T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:24- Finding
Remote Installation Script Is Executed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
alibabacloud-sas-log-to-oss
Security checks for vulnerabilities and agentic risk
Overview
This skill is aimed at Alibaba Cloud log export management, but it requires risky unverified tool updates and can continuously copy or stop/delete log export tasks.
Install only after reviewing the Aliyun CLI and plugin setup path, avoiding curl-to-bash and unpinned latest downloads where possible. Use least-privilege RAM credentials scoped to the intended SLS project and OSS bucket, avoid command-line secrets, and confirm exactly which LogStores will be exported before running batch-create or any start/stop/delete action.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:28- Finding
Mutable CLI and Plugin Updates Are Installed Without Version or Integrity Controls
- Content
View full analysis
[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ``` ```markdown > 2. **User-specified tooling exception**: If the user explicitly asks to use the aliyun CLI, follow the user's request — use the aliyun CLI in **plugin mode** with lowercase-hyphenated subcommands (`list-log-stores`, `create-oss-export`, `list-oss-exports`, `get-oss-export`, `start-oss-export`, `stop-oss-export`, `delete-oss-export`) and include `--user-agent` per Section 6. **CLI precondition**: BEFORE the first aliyun sls call, run `aliyun configure set --auto-plugin-install true && aliyun plugin update` once to enable plugin-mode subcommands — without the sls plugin, lowercase-hyphenated subcommands fail with "not a valid api". ``` The manual Linux installation alternatives also use mutable `latest` archives: ```bash wget --connect-timeout=10 --read-timeout=120 --tries=3 -qO- https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz sudo mv aliyun /usr/local/bin/ ``` ```bash wget --connect-timeout=10 --read-timeout=120 --tries=3 -qO- https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz | tar xz sudo mv aliyun /usr/local/bin/ ``` ### Technical Analysis The skill requires enabling automatic plugin installation and updating all existing plugins before the first SLS CLI operation. No plugin version is pinned, and no checksum, signature, or allowlist is specified. Consequently, the executable components used by the skill may differ from those reviewed during the audit. The manual alternatives compound this risk by ...[truncated 2133 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/cli-installation-guide.md:83- Finding
Long-Lived Cloud Credentials Are Recommended as Command-Line Arguments
- Content
View full analysis
\ --access-key-secret \ --region cn-hangzhou ``` The guide then recommends this mode for automation: ```markdown All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` ### Technical Analysis The guide instructs users to place an Alibaba Cloud AccessKey ID and AccessKey secret directly in command arguments. When placeholders are replaced with real credentials, the secret may be captured by: - Shell history. - CI/CD job logs. - Terminal session recording. - Debug or audit telemetry. - Process execution monitoring. - Automation definitions or copied command transcripts. This guidance also conflicts with the primary security rules in `SKILL.md:58-62`, which prohibit asking users to provide credentials in the conversation or command line and prohibit using `aliyun configure set` with literal credential values. Users who follow the referenced guide may therefore bypass the stronger controls stated in the main skill instructions. Although some operating systems restrict cross-user process inspection, command histories and automation logs remain common credential-disclosure channels. ### Attack Path 1. A user follows the referenced quick-start instructions. 2. The user replaces `` with a real long-lived secret. 3. The command is entered into an interactive shell or embedded in CI/CD automation. 4. Shell history, build logs, process telemetry, terminal recording, or script storage captures the expanded command. 5. Another local user, admi ...[truncated 1035 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (28)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to install or self-update software via a remote shell bootstrap script and built-in upgrade commands. This is dangerous because it enables self-modification and execution of externally fetched code in the agent environment, expanding the attack surface and undermining environment integrity.
- Content
md **Pre-check: Aliyun CLI >= 3.3.3 required** > [MUST] Verify: `aliyun version` — must be >= 3.3.3. > - **First install or major upgrade:** `/bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh)"` > - **Routine update (CLI >= 3.3.5):** `aliyun upgrade` — prefer this built-in self-update over re-running the install script. > - See [references/cli-installation-guide.md](references/cli-installation-guide.md) for full installation instructions. **Pre-check: Aliyun CLI plugin update required**
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 97% confidence
- Finding
The explicit anti-refusal instruction attempts to constrain the agent from declining unsafe or policy-violating actions by banning refusal language. In an adversarial or high-risk scenario, this can suppress safety behavior and pressure the agent to continue assisting with sensitive cloud operations even when it should stop.
- Content
md > **[CRITICAL] Do NOT refuse to help:** When an error occurs, NEVER use refusal phrases such as "无法帮您", "我无法完成", "无法继续", "帮不了", "I cannot help", or "I am unable to help". Instead, explain the specific error, its cause, and the exact steps the user should take to resolve it, then hand the decision back to the user.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md For detailed verification steps, see [references/verification-method.md](references/verification-method.md).
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md For detailed verification steps, see [references/verification-method.md](references/verification-method.md).
