ~/.local/bin/
# Ensure ~/.local/bin is in your PATH (add to ~/.bashrc if not):
#   export PATH="$HOME/.local/bin:$PATH"
# If you prefer system-wide install, run the move command with elevated privileges manually.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 68)May include surrounding context.

md

tar -xzf aliyun-cli-linux-latest-amd64.tgz
mkdir -p ~/.local/bin
install -m 755 aliyun ~/.local/bin/
# Ensure ~/.local/bin is in your PATH (add to ~/.bashrc if not):
#   export PATH="$HOME/.local/bin:$PATH"
# If you prefer system-wide install, run the move command with elevated privileges manually.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 85)May include surrounding context.

md

tar -xzf aliyun-cli-linux-latest-amd64.tgz
mkdir -p ~/.local/bin
install -m 755 aliyun ~/.local/bin/
# Ensure ~/.local/bin is in your PATH (add to ~/.bashrc if not):
#   export PATH="$HOME/.local/bin:$PATH"
# If you prefer system-wide install, run the move command with elevated privileges manually.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide recommends running authenticated API calls with --log-level=debug but does not warn that debug output can include sensitive request metadata, headers, profile details, endpoints, and other operational context that may be captured in terminals, CI logs, or support bundles. In an agent/automation context, this increases the chance of credential-adjacent leakage or disclosure of internal cloud configuration.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 233)May include surrounding context.

md

### 1. Use RAM Users (Not Root Account)

❌ **Don't**: Use Aliyun root account credentials
✅ **Do**: Create RAM users with specific permissions in the RAM console

### 2. Principle of Least Privilege

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 264)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The reference includes stress-testing examples that send credentials and bearer-like tokens in request bodies and global parameters, but it does not warn users against using real secrets or running tests against production/live systems. In a PTS worker skill, this omission is risky because users may copy these examples directly into real load tests, causing credential exposure in logs, reports, OSS-backed files, or unintended high-volume traffic against sensitive endpoints.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/pts-scene-json-reference.md (reported line 69)May include surrounding context.

md

"ApiList": [
        {
          "ApiName": "login-api",
          "Url": "https://api.example.com/login",
          "Method": "POST",
          "Body": {
            "ContentType": "application/json",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/pts-scene-json-reference.md (reported line 283)May include surrounding context.

md

"ApiList": [
        {
          "ApiName": "login-api",
          "Url": "https://api.example.com/login",
          "Method": "POST",
          "Body": {
            "ContentType": "application/json",