Alibabacloud Rds Postgresql Inspection

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:50 AM UTC
• Version: 0.0.1

Overview

The skill is mostly an RDS PostgreSQL inspection tool, but it uses unsafe dependency installation/update steps and under-discloses sensitive report outputs.

Install only after reviewing the dependency steps. Avoid curl-to-bash, avoid agent-run sudo, do not update all Aliyun CLI plugins just to inspect RDS, use a narrowly scoped read-only RAM identity, and treat generated HTML/JSON reports as sensitive because they may contain SQL text and cloud metadata.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:143

Finding

Unverified Remote Installation Script Executed Through Bash

Content

View full analysis

= 3.3.3 required** > Run `aliyun version` to verify the version is >= 3.3.3. If the CLI is missing or outdated, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install or upgrade, > or follow https://help.aliyun.com/zh/cli/ for installation instructions. ``` ### Technical Analysis The installation instruction downloads a mutable shell script from an external URL and passes the response directly to Bash. The payload is executed without: - Pinning a specific version - Verifying a cryptographic checksum - Validating a digital signature - Saving the script for inspection - Requesting explicit approval immediately before execution HTTPS protects the connection in transit but does not make a mutable remote payload safe. The effective code can change after this Skill has been reviewed. Compromise of the hosting origin, CDN, upstream release process, DNS/TLS trust path, or associated credentials could therefore turn an apparently legitimate installation step into arbitrary code execution. This behavior is not the minimum privilege necessary for an RDS inspection Skill. The Skill could instead stop and direct the user to a verified package installation procedure. ### Attack Path 1. The agent loads the Skill and checks for the Aliyun CLI. 2. The CLI is absent or considered outdated. 3. The agent follows the documented installation instruction. 4. `curl` retrieves the current contents of `setup.sh`. 5. The response is passed directly to Bash without verification. 6. A compromised or malicious response executes with the privileges of the user running the agent. 7. The payload can access local files, environment variables, Aliyun configuration, and any cloud credentials available to that process. ### Impac ...[truncated 505 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:148

Finding

Automatic Installation and Update of Unpinned CLI Plugins

Content

View full analysis

[MUST] Run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] Run `aliyun plugin update` to ensure all locally installed plugins are up to date. ```bash aliyun version aliyun configure set --auto-plugin-install true aliyun plugin update ``` ``` ```python def ensure_cli_plugins(required_plugins: list = None): """ Pre-install required CLI plugins to avoid auto-install conflicts during concurrent calls. Must be invoked synchronously before concurrent data collection. """ if required_plugins is None: required_plugins = ['aliyun-cli-rds', 'aliyun-cli-cms'] print('🔧 Checking CLI plugins...', flush=True) # Fetch the list of installed plugins try: result = subprocess.run( ['aliyun', 'plugin', 'list'], capture_output=True, text=True, timeout=30 ) installed = result.stdout.lower() except Exception as e: print(f' [WARN] Failed to retrieve plugin list: {e}', file=sys.stderr) installed = '' for plugin in required_plugins: plugin_lower = plugin.lower() if plugin_lower in installed: print(f' ✅ {plugin} installed') continue print(f' 📦 Install {plugin}...', end=' ', flush=True) try: install_result = subprocess.run( ['aliyun', 'plugin', 'install', '--name', plugin], capture_output=True, text=True, timeout=120 ) ``` The installation routine is invoked unconditionally during normal execution: ```python # Pre-install CLI plugins (must run synchronously before concurrent calls) ensure_cli_plugins(['aliyun ...[truncated 1888 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/inspect.py:2205

Finding

Sensitive Cloud Metadata and SQL Data Written to Plaintext JSON

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/inspect.py:1578

Finding

Remote JavaScript Executes in Reports Containing Sensitive Database Information

Content

View full analysis

``` The summary report uses a non-exact major-version dependency: ```html ``` ### Technical Analysis Generated HTML reports contain RDS instance metadata, resource metrics, alerts, and potentially SQL slow-log text. When a report is opened, it retrieves and executes JavaScript from jsDelivr. Remote JavaScript executes with access to the report's DOM. A compromised CDN response, package release, package-maintainer account, or upstream distribution channel could read report contents and transmit them to an external endpoint. The `@5` URL is especially unsafe because it permits the delivered code to change between compatible version releases. No Subresource Integrity attribute or restrictive Content Security Policy is present. Even an exact package version therefore remains dependent on the integrity of the remote delivery path. ### Attack Path 1. The Skill creates an HTML report containing sensitive RDS and SQL information. 2. A user opens the report in a browser while connected to the network. 3. The browser fetches ECharts JavaScript from jsDelivr. 4. The CDN or upstream package returns compromised JavaScript. 5. The script executes in the report document. 6. It reads instance metadata, alerts, metrics, and SQL text from the DOM or JavaScript variables. 7. It sends the extracted information to an attacker-controlled service or falsifies the visible health report. ### Impact Assessment Successful exploitation can disclose all information rendered in the opened report. It can also manipulate ...[truncated 330 chars]

Remediation

View remediation

``` 6. If remote loading cannot be removed, use Subresource Integrity and `crossorigin="anonymous"`, while recognizing that local bundling is safer. 7. Avoid placing sensitive data in globally accessible JavaScript variables. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/cli-installation-guide.md:103

Finding

Credential Configuration Examples Expose Access Keys Through Command Arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` The guide contains additional concrete examples using the same command-line secret pattern, including at `assets/cli-installation-guide.md:129-134`, `164-179`, `264-270`, `373`, `381`, and `451`. ### Technical Analysis The guide recommends placing the Access Key secret directly in a command-line argument. Depending on the operating system and shell configuration, command arguments can be exposed through: - Shell history - Process-list inspection - Terminal session recording - Audit or endpoint-monitoring tools - CI/CD command logs - Debugging and support bundles The same guide also recommends environment-variable credential storage. Environment variables can be inherited by child processes and captured by diagnostics or crash reporting. These examples conflict with the safer authentication rules in `SKILL.md`, which state that AK/SK values must never be requested or entered directly in conversation or command lines. ### Attack Path 1. A user follows the bundled quick-start instructions. 2. The user substitutes a real Access Key ID and secret into the command. 3. The shell records the command in history, or another process/monitoring component captures its argument list. 4. An attacker or unauthorized local user obtains the secret. 5. The attacker authenticates to Alibaba Cloud using the exposed credentials. 6. The attacker accesses all resources and API actions permitted by the associated RAM identity until the key is revoked or expires. ### Impact Assessment The resulting cloud access is bounded by the permissions attached to the compromised RAM identity. With the recommended minimum inspecti ...[truncated 425 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 490)May include surrounding context.

md

> **The ONLY correct way to fulfil any inspection request is to execute `scripts/inspect.py`.**

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

This is a direct instance of remote script fetching and execution via curl ... | bash, which is a well-known arbitrary code execution pattern. In a skill context, embedding such an instruction is especially risky because users may follow it verbatim to satisfy prerequisites, executing unreviewed code on their workstation or runner.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md

**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify the version is >= 3.3.3. If the CLI is missing or outdated,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install or upgrade,
> or follow https://help.aliyun.com/zh/cli/ for installation instructions.

**Pre-check: Aliyun CLI plugin update required**

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list is extremely broad, including generic phrases like batch inspection, slow log analysis, long transaction, and health summary in multiple languages. That increases the chance the skill activates in contexts the user did not intend, causing unexpected execution of account-backed cloud inspection actions and large-scale data collection across regions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Early in the file, the eval-critical deliverables are defined as outputs/instances/<DBInstanceId>.html and outputs/summary.html. Later, the CLI argument reference and report structure describe the output directory as ./rds-pg-inspection-reports/<ts>/, which is a materially different location and could cause an agent to produce outputs in the wrong place despite following the documentation.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

## Usage

**You do not need to run any command manually.** Simply describe the request in natural language.

### Example Prompts

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation tells users to execute curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash, which downloads and immediately runs a remote script in the shell. Piped remote-script execution is dangerous because it prevents inspection before execution and can lead to arbitrary code execution if the source is compromised, tampered with, or intercepted.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · assets/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · assets/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · assets/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · assets/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Static analysis

No suspicious patterns detected.