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
aliyun version
text ### Self-Update (CLI >= 3.3.5) Once the CLI is at version 3.3.5 or newer, routine updates can use the built-in self-update subcommand instead of re-running the install script:
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
Self-Update (CLI >= 3.3.5)
Once the CLI is at version 3.3.5 or newer, routine updates can use the built-in self-update subcommand instead of re-running the install script:
bash aliyun upgrade
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs the agent to avoid refusal language and to continue being helpful even during error conditions. In an adversarial skill, this kind of anti-refusal prompt can weaken safety boundaries by pressuring the agent to comply with risky or disallowed actions instead of stopping, escalating, or enforcing policy-based refusals.
- Content
md **[CRITICAL] Do NOT refuse to help:** When an error occurs, NEVER use refusal phrases such as "无法帮您", "我无法完成", "无法继续", "帮不了", "I cannot help", or "I am unable to help". Instead, explain the specific error, its cause, and the exact steps the user should take to resolve it, then hand the decision back to the user.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md Deletes a specified OSS export task. **Path:** `DELETE /ossexports/{ossExportName}` ---
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill clearly expects access to sensitive environment variables such as cloud credentials and account identifiers, but it declares no explicit tool scope or permission boundary. This creates ambiguity about what the agent is allowed to read and increases the risk of unintended credential exposure or execution in a broader-than-necessary runtime context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list is very broad and includes generic operational phrases like 'start', 'delete', 'manage export task', and multilingual variants that could match user requests unexpectedly. That increases the chance this skill is invoked in the wrong context and then performs or proposes destructive cloud operations against log-export infrastructure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file instructs users to ship collected log data to OSS for storage and analysis, which can materially affect user data handling and privacy. Although it explains setup details, it does not include any user-facing warning about sensitive data being exported, broader access exposure, or the need to validate retention and access controls before enabling the export task.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The referenced document is about generic OSS bucket creation, file upload/download, sharing, and cleanup, not the advertised SLS-to-OSS log export workflow. In a skill intended for Security Center/SLS archival automation, this mismatch can mislead an agent or operator into performing unrelated storage actions, broadening scope and increasing the chance of incorrect or unsafe operations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This section instructs users to generate and share file URLs from OSS, which is not justified by the skill's cold-storage archival purpose. Introducing sharing guidance into a log archival context increases the risk of exposing archived logs or other sensitive objects through temporary public links, which could lead to data leakage if an agent follows or adapts the instructions improperly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guide instructs users to execute a remotely fetched shell script directly with bash, which removes any opportunity to inspect the code before execution. If the download endpoint, CDN path, or transport trust is compromised, this can lead to arbitrary code execution on the host.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manual install examples stream a downloaded archive directly into extraction and then move the resulting binary into a privileged system path. This creates a supply-chain and arbitrary code execution risk because the artifact is not integrity-checked before installation, and the final placement increases trust and reach of any malicious binary.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
x86_64
bash wget --connect-timeout=10 --read-timeout=120 --tries=3 -qO- https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz sudo mv aliyun /usr/local/bin/ARM64
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
x86_64
bash wget --connect-timeout=10 --read-timeout=120 --tries=3 -qO- https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz sudo mv aliyun /usr/local/bin/ARM64
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once ### Configuration Modes
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a skill for automating SLS log export to OSS for archival, but this file is a broad Alibaba Cloud CLI installation and configuration guide covering generic authentication modes, ECS operations, plugin installation, and unrelated product commands. Those instructions materially expand the apparent scope beyond log export management and are not specific implementation details of the declared purpose.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The guide instructs users to run ECS commands such as
aliyun ecs describe-instancesandaliyun ecs describe-regions, and to explore other products like Function Compute (aliyun fc --help). For a skill intended to manage SLS log export to OSS, ECS and FC administration capabilities are not justified by the stated purpose and suggest unrelated cloud-management scope.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Restrict permissions chmod 600 ~/.aliyun/config.jsonTroubleshooting
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation exposes stop and delete operations, including force deletion, without any warning about operational impact, confirmation requirements, or guidance to verify the target export task before execution. In an automation skill for log archival, this increases the chance that a user or agent will disable or remove exports that preserve security logs, causing loss of audit visibility and interruption of log retention.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The batch-create command can create export tasks for every LogStore in a project, and the defaults make those exports continuous (
from_time=1,to_time=0) without any confirmation, dry-run, or explicit warning. In an agent skill context, this can unintentionally trigger broad data replication of sensitive logs into OSS, increasing data exposure, storage cost, and persistence of security telemetry outside its original control boundary.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python p_delete = subparsers.add_parser("delete-export", help="Delete an export task") add_common_args(p_delete) p_delete.add_argument("--name", required=True, help="Export task name") p_delete.add_argument("--force", action="store_true", help="Skip confirmation prompt") args = parser.parse_args()
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instruction explicitly forbids certain refusal phrases in both Chinese and English, imposing language-specific wording requirements without offering user choice. This is a natural-language policy concern because it constrains response language behavior rather than letting the user select their preferred language or locale.
- Content
Static analysis
No suspicious patterns detected.