Security audit

alibabacloud-rds-copilot

Security checks for vulnerabilities and agentic risk

Overview

This is a plausible Alibaba Cloud RDS Copilot skill, but it needs review because it can change the local CLI environment, install unpinned remote components, handle cloud credentials, and send database context to Alibaba Cloud.

Install only if you intentionally want an agent to use Alibaba Cloud RDS Copilot. Review and approve any CLI install, plugin install/update, sudo command, or credential setup before it runs. Prefer interactive credential configuration, avoid pasting AccessKey secrets into chat or command arguments, use a least-privileged RAM identity, and redact SQL, logs, customer data, connection strings, tokens, and instance details before sending them to Alibaba Cloud.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:81
Finding: Unverified Remote Installer Is Downloaded and Executed Directly
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:68
Finding: Automatic Installation and Update of an Unpinned CLI Plugin
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:119
Finding: Long-Lived Cloud Credentials Can Be Exposed Through Command-Line Arguments
Content: View full analysis
\ --access-key-secret \ --region cn-hangzhou ``` The workflow further states that, when the user wants the Agent to configure credentials, the Agent should request the following secret fields: ```text - AccessKeyId and AccessKeySecret for AK mode, or the mode-specific fields for STS/RAM-role modes. - STS token if using temporary credentials. ``` ### Technical Analysis Although interactive credential configuration is described as recommended, the Skill retains a non-interactive path that places the AccessKey ID and AccessKey secret directly in process arguments. It also instructs the Agent to request those values from the user. Secrets supplied through this path may be captured in conversation history, Agent traces, tool-call logs, shell history, process-monitoring output, terminal recording, telemetry, or debugging logs. The fact that the CLI later stores the credentials does not protect the earlier chat and process-argument exposure. Long-lived AccessKey credentials are particularly sensitive because they remain useful until revoked or rotated. ### Attack Path 1. The Alibaba Cloud credential preflight reports missing or invalid credentials. 2. The user asks the Agent to perform non-interactive configuration. 3. The Agent requests an AccessKey ID and AccessKey secret through the conversation. 4. The Agent interpolates the values into `aliyun configure set` command-line arguments. 5. The secret is retained in one or more conversation, tool, process, shell, audit, or telemetry records. 6. A user or service with access to those records retrieves th ...[truncated 598 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:138
Finding: Sensitive SQL and Diagnostic Content May Be Transmitted Without a Redaction Gate
Content: View full analysis
' \ --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai [CustomAgentId=] [EnableThinking=] [ThinkEffort=] [ModelId=] \ --event-mode separate \ --endpoint rdsai.aliyuncs.com \ --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}' \ [--conversation-id ''] ``` The documented troubleshooting flow includes forwarding instance identifiers and error details: ```bash aliyun rdsai chat-messages \ --query 'RDS instance rm-bp1xxx connection timeout, error Too many connections, please help troubleshoot. Instance is in Hangzhou region.' \ --inputs RegionId=cn-hangzhou Language=zh-CN Timezone=Asia/Shanghai \ --event-mode separate \ --endpoint rdsai.aliyuncs.com \ --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}' ``` ### Technical Analysis Sending user queries to `rdsai.aliyuncs.com` is declared and necessary for the Skill’s remote RDS Copilot functionality. Therefore, the network transmission itself is not hidden exfiltration. However, the workflow does not establish a mandatory inspection, redaction, minimization, or confirmation gate before forwarding full SQL, pasted errors, logs, instance identifiers, and troubleshooting context. Such content may contain credentials in connection strings, authentication tokens, customer data, personal data, SQL literals, internal hostnames, schema details, or other confidential operational information. The use of a conversation identifier for multi-turn sessions can also correlate sensitive content across multiple reques ...[truncated 1380 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Context Leakage

High

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The verification flow captures full CLI output into RESULT, prints it verbatim, and then extracts and echoes ConversationId. In a shared terminal, CI log, or support transcript, this can leak conversation metadata and potentially other response content from the RDS Copilot session, increasing the risk of cross-session correlation or inadvertent disclosure of sensitive prompts/results.
Content: Scanner excerpt · references/verification-method.md (reported line 177)May include surrounding context.
md
--user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-copilot/{session-id}' 2>&1) echo "$RESULT" # Extract ConversationId CONV_ID=$(echo "$RESULT" | grep -oP '"ConversationId":"[^"]+' | head -1 | cut -d'"' -f4) echo "ConversationId: $CONV_ID"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger list is broad enough to activate on generic database help requests such as SQL optimization or troubleshooting, even when the user did not intend to use Alibaba Cloud RDS Copilot. In this skill, unintended activation is more dangerous because activation can lead to autonomous installation, plugin changes, and credential prompts or API calls.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to make the environment 'ready by itself' and to install or upgrade the Alibaba Cloud CLI and plugins without first requiring user-initiated setup. In this context, autonomous modification of the local environment and preparation for cloud access materially increases risk because a loosely triggered skill can perform networked installation and change execution state before the user fully understands the consequences.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
## Agent Execution Contract Before calling RDS Copilot, the agent must make the local environment ready by itself whenever command execution is available. Do not ask the user to install CLI or plugins first if the agent can install or upgrade them directly. If install or upgrade needs network access, sudo, or tool approval, request that approval with the concrete command and continue after approval. **Hard gate**: Do not execute `aliyun rdsai chat-messages` until all readiness checks pass:

