ClawHub
Back to skill

Security audit

alibabacloud-rds-instances-manage

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Alibaba Cloud RDS management helper, but it asks agents to install mutable CLI plugins and run high-impact cloud commands using unsafe shell-style templates.

Install only if you are comfortable letting an agent operate Alibaba Cloud RDS through a tightly scoped RAM profile. Prefer preinstalled, verified Alibaba Cloud CLI plugins; disable or restore global auto-plugin-install after use; use read-only permissions by default; require exact confirmation for every mutation; and avoid using this skill for database-account password creation unless the execution environment protects process arguments and logs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:47
Finding

Automatic Installation of Unpinned Alibaba Cloud CLI Plugins

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:47-64
Vulnerability Type: Unpinned executable dependency installation
Risk Level: Medium

Vulnerable Code

bash
aliyun configure set --auto-plugin-install true
aliyun plugin list
aliyun rds --help
aliyun configure list

The Skill additionally directs the Agent to install plugins by mutable short name:

bash
aliyun plugin install --names <product>

The same automatic plugin configuration also appears in references/verification-method.md:44.

Technical Analysis

The Skill enables Alibaba Cloud CLI's automatic plugin installation and permits plugins to be installed using only a product short name. It does not require a pinned plugin version, integrity checksum, trusted publisher verification, or validation of the retrieved executable artifact. It also does not direct the Agent to restore the previous global auto-install setting after completing the task.

Alibaba Cloud CLI plugins are executable dependencies. Their behavior can change independently of the reviewed Skill package. Consequently, the code ultimately executed by the Skill is not fully represented by the audited files. This creates a supply-chain boundary where a compromised plugin repository, publishing account, or mutable plugin release could introduce unreviewed local code.

Attack Path

  1. The Agent executes aliyun configure set --auto-plugin-install true.
  2. A required product plugin is absent or an API request causes plugin resolution.
  3. Alibaba Cloud CLI retrieves a plugin selected by its mutable product name.
  4. If the distribution channel or plugin release is compromised, the malicious plugin is installed.
  5. The plugin executes with the same operating-system privileges and cloud credentials available to the Agent.
  6. Because auto-install remains globally enabled, later CLI operations may continue retrieving executable components without an explici ...[truncated 527 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not enable automatic plugin installation globally as a default readiness step.
  2. Require explicit user or tool approval before installing executable dependencies.
  3. Pin each plugin to a tested version when the CLI supports version selection.
  4. Verify the plugin's trusted publisher, signature, and cryptographic checksum before execution.
  5. Record and restore the previous auto-plugin-install setting after the task.
  6. Prefer verified, preinstalled plugins in controlled environments.
  7. Revalidate the exact plugin version and action help before each cloud operation.
  8. Document the trusted plugin source and reject unexpected mirrors or repositories.

T09 · Insecure Skill Coding Practices

Error
Location
references/related-apis.md:261
Finding

Shell Command Injection Through User-Controlled CLI Parameters

Content
View full analysis

Vulnerability Details

File Location: references/related-apis.md:261-267
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

bash
aliyun rds modify-db-instance-description \
  --db-instance-id rm-example \
  --db-instance-description '<new-description>' \
  --region cn-hangzhou \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-instances-manage/{session-id}' \
  --profile <profile>

Other affected templates include the password command at references/related-apis.md:281-293 and the whitelist command at references/related-apis.md:296-306:

bash
aliyun rds create-account \
  --db-instance-id rm-example \
  --account-name <account-name> \
  --account-password '<redacted>' \
  --account-type Normal \
  --region cn-hangzhou \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-instances-manage/{session-id}' \
  --profile <profile>
bash
aliyun rds modify-security-ips \
  --db-instance-id rm-example \
  --db-instance-ip-array-name default \
  --security-ips '10.0.0.0/24,192.0.2.10' \
  --modify-mode Cover \
  --region cn-hangzhou \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-instances-manage/{session-id}' \
  --profile <profile>

Technical Analysis

The templates place user-derived values directly into shell command strings. Some placeholders are unquoted, while others are enclosed in single quotes. Single quotes do not make arbitrary interpolation safe if the substituted value itself contains a single quote. The Skill does not mandate an argument-vector process API, robust shell escaping, or strict field-specific validation before constructing these commands.

If an Agent replaces placeholders through direct string interpolation and submits the resulting text to a shell, a crafted value can terminate the quoted argument and append shell syntax. For example ...[truncated 1482 chars]

Remediation
View remediation

Remediation Suggestions

  1. Invoke aliyun through an argument-vector process API with shell processing disabled.
  2. Pass each parameter as a distinct argument rather than constructing a command string.
  3. Apply strict field-specific validation:
    • Validate region, instance, VPC, vSwitch, zone, and profile identifiers against documented character sets.
    • Parse and canonicalize every IP address and CIDR.
    • Parse parameter JSON structurally instead of accepting arbitrary shell text.
    • Enforce documented length and character restrictions for descriptions, account names, tags, and connection prefixes.
  4. If shell execution is unavoidable, use a proven escaping routine for every dynamic argument; do not rely on surrounding placeholders with quotes.
  5. Reject newline characters, NUL bytes, and unexpected control characters.
  6. Display the normalized argument list during confirmation without reconstructing it as executable shell text.
  7. Add negative tests using quotes, command separators, substitutions, redirects, and newline payloads.

T09 · Insecure Skill Coding Practices

Warning
Location
references/related-apis.md:281
Finding

Database Password Exposed in Process Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: references/related-apis.md:281-293
Vulnerability Type: Plaintext secret exposure through process arguments
Risk Level: Medium

Vulnerable Code

bash
aliyun rds create-account \
  --db-instance-id rm-example \
  --account-name <account-name> \
  --account-password '<redacted>' \
  --account-type Normal \
  --region cn-hangzhou \
  --user-agent 'AlibabaCloud-Agent-Skills/alibabacloud-rds-instances-manage/{session-id}' \
  --profile <profile>

The following instruction accompanies the template:

text
Replace <redacted> only at execution time. Never persist or echo the real password.

SKILL.md:177 likewise requires the plaintext password to appear in the CLI command argument at execution time.

Technical Analysis

The Skill has strong chat, file, and dry-run redaction requirements, but it explicitly places the real database password in the process argument vector. Quoting affects shell parsing only; it does not remove the plaintext value from the launched process's arguments.

Depending on operating-system and execution-platform controls, command-line arguments may be visible through process inspection, endpoint monitoring, audit systems, parent-process telemetry, command tracing, terminal history, or orchestration logs. Therefore, the promise that the password appears in exactly one place does not ensure that downstream systems will not capture it.

Attack Path

  1. The user provides a database account password immediately before execution.
  2. The Agent replaces <redacted> with the plaintext password.
  3. The Agent launches aliyun with --account-password in its argument vector.
  4. A local process observer, audit service, execution wrapper, or telemetry collector records or reads the command-line arguments.
  5. The observer recovers the database password and can attempt to authenticate to the creat ...[truncated 470 chars]
Remediation
View remediation

Remediation Suggestions

  1. Use a CLI-supported protected input channel, such as stdin, an interactive no-echo prompt, a secure file descriptor, or a secret-manager reference.
  2. If Alibaba Cloud CLI only accepts this field through argv, explicitly document the residual exposure and require approval before using that mechanism.
  3. Execute in an environment where process arguments are not visible to unrelated users.
  4. Disable shell tracing, command history, verbose process logging, and execution telemetry for the sensitive invocation.
  5. Ensure errors and diagnostic wrappers redact the --account-password argument.
  6. Keep the secret only in memory for the shortest possible period and clear references after process launch.
  7. Prefer temporary or rotated database credentials when operationally supported.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
84% confidence
Finding

The instruction to let the agent install or upgrade Alibaba Cloud CLI on its own increases autonomous control over the execution environment. Even though this is framed as operational readiness, allowing self-directed tool installation/modification can create supply-chain, environment-tampering, and unintended-execution risk, especially in a skill that can later perform cloud operations.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
## Agent Execution Contract

Make the local environment ready when command execution is available. Do not ask the user to install or upgrade Alibaba Cloud CLI when the agent can do it after obtaining any required tool approval.

Do not run a business API until all readiness gates pass:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

md
- [references/verification-method.md](references/verification-method.md): static, dry-run, and live read-only verification.
- [references/acceptance-criteria.md](references/acceptance-criteria.md): required and forbidden behavior.
- [Alibaba Cloud RDS OpenAPI 2014-08-15](https://help.aliyun.com/zh/rds/developer-reference/api-rds-2014-08-15-overview)
- [Alibaba Cloud CLI RDS 2014-08-15](https://api.aliyun.com/api-tools/cli/Rds/2014-08-15)
- [Alibaba Cloud DAS OpenAPI 2020-01-16](https://help.aliyun.com/zh/das/developer-reference/api-das-2020-01-16-overview)

## Constraints

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/related-apis.md (reported line 366)May include surrounding context.

md
- [references/verification-method.md](references/verification-method.md): static, dry-run, and live read-only verification.
- [references/acceptance-criteria.md](references/acceptance-criteria.md): required and forbidden behavior.
- [Alibaba Cloud RDS OpenAPI 2014-08-15](https://help.aliyun.com/zh/rds/developer-reference/api-rds-2014-08-15-overview)
- [Alibaba Cloud CLI RDS 2014-08-15](https://api.aliyun.com/api-tools/cli/Rds/2014-08-15)
- [Alibaba Cloud DAS OpenAPI 2020-01-16](https://help.aliyun.com/zh/das/developer-reference/api-das-2020-01-16-overview)

## Constraints

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The acceptance criteria mandate cn-hangzhou as the default omitted target region and --region cn-shanghai for DAS calls. This imposes a locale/region choice in natural-language requirements, and the file does not indicate user choice or explain that the skill is explicitly limited to a China-region-only deployment context.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 58)May include surrounding context.

md
- Claim one region is the whole account.
- Claim the first page is a complete result.
- Report an empty result without checking region and filters.
- Send arbitrary CPU/IO metric names to `GetPfsMetricTrends`.

## 5. Mutation confirmation

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/related-apis.md (reported line 88)May include surrounding context.

md
| Capability | Rds Action | Required API inputs | Important optional inputs and risks |
|---|---|---|---|
| `create_db_instance` | `CreateDBInstance` | `RegionId`, `Engine`, `EngineVersion`, `DBInstanceClass`, `DBInstanceStorage`, `DBInstanceStorageType`, `DBInstanceNetType`, `PayType`, `SecurityIPList` | `InstanceNetworkType`, `VPCId`, `VSwitchId`, `ZoneId`, category, period; creates an order and may charge automatically |
| `modify_parameter` | `ModifyParameter` | `DBInstanceId` plus `Parameters` or `ParameterGroupId` | `Forcerestart`, `SwitchTimeMode`, `SwitchTime`; parameter changes can restart or destabilize the instance |
| `modify_db_instance_spec` | `ModifyDBInstanceSpec` | `DBInstanceId` plus at least one target spec field | class, storage, category, pay type, effective time; may create an order, charge, restart, or cause a transient connection impact |
| `modify_db_instance_description` | `ModifyDBInstanceDescription` | `DBInstanceId`, `DBInstanceDescription` | metadata-only but still mutating |