T08 · Insecure Dependencies
Warning
- Location
references/cli-installation-guide.md:32- Finding
Unverified and Unpinned Remote Executables and Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
Alibabacloud Sas Incident Manage
Security checks for vulnerabilities and agentic risk
Overview
The skill performs the advertised Aliyun security incident lookups, but its setup guidance includes unsafe credential handling and unverified tool installation steps that users should review before use.
Before installing, use a least-privilege RAM identity limited to the documented Cloud SIEM read APIs, avoid passing access keys or STS tokens in command lines, chat, CI logs, or scripts, and prefer interactive configuration, workload identity, or a secret manager. Pin and verify the Aliyun CLI, plugin, and Python dependencies where possible, and confirm before allowing the agent to retrieve detailed incident records.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/cli-installation-guide.md:109- Finding
Cloud Credentials and Tokens Passed Through Command-Line Arguments
- Content
View full analysis
\ --access-key-secret \ --region cn-hangzhou ``` The guide immediately recommends this command-line approach for automation: ```text All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` `references/cli-installation-guide.md:166-174`: ```bash aliyun configure set \ --mode StsToken \ --access-key-id \ --access-key-secret \ --sts-token \ --region cn-hangzhou ``` `references/cli-installation-guide.md:248-261`: ```bash aliyun configure set --profile projectA \ --mode AK \ --access-key-id \ --access-key-secret \ --region cn-hangzhou aliyun configure set --profile projectB \ --mode AK \ --access-key-id \ --access-key-secret \ --region cn-shanghai ``` ### Technical Analysis The guide instructs users to place long-lived access-key secrets and temporary STS tokens directly in command-line arguments. Once placeholders are replaced with real values, those values may become visible through: - Shell history files. - Process-listing and process-inspection interfaces available to other local users or monitoring agents. - CI/CD job logs and generated build metadata. - Terminal recordings and command auditing systems. - Agent transcripts or orchestration logs. - Error-reporting systems that capture th ...[truncated 1981 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (12)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list contains broad terms such as '安全事件', '事件查询', and especially 'Agentic-soc', which can plausibly appear in ordinary security-assistance conversations. This increases the chance the skill is invoked unintentionally and then executes cloud-siem queries against real tenant data, creating unnecessary data exposure and unexpected API activity.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The multi-step workflow is triggered by ambiguous phrases like '排查', '先查...再查', and '把详情也查出来', which are common investigative terms and do not clearly signal consent for a two-step sequence. In this skill, that ambiguity is more dangerous because the second step automatically retrieves incident details from live security tooling, potentially expanding disclosure beyond what the user explicitly requested.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple example commands hard-code
--lang zh, which imposes a specific language/locale on users. The document does not offer an opt-in choice or explain why Chinese output is required for all usage contexts.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md tar -xzf aliyun-cli-macosx-latest-amd64.tgz # Move to PATH mkdir -p "$HOME/.local/bin" && mv aliyun "$HOME/.local/bin/" # Verify aliyun version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Secure config file permissions chmod 600 ~/.aliyun/config.jsonTroubleshooting
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown instructs users to include
--lang zhby default and states that English is only an override. That enforces a specific language preference in the skill's natural-language instructions without indicating user choice or explicit opt-in, which is a locale-policy concern.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## References - [Cloud SIEM API Documentation](https://api.aliyun.com/product/cloud-siem) - [ListIncidents API](https://api.aliyun.com/api/cloud-siem/2024-12-12/ListIncidents?useCommon=true) - [GetIncident API](https://api.aliyun.com/api/cloud-siem/2024-12-12/GetIncident?useCommon=true) - [DescribeEventCountByThreatLevel API](https://api.aliyun.com/api/cloud-siem/2022-06-16/DescribeEventCountByThreatLevel?useCommon=true)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## References - [Cloud SIEM API Documentation](https://api.aliyun.com/product/cloud-siem) - [ListIncidents API](https://api.aliyun.com/api/cloud-siem/2024-12-12/ListIncidents?useCommon=true) - [GetIncident API](https://api.aliyun.com/api/cloud-siem/2024-12-12/GetIncident?useCommon=true) - [DescribeEventCountByThreatLevel API](https://api.aliyun.com/api/cloud-siem/2022-06-16/DescribeEventCountByThreatLevel?useCommon=true)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## References - [Cloud SIEM API Documentation](https://api.aliyun.com/product/cloud-siem) - [ListIncidents API](https://api.aliyun.com/api/cloud-siem/2024-12-12/ListIncidents?useCommon=true) - [GetIncident API](https://api.aliyun.com/api/cloud-siem/2024-12-12/GetIncident?useCommon=true) - [DescribeEventCountByThreatLevel API](https://api.aliyun.com/api/cloud-siem/2022-06-16/DescribeEventCountByThreatLevel?useCommon=true)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## References - [Cloud SIEM API Documentation](https://api.aliyun.com/product/cloud-siem) - [ListIncidents API](https://api.aliyun.com/api/cloud-siem/2024-12-12/ListIncidents?useCommon=true) - [GetIncident API](https://api.aliyun.com/api/cloud-siem/2024-12-12/GetIncident?useCommon=true) - [DescribeEventCountByThreatLevel API](https://api.aliyun.com/api/cloud-siem/2022-06-16/DescribeEventCountByThreatLevel?useCommon=true)
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The sample
config.jsonhard-codes"language": "en", which presents a locale choice as fixed rather than optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern, and the surrounding text does not explain that this value is optional or user-selectable.- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The skill's stated purpose is querying security incidents, trends, and incident details from Alibaba Cloud Security Center. The related-commands document additionally instructs use of local shell date arithmetic to compute timestamps, which is a host-level command capability not inherent to incident management itself and could steer an agent toward unnecessary shell execution.
- Content