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 89% confidence
Finding: The instructions allow the agent to proceed from missing prerequisites into credential setup guidance and potentially configuration actions, while enforcing default region and other operational choices. In a skill that can touch real cloud accounts, this degree of autonomous decision-making can steer users into credential entry and account-affecting operations without a narrowly scoped, explicit consent boundary.
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
- Missing or old CLI: install or upgrade Alibaba Cloud CLI, then re-run `aliyun version`. - Missing `rdsai` plugin: enable plugin auto-install and install or trigger installation of `rdsai`, then re-check the command. - Missing/invalid credentials: stop before the RDS Copilot API call and guide the user to configure credentials. If the user asks the agent to configure them, request only the required fields, then configure through `aliyun configure`; never ask the user to paste secrets into environment variables. **Default region**: If the user does not explicitly provide a region, always use `cn-hangzhou`. Natural language "Hangzhou" maps to `cn-hangzhou`. Keep this default in both `--inputs RegionId=cn-hangzhou` and any credential setup guidance unless the user specifies another region.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The skill includes privileged installation paths using sudo installer and a one-line curl | bash pattern that downloads and executes remote code. This is dangerous because it combines elevated execution with network-fetched content, creating a strong supply-chain and arbitrary code execution risk if the source, transport, or script is compromised.
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
# Option 2: Install via PKG package curl -O https://aliyuncli.alicdn.com/aliyun-cli-latest.pkg sudo installer -pkg aliyun-cli-latest.pkg -target / # Option 3: Install via one-click script /bin/bash -c "$(curl -fsSL https://aliyuncli.alicdn.com/install.sh)"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The Linux install instructions direct the agent to download a binary archive from the network and place the extracted executable into /usr/local/bin/ using sudo. Without mandatory integrity verification, this permits privileged installation of potentially tampered binaries and expands the blast radius of any compromise.
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
Or download TGZ package for manual installation

curl https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz -o aliyun-cli.tgz tar xzvf aliyun-cli.tgz sudo mv aliyun /usr/local/bin/

text
### Verify Installation

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The parameter table specifies Language defaulting to zh-CN, and later command examples consistently pass Language=zh-CN, which forces a specific locale unless the user overrides it. Although the skill says it understands Chinese or English, it does not present language selection as an explicit opt-in choice before defaulting to Chinese.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The workflow tells the agent to collect parameters using defaults if unspecified, including Language default zh-CN. This operational instruction reinforces a fixed-language default without requiring consent or selection from the user.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill claims it is read-only and requires no cleanup, but earlier instructions direct the agent to install software, enable plugins, modify CLI configuration, and potentially write credentials via aliyun configure. This mismatch can mislead users and higher-level safety systems about the real side effects, increasing the chance of unreviewed environment changes and credential handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The criteria hard-code Language=zh-CN, Timezone=Asia/Shanghai, and default region cn-hangzhou without making clear that these should be user-selected or justified by prior configuration. In an operations assistant, forced locale and region can cause user confusion, misrouting of requests, or accidental processing in an unintended jurisdiction, which is more concerning because cloud/database context may be sensitive and region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The sample aliyun rdsai chat-messages commands send the user's query and accompanying context fields to an external Alibaba Cloud service, but the acceptance criteria do not require any disclosure, consent, or warning before doing so. In a skill meant for SQL optimization and troubleshooting, prompts may contain SQL text, schema details, or operational metadata, so omitting a transmission warning creates a meaningful risk of unintended data exposure to a third party.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation explicitly instructs sending arbitrary user queries, troubleshooting details, SQL text, and multi-turn conversation content to a remote AI service, but it provides no warning about data sensitivity, retention, logging, or consent. In this skill context, prompts may contain database identifiers, SQL statements, operational incidents, and potentially secrets or personal data, so omission of privacy guidance creates a realistic data-exposure risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The supported parameter table sets defaults of RegionId=cn-hangzhou, Language=zh-CN, and Timezone=Asia/Shanghai, and all examples repeat those locale choices. This can violate language/locale policy because it imposes a specific language and locale without user opt-in or justification that the skill is intended only for that region.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The verification commands hard-code Language=zh-CN and Timezone=Asia/Shanghai, and later sections repeat the same pattern as expected behavior. This is a natural-language policy concern because the skill appears to require a specific locale without user opt-in or justification that the tool is region-locked.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instruction says the agent 'must still pass RegionId=cn-hangzhou' even when the user omitted region, which imposes a specific regional setting by default. Without explicit opt-in or a documented reason that this skill is restricted to that region, this is a locale-policy issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Context Leakage

Vague Triggers

Autonomous Decision Making

Autonomous Decision Making

Sudo/Root Execution

Sudo/Root Execution

Or download TGZ package for manual installation

Natural-Language Policy Violations

Natural-Language Policy Violations

Intent-Code Divergence

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis