Alibabacloud Rds Mysql Inspection

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:34 AM UTC
• Version: 0.0.1

Overview

This is a real Alibaba Cloud RDS inspection skill, but its setup asks for risky unpinned installer and plugin-update actions that can change the user's local CLI environment.

Review before installing. Use a dedicated least-privileged Aliyun profile with the custom RAM policy, avoid the curl-to-bash installer path, avoid enabling persistent automatic plugin installation unless you understand the impact, and treat generated HTML reports as sensitive because they load third-party JavaScript when opened.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:55

Finding

Unverified Remote Installer Is Downloaded and Executed Directly

Content

View full analysis

= 3.3.3 required** > Run `aliyun version` to verify the version is >= 3.3.3. If the CLI is missing or outdated, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install or upgrade, > or follow https://help.aliyun.com/zh/cli/ for installation instructions. ``` ### Technical Analysis The installation command pipes the current response from an external URL directly into Bash. The payload is not pinned to a specific release, inspected before execution, checked against a cryptographic checksum, or verified using a trusted signature. Although the hostname appears related to Alibaba Cloud, TLS and a recognizable domain only authenticate the network endpoint. They do not guarantee that the returned script is immutable or that the endpoint, CDN, DNS configuration, or upstream release process has not been compromised. This behavior exceeds the minimum privileges required for an RDS inspection. The inspection only requires an existing Aliyun CLI installation; it does not inherently require the Skill to retrieve and execute a mutable remote installer. ### Attack Path 1. An attacker compromises the installer endpoint, CDN distribution, DNS resolution, TLS termination, or upstream publishing process. 2. The user or Agent follows the documented prerequisite command. 3. `curl` downloads the attacker-controlled response. 4. The pipe sends the response directly to Bash without an opportunity for review or integrity verification. 5. Bash executes the payload with all privileges available to the invoking user. 6. The payload can access local files and credentials, modify tools or configuration, establish persistence, or execute additional network operations. ### Impact Assessment Successful exploitation provides arbitrary lo ...[truncated 661 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:60

Finding

Mandatory Automatic Plugin Installation and Unpinned Updates Create a Supply-Chain Execution Path

Content

View full analysis

[MUST] Run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] Run `aliyun plugin update` to ensure all locally installed plugins are up to date. ```bash aliyun version aliyun configure set --auto-plugin-install true aliyun plugin update ``` ``` ### Technical Analysis The Skill mandates enabling automatic plugin installation and updating every locally installed plugin. No exact plugin names, versions, hashes, signatures, or trusted repository constraints are specified. This creates a mutable dependency path in which the code executed by later Aliyun CLI operations can differ from the components reviewed during this audit. Updating all installed plugins also affects components unrelated to the RDS inspection and modifies persistent CLI configuration beyond the duration and scope of the task. Automatic plugin installation is not the minimum privilege or minimum-change approach needed for an inspection. Only the specific CLI services and versions required by the Skill should be present. Existing unrelated plugins should not be updated, and automatic installation should not remain enabled without explicit user consent. ### Attack Path 1. An attacker compromises a plugin repository, publishing account, distribution service, or plugin update artifact. 2. The Skill requires the user or Agent to enable automatic plugin installation. 3. `aliyun plugin update` resolves and installs mutable plugin releases without project-level version pinning. 4. A compromised plugin is installed or an existing plugin is replaced. 5. A subsequent Aliyun CLI invocation loads or executes the compromised component. 6. The component runs with the current user's local privileges and can ...[truncated 649 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/inspect.py:1946

Finding

Generated Reports Execute Mutable Third-Party JavaScript Without Integrity Verification

