Alibabacloud Sas Overview

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:37 AM UTC
• Version: 0.0.4

Overview

The skill mostly performs read-only Alibaba Cloud security overview queries, but its setup instructions can persistently change the local CLI environment and install or update unverified code.

Review before installing. Use a separately verified Aliyun CLI and explicitly approved plugin versions, avoid `curl | bash` and mutable latest installers, do not place real access keys or tokens in command-line arguments or agent chat, and use a least-privilege read-only RAM profile dedicated to SAS/WAF/billing overview queries.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57
• Finding: Unverified Remote Installation Script Is Executed Directly by Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 57-59 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash > Run `aliyun version` to verify >= 3.3.1. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update, > or see `references/cli-installation-guide.md` for installation instructions. ``` ### Technical Analysis The response from an external URL is piped directly into Bash. The downloaded script is not pinned to a specific release and is not subject to checksum validation, signature verification, or local inspection before execution. Although the domain appears associated with Aliyun CLI distribution, this pattern makes the effective payload mutable after the Skill has been reviewed. Compromise of the distribution host, CDN, DNS resolution, TLS termination, or hosted script could result in arbitrary commands being executed. Installing the CLI is a prerequisite rather than part of the declared SAS overview query functionality. Direct execution of a remote installer therefore exceeds the minimum behavior needed when a compatible CLI is already available. ### Attack Path 1. An attacker compromises the hosted `setup.sh`, its delivery infrastructure, or another component in the download path. 2. A user invokes the Skill on a system where Aliyun CLI is absent or older than version 3.3.1. 3. The documented prerequisite downloads the attacker's current script. 4. Bash interprets the response immediately, without an opportunity to verify its contents. 5. The payload executes with the privileges and environment of the invoking user. 6. The payload may access Aliyun configuration files and environment-based credentials available to that user, modify local files, or install additional components. ### Impact Assessment Successful exploitation provides arbitrary code execution with the invoking user's privileges. The resultin ...[truncated 432 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` instruction. 2. Prefer a trusted operating-system package manager or an official package repository with signed metadata. 3. If direct download is unavoidable: - Pin an exact Aliyun CLI version. - Download the artifact to a local file. - Obtain the expected digest or signature through an independently trusted vendor channel. - Verify the SHA-256 digest or cryptographic signature before execution. - Inspect the installer and request explicit user approval before running it. 4. Do not perform installation automatically during a data-query Skill invocation. 5. If the required CLI is unavailable or incompatible, stop safely and provide non-executing installation guidance. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:61
• Finding: Mandatory Automatic Plugin Installation and Unpinned Plugin Updates<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 61-65 **Vulnerability Type**: Unpinned and automatically installed dependencies **Risk Level**: High ### Vulnerable Code ```bash > **Pre-check: Aliyun CLI plugin update required** > [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. > > With `--auto-plugin-install true` set, the required plugins (sas, waf-openapi, bssopenapi) are installed automatically on first use — no manual `aliyun plugin install` step is needed. ``` ### Technical Analysis The Skill mandates enabling automatic plugin installation and updating all existing plugins. No plugin versions, artifact hashes, or signatures are pinned or verified. This creates a supply-chain trust boundary at runtime: the plugin content used by the Skill can differ from the content present during audit. Updating all existing plugins is also broader than necessary because the declared functionality only requires `sas`, `waf-openapi`, and `bssopenapi`. The configuration command persistently changes Aliyun CLI behavior. Once automatic installation is enabled, later CLI commands outside the current Skill may also retrieve plugins without a separate approval decision. ### Attack Path 1. An attacker compromises a plugin publication account, repository, distribution endpoint, or update infrastructure. 2. The Skill enables persistent automatic plugin installation. 3. The mandatory update command downloads the compromised plugin, or a later CLI command automatically installs it. 4. The affected plugin is loaded or used by the credentialed Aliyun CLI. 5. Malicious plugin behavior executes in the user's local CLI context and can potentially observe command inputs, outputs, local configuration, or authenticated cloud interactions. ### Impact Assessment A compromised plugin may act with the local privileg ...[truncated 462 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not enable global automatic plugin installation. 2. Check whether the three required plugins are already present before changing the system. 3. Install only `sas`, `waf-openapi`, and `bssopenapi`; do not update unrelated plugins. 4. Pin approved plugin versions and verify vendor signatures or published cryptographic digests. 5. Request explicit user approval before installing or updating any plugin. 6. Keep automatic installation disabled after setup, or restore the prior configuration after a user-approved temporary change. 7. Separate dependency setup from normal read-only Skill execution and fail safely when an approved dependency is unavailable. ]]>

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:39
• Finding: Mutable CLI Binary Is Installed into a Privileged Executable Path Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `references/cli-installation-guide.md`, lines 39-45 **Vulnerability Type**: Unverified binary dependency installation **Risk Level**: High ### Vulnerable Code ```bash **Debian/Ubuntu** ```bash # Download wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz # Extract and install tar -xzf aliyun-cli-linux-latest-amd64.tgz sudo mv aliyun /usr/local/bin/ ``` ``` The same unsafe pattern is also documented for macOS, CentOS/RHEL, ARM64, and Windows distributions. ### Technical Analysis The guide downloads a mutable `latest` archive, extracts its executable, and installs it into `/usr/local/bin` using `sudo`. It provides no checksum, signature, trusted manifest, pinned version, or validation of the archive contents. A compromised archive can therefore replace the legitimate `aliyun` command with an attacker-controlled executable. Installation into a system-wide executable path amplifies the risk because other users, scripts, and automation may subsequently invoke the replaced tool. The use of `sudo` only covers moving the downloaded file and does not prove that the binary itself runs as root later. However, it permits an unverified executable to be placed in a privileged path and trusted as a normal system command. ### Attack Path 1. An attacker replaces or compromises the mutable `aliyun-cli-linux-latest-amd64.tgz` artifact or its delivery infrastructure. 2. The user downloads the archive without integrity verification. 3. The archive is extracted, and the attacker-controlled `aliyun` executable is moved into `/usr/local/bin` with administrative authorization. 4. The user or another automation process later invokes `aliyun`. 5. The replacement binary executes in place of the legitimate CLI and can capture command arguments, inspect accessible credential configuration, alter API requests, or return spoofed results. ### Impact Assessment The immediate result is installation of an attacker ...[truncated 506 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace mutable `latest` URLs with exact, approved release versions. 2. Publish and verify SHA-256 digests or cryptographic signatures before extraction. 3. Validate the archive's file list and reject unexpected paths or executable content. 4. Prefer a trusted package manager that verifies signed repository metadata. 5. Download and verify artifacts as an unprivileged user before requesting elevation. 6. Request explicit approval before placing an executable in `/usr/local/bin`. 7. Document safe rollback steps and verify the installed binary's version and digest after installation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:103
• Finding: Cloud Access Keys and Tokens Are Passed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `references/cli-installation-guide.md`, lines 103-108 **Vulnerability Type**: Sensitive credentials exposed through command invocation **Risk Level**: Medium ### Vulnerable Code ```bash aliyun configure set \ --mode AK \ --access-key-id <your-access-key-id> \ --access-key-secret <your-access-key-secret> \ --region cn-hangzhou ``` Similar examples appear elsewhere in the guide for AK, STS, role-assumption, profile creation, key rotation, and troubleshooting workflows. ### Technical Analysis The guide recommends placing access-key IDs, access-key secrets, and in some examples STS tokens directly in command arguments. Depending on the operating system and execution environment, command arguments may be exposed through: - Shell history files - Process inspection utilities - Terminal session recording - CI/CD logs - Debugging or monitoring agents - Agent conversation or command-transcript retention This guidance conflicts with the safer rules in `SKILL.md`, which prohibit asking users to provide credentials in the conversation or using literal credential values with `aliyun configure set`. ### Attack Path 1. A user copies the documented command and substitutes real access-key values. 2. The shell records the command in its history, or another local process observes the process arguments while the command runs. 3. Automation, terminal capture, or diagnostic logging preserves the command. 4. An attacker with access to the history, process information, or logs retrieves the credentials. 5. The attacker authenticates to Alibaba Cloud using the exposed credentials until they expire or are revoked. ### Impact Assessment Exposure of a long-lived access key can allow authentication from another system and use of all RAM permissions attached to that identity. Exposure of an STS token permits equivalent access until token expiration. The exact cloud impact depends on the associated RAM policies. Althou ...[truncated 144 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all examples that place literal secrets or tokens in command arguments. 2. Prefer ECS RAM roles, workload identity, OAuth, or short-lived role-based credentials that do not require static secrets. 3. Where static credentials are unavoidable, use a vendor-supported interactive no-echo mechanism outside the Agent session. 4. Prevent credentials from entering shell history, process arguments, CI logs, or conversational transcripts. 5. Use short-lived STS credentials with minimal RAM permissions and narrowly scoped sessions. 6. Document immediate rotation and revocation procedures for accidentally exposed credentials. 7. Keep the main Skill's prohibition against reading, echoing, or requesting AK/SK values and make the reference guide consistent with that policy. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (23)

External Script Fetching

High

• Category: Supply Chain

Content

> **Pre-check: Aliyun CLI >= 3.3.1 required**
> Run `aliyun version` to verify >= 3.3.1. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.

> **Pre-check: Aliyun CLI plugin update required**

• Confidence: 98% confidence
• Finding: The skill instructs users to execute `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash`, which downloads and immediately executes a remote script without verification. This is a classic supply-chain and arbitrary-code-execution risk: if the remote host, network path, or script content is compromised, the user may run attacker-controlled code on their machine.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list includes generic phrases such as "security score", "risk governance", "asset risk trend", and "账单", which are not uniquely tied to Alibaba Cloud SAS overview queries. Because the manifest says the skill supports flexible scope based on user intent, these broad phrases could cause unintended invocation when users discuss security topics more generally.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill claims it only performs overview data queries and does not modify configurations, but later instructs changing local Aliyun CLI configuration. This mismatch can mislead operators into approving a skill under a read-only mental model while it actually performs state-changing actions on the local environment.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill requires `aliyun configure set --auto-plugin-install true` and `aliyun plugin update`, which modify the user's local CLI behavior and trust state even though the skill's purpose is only to read SAS overview data. Enabling automatic plugin installation broadens the attack surface by allowing future commands to fetch and install code/plugins implicitly, and forced plugin updates introduce unnecessary supply-chain risk for a read-only query workflow.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The file states the skill is read-only and requires no cleanup, but the earlier steps change CLI configuration and update plugins. This inaccurate safety framing may cause reviewers and users to underestimate the operational impact and persistence of the changes, increasing the chance that risky setup actions are executed without scrutiny.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

#### INCORRECT
```python
# Wrong: always reading CreateTime/ReleaseTime without checking IsPaidUser
create_time = response["CreateTime"]
release_time = response["ReleaseTime"]

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

#### INCORRECT
```python
# Wrong: always reading CreateTime/ReleaseTime without checking IsPaidUser
create_time = response["CreateTime"]
release_time = response["ReleaseTime"]

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

#### INCORRECT
```python
# Wrong: always reading CreateTime/ReleaseTime without checking IsPaidUser
create_time = response["CreateTime"]
release_time = response["ReleaseTime"]

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: This reference guide materially exceeds the stated scope of a SAS overview query skill by teaching generic Aliyun CLI installation, authentication, profile management, and plugin ecosystem usage. In an agent skill context, overbroad operational documentation can enable capability expansion, credential collection, and use of unrelated cloud services beyond the intended read-only SAS overview function.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/
```

### Windows

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The guide places long-lived access key ID and secret directly on the command line in copyable examples. Secrets supplied as CLI arguments may be exposed via shell history, process listings, terminal logging, CI logs, or agent transcripts, making credential theft significantly easier.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documented authentication modes include role assumption, cross-account access, and elevated access patterns that are unnecessary for a SAS overview skill. In a skill package, this broadens the operational playbook available to an agent or operator and increases the chance of privilege misuse or expansion far outside the intended read-only overview use case.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Restrict permissions
chmod 600 ~/.aliyun/config.json
```

## Troubleshooting

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill manifest says it is limited to SAS overview queries and does not manage non-SAS services, but the verification method invokes `waf-openapi` to enumerate WAF instances and retrieve flow-chart telemetry. This expands the skill's effective data-access scope into another security product, creating a scope mismatch that can expose additional service metadata and require broader permissions than users would reasonably expect.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### 3c. Security Response

Currently N/A — no verification needed.

## Module 4: Asset Risk Trend

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Low

• Confidence: 75% confidence
• Finding: The file duplicates the description in English and Chinese, but does not state whether the skill should respond in the user's preferred language or ask for language preference. This can create a locale-policy issue if the skill implicitly assumes a language rather than offering a choice.

Context-Inappropriate Capability

Low

• Confidence: 90% confidence
• Finding: The guide includes commands for ECS and plugin usage unrelated to SAS overview querying, such as region listing and arbitrary product plugin installation. While not directly exploit code, this widens the skill's effective surface area and can encourage use of non-SAS capabilities inconsistent with the declared scope.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The document instructs retrieval of security scores, asset inventories, risk counts, WAF metrics, and billing status without any warning that these commands expose sensitive cloud security and account metadata. In an agent skill context, lack of disclosure increases the chance that users or operators invoke broad reconnaissance-style queries without informed consent or proper handling expectations.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The verification instructions call `bssopenapi query-bill` to pull billing data, which reaches beyond core SAS overview telemetry into account-level financial metadata. Even if intended for subscription status validation, this accesses sensitive billing information that is not clearly constrained or justified by the stated SAS-only scope.

Static analysis

No suspicious patterns detected.