alibabacloud-sas-overview

• Outcome: Review
• Latest audit: Oct 22, 2026 · 1:49 AM UTC
• Version: 0.0.5

Overview

This cloud-reporting skill needs review because its setup can execute downloaded software and change unrelated CLI plugins without separate user approval.

Review setup before allowing execution. Prefer an isolated CLI environment with approved, verified dependencies; require approval for installation, persistent settings changes and plugin updates. Use a read-only cloud identity limited to the requested services, and keep credentials out of chat. The reviewed artifacts support setup-control concerns, not a malicious verdict; the supplied SARIF report contains no findings.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (11)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Piping a remotely fetched, unpinned script directly into bash executes its contents without an integrity-verification step. The vendor-associated HTTPS endpoint and conditional installation path reduce suspicion of malicious intent, but compromise of the distribution source could yield arbitrary code execution with access to files and credentials available to the agent.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

> **Pre-check: Aliyun CLI >= 3.3.1 required**
> Run `aliyun version` to verify >= 3.3.1. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.

> **Pre-check: Aliyun CLI plugin update required**

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The command downloads a mutable remote script and immediately executes it without independent integrity verification or review. The vendor-associated HTTPS endpoint and legitimate installation purpose reduce suspicion of malicious intent, but a compromised distribution endpoint could still execute arbitrary code with the invoking user's access, potentially including access to cloud credentials.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 13)May include surrounding context.

bash

aliyun version
# Install/update the CLI if needed:
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

Credentials

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Piping the downloaded response into bash turns externally supplied content directly into executable instructions, removing the opportunity to inspect or verify the complete script before execution. This is the execution mechanism of the same supply-chain issue identified by SC2, not evidence of a separate malicious chaining attack.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 13)May include surrounding context.

bash

aliyun version
# Install/update the CLI if needed:
curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash

Credentials

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Setup instructions execute remote code and persistently modify the CLI environment without a system-change warning.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The prerequisite workflow permits remote installer execution and mandates persistent CLI changes without a clear system-change warning or approval gate. A user requesting read-only cloud information could therefore trigger local software changes and execution with the agent's operating-system privileges; this overlaps the plugin-change and remote-fetch findings rather than representing a separate exploit chain.

Content

No source excerpt is available for this finding.

Read-only query skill mandates persistent CLI configuration changes and updates to existing plugins.

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The mandatory commands persistently enable automatic plugin installation and update existing plugins despite the skill's read-only positioning. These changes extend beyond retrieving overview data and can alter unrelated workflows or introduce newly downloaded code without explicit authorization for environment changes.

Content

No source excerpt is available for this finding.

The installation step executes a remotely downloaded shell script without warning about its system-level effects.

Medium

• Category: Output Handling
• Confidence: 93% confidence

Finding

The guide recommends executing a remote installer without explaining its potential filesystem, executable, or configuration changes or requiring explicit approval. Installing the CLI is relevant to the skill, but this maintenance step expands a read-only query workflow into local code execution.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · references/query-errors.md (reported line 26)May include surrounding context.

md

Permission/authentication failures, invalid/missing parameters, wrong endpoints,
unsupported versions and service-not-opened errors require diagnosis, not repeated
calls. A valid HTTP/CLI success with null business fields is a validation failure,
not a reason to retry indefinitely. Unknown errors stop immediately. The wrapper
returns structured-response validation errors without retrying them.

After exhaustion, report the affected item, region/page, attempts, safe error code

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_cli_contract.py (reported line 73)May include surrounding context.

python

if args.help_dir:
                help_text = (args.help_dir / f"{product}-{action}.txt").read_text()
            else:
                result = subprocess.run(["aliyun", product, action, "--help", "--user-agent", user_agent],
                                        capture_output=True, text=True, timeout=30)
                if result.returncode:
                    raise ValueError(f"help exited {result.returncode}")

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 267)May include surrounding context.

md

Follow [query-parameters.md](query-parameters.md). Test same-region WAF ID binding,
missing discovery output, invalid months/days, seconds vs milliseconds, and missing
required inputs with test_query_parameters.py. Preserve explicitly supplied months
and region scope; never expand scope or execute a placeholder.

## Per-item acceptance and whole-workflow completion

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/verification-method.md (reported line 271)May include surrounding context.

md

Follow [query-parameters.md](query-parameters.md). Test same-region WAF ID binding,
missing discovery output, invalid months/days, seconds vs milliseconds, and missing
required inputs with test_query_parameters.py. Preserve explicitly supplied months
and region scope; never expand scope or execute a placeholder.

## Final result manifest