Content

View full analysis

``` ### Technical Analysis Generated HTML reports load ECharts from jsDelivr whenever a report is opened. The dependency is pinned only to the major version `5`, so its effective contents can change after this project has been reviewed. The script has no Subresource Integrity (`integrity`) attribute and the report does not constrain execution through a restrictive Content Security Policy. JavaScript loaded through a `

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check-write-operation.sh:8

Finding

Write-Operation Guard Can Be Bypassed by Command Wrapping and Incomplete Action Classification

Content

View full analysis

format) ACTION=$(echo "$COMMAND" | awk '{print $3}') # Write operation Action prefixes (matched case-insensitively to handle both # PascalCase like "ModifyDBInstance" and kebab-case like "modify-db-instance-spec") WRITE_PREFIXES="Create Delete Remove Modify Update Attach Detach Grant Revoke Start Stop Reboot Release Allocate Associate Disassociate Enable Disable Reset Resize" IS_WRITE=false for PREFIX in $WRITE_PREFIXES; do if echo "$ACTION" | grep -qi "^${PREFIX}"; then IS_WRITE=true break fi done # Exception: storage-analysis-task creation is a read-equivalent operation (DAS analysis, # no instance state change). Match both kebab-case and PascalCase. WHITELISTED=false if echo "$COMMAND" | grep -qi "createstorageanalysistask\|create-storage-analysis-task"; then IS_WRITE=false WHITELISTED=true fi ``` ### Technical Analysis The guard recognizes an Aliyun invocation only when the raw command begins exactly with `aliyun ` at character zero. Equivalent commands using leading whitespace, an absolute executable path, `env`, a shell wrapper, or another command prefix are treated as unrelated commands and receive the empty allow response. The action is extracted by whitespace position using `awk '{print $3}'`, which assumes one exact command layout. The guard then uses a finite denylist of write prefixes. Any mutating action whose name does not begin with a listed verb is treated as read-only. A security boundary based on a denylist is unsafe because APIs can introduce new actions or use verbs absent from the list. The storage-analysis excepti ...[truncated 1976 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for an RDS MySQL inspection/reporting skill, but the supplied code does something entirely different: it acts as a safety hook that examines aliyun CLI commands and asks for confirmation before write-like actions. It neither scans RDS instances nor gathers health data nor produces HTML reports. Its primary purpose, resources touched, and behavior are materially different from the declared inspection functionality.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs users to install or upgrade the CLI by piping a remotely fetched script directly into bash. This is a classic supply-chain risk: if the remote content, transport, mirror, or hosting account is compromised, arbitrary code executes immediately on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify the version is >= 3.3.3. If the CLI is missing or outdated,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install or upgrade,
> or follow https://help.aliyun.com/zh/cli/ for installation instructions.

**Pre-check: Aliyun CLI plugin update required**

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes shell execution and report generation but declares no explicit tool scope such as allowed-tools or permissions. In an agent setting, missing tool restrictions can let the runtime grant broader shell and file-write access than the skill actually needs, increasing the blast radius if the skill is misused or prompt-injected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list includes broad phrases like health check, slow log analysis, and database inspection in multiple languages, which can cause unintended invocation for loosely related requests. In agent ecosystems, overbroad triggers increase the chance that a high-privilege skill activates in the wrong context and performs cloud enumeration or report generation without clear user intent.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

## Usage

**You do not need to run any command manually.** Simply describe the request in natural language.

### Example Prompts

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/ram-policies.md (reported line 47)May include surrounding context.

md

## Permission Purpose

| Action                              | Service | Purpose                                                                                  |
| ----------------------------------- | ------- | ---------------------------------------------------------------------------------------- |
| `rds:DescribeRegions`               | RDS     | List available regions.                                                                  |
| `rds:DescribeDBInstances`           | RDS     | List RDS MySQL instances per region.                                                     |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/check-write-operation.sh (reported line 63)May include surrounding context.

sh

"hookSpecificOutput": {
    "hookEventName": "PreToolUse",
    "permissionDecision": "allow",
    "permissionDecisionReason": "Read operation API ($ACTION), no confirmation needed."
  }
}
EOF

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/inspect.py (reported line 35)May include surrounding context.

python

# 1. CLI invocation wrapper
# ═══════════════════════════════════════════════════════════════════════════

def call_cli(_svc, _action, region=None, endpoint=None, timeout=None, **kwargs):
    """Invoke the aliyun CLI and return the parsed JSON dict or None.

    The positional arguments are intentionally prefixed with an underscore

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/inspect.py (reported line 55)May include surrounding context.

python

cmd.extend([f'--{key}', str(value)])

    try:
        result = subprocess.run(cmd, capture_output=True, text=True,
                                timeout=timeout or _CLI_TIMEOUT)
        if result.returncode == 0:
            try:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The generated per-instance HTML report loads JavaScript from cdn.jsdelivr.net, causing external network access whenever a report is opened. This leaks viewer metadata and report access patterns to a third party, and creates a supply-chain risk where a compromised CDN or modified dependency could run arbitrary script in the report viewer's browser.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The summary HTML report also imports JavaScript from a third-party CDN, introducing undeclared outbound connectivity during report viewing. Because the summary aggregates all inspected instances, any compromise of that external script has broader visibility and could exfiltrate highly sensitive infrastructure inventory and health data shown in the report.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/inspect.py (reported line 2846)May include surrounding context.

python

# Check that the aliyun CLI is available
    try:
        result = subprocess.run(['aliyun', 'version'], capture_output=True, text=True, timeout=5)
        if result.returncode != 0:
            raise FileNotFoundError
    except (FileNotFoundError, subprocess.TimeoutExpired):

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown explains that the skill produces HTML reports, but it does not clearly warn users that running the skill will create files in a local output directory. Because report generation affects the user's filesystem, the description should explicitly disclose this behavior as a user-facing warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.