Alibabacloud Sas Overview

• Outcome: Review
• Latest audit: Jun 25, 2026 · 1:07 PM UTC
• Version: 0.0.4

Overview

This skill is mainly a read-only Alibaba Cloud security overview helper, but its setup asks for risky local CLI/plugin changes and direct remote script execution, so it needs review before installation.

Install only if you are comfortable with persistent changes to your local Aliyun CLI and plugin state. Prefer installing or updating Aliyun CLI through a package manager or manually verified download, avoid `curl | bash`, use least-privilege read-only RAM permissions for SAS/WAF/billing, and do not provide access keys in chat or command history.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill requires `aliyun configure set --auto-plugin-install true` and `aliyun plugin update`, which modify the user's local CLI configuration and plugin state. That is a real side effect unrelated to a read-only data query and can expand the attack surface by implicitly downloading or changing executable components on the host.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill claims it only performs overview queries and does not modify configurations, but its execution path includes commands that change CLI settings and local plugin state. This mismatch is dangerous because it can cause users or orchestrators to trust and auto-run a supposedly read-only skill that actually performs administrative changes.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The cleanup/read-only section states that no resources are created and no cleanup is needed, but earlier steps alter local configuration and plugins. This false assurance can suppress scrutiny and incident response, because operators may not realize the skill changed system state even if no cloud resources were modified.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This reference file is far broader than the stated skill scope of SAS overview querying. It equips an agent or user with generic Aliyun CLI installation, authentication, profile management, plugin installation, and cross-service usage guidance, which expands capability beyond read-only SAS overview retrieval and increases the chance of unintended or unauthorized cloud access.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The document teaches elevated and cross-account authentication patterns such as RamRoleArn and RamRoleArnWithEcs that are unnecessary for an SAS overview skill. In this context, providing role-assumption workflows can enable broader administrative reach than intended, especially if an agent is later prompted to act outside scope.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The guide explicitly promotes installing arbitrary Alibaba Cloud product plugins and exploring unrelated service commands like ECS, VPC, RDS, and FC. For a skill advertised as SAS overview-only, this materially broadens operational scope and can facilitate misuse or prompt injection-driven expansion into other services.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill is declared as SAS overview-only, but the related API list expands into WAF and billing services. This creates scope drift that can cause an agent to invoke unintended cross-service APIs, potentially exposing unrelated billing or WAF metadata and violating least-privilege expectations. In an agent setting, documentation is often treated as execution guidance, so including out-of-scope services increases the chance of unauthorized or surprising actions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The verification method expands beyond the skill’s declared SAS-only overview scope by instructing use of WAF and billing APIs. This creates unnecessary cross-service access requirements and broadens the operational blast radius, which is dangerous because a verifier or agent may request or use privileges unrelated to the stated function of the skill.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The WAF verification steps introduce unjustified cross-service access for a skill described as a SAS overview query skill. Even if intended for correlated security reporting, requiring `waf-openapi` calls can cause over-privileged execution contexts and expose unrelated service metadata, making the skill more dangerous than its description suggests.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Passing access keys and secrets directly on the command line can expose credentials through shell history, audit logs, process listings, and agent execution traces. In an agent skill context, these secrets may also be captured in transcripts or telemetry, making compromise more likely.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document shows a config file structure containing access_key_id and access_key_secret without immediately warning that the file is sensitive and must be protected. This can normalize unsafe handling of plaintext credentials and lead users or agents to store or copy secrets insecurely.

External Script Fetching

High

• Category: Supply Chain

Content

> **Pre-check: Aliyun CLI >= 3.3.1 required**
> Run `aliyun version` to verify >= 3.3.1. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.

> **Pre-check: Aliyun CLI plugin update required**

• Confidence: 99% confidence
• Finding: curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.