alibabacloud-sls-alerting

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:22 AM UTC
• Version: 0.0.2

Overview

The skill fits its Alibaba Cloud SLS alert-management purpose, but its install guide tells users to run an unverified remote shell installer before using high-impact cloud workflows.

Review before installing. The SLS management behavior is broadly appropriate for users who intend to let an agent manage Alibaba Cloud alerting resources, but avoid the documented curl-to-bash installer unless you independently trust and verify the Aliyun CLI source. Use least-privilege RAM permissions, avoid delete permissions unless needed, keep using an explicit profile only when intended, and review dry-run output before writes.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/cli-installation-guide.md:9
• Finding: Unverified Remote Installer Is Executed Directly by Bash## Vulnerability Details **File Location**: `references/cli-installation-guide.md`, lines 9–12 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash /bin/bash -c "$(curl -fsSL https://aliyuncli.alicdn.com/install.sh)" aliyun version ``` ### Technical Analysis The installation guide instructs the agent or user to retrieve a mutable shell script from an external URL and pass its contents directly to Bash. Although the URL uses HTTPS and an Alibaba-controlled domain, the command performs no version pinning, checksum verification, signature validation, or local inspection before execution. Consequently, the code that executes is not limited to the content reviewed as part of this Skill. The effective payload can change whenever the remote installer changes. A compromise of the origin, CDN, DNS resolution, certificate trust chain, or release process could therefore turn this installation step into arbitrary local code execution. This behavior is not required at this privilege level. The Skill legitimately needs the Aliyun CLI, but that requirement can be satisfied by installing a pinned, integrity-verified release rather than directly executing a network response. ### Attack Path 1. A user requests an SLS operation supported by the Skill. 2. The Skill determines that Aliyun CLI is missing or outdated. 3. The installation guide directs the user or agent to run the documented command. 4. `curl` retrieves the current contents of `https://aliyuncli.alicdn.com/install.sh`. 5. The shell command substitutes the network response directly into `bash -c`. 6. If the delivery infrastructure or hosted installer has been compromised, attacker-controlled shell commands execute with the privileges of the invoking account. 7. The payload can read accessible files, modify user-level configuration, invoke local tools, or access cloud services through credentials already available to the Aliyun CLI. ### Impact Assessmen ...[truncated 796 chars]
• Remediation: ## Remediation Suggestions 1. Remove the direct `curl`-to-Bash installation command. 2. Pin installation instructions to a specific Aliyun CLI release version. 3. Download the release artifact to a local file without executing it: ```bash curl --fail --show-error --location \ --output aliyun-cli.tar.gz \ "https://trusted.example/path/to/pinned-version/aliyun-cli.tar.gz" ``` 4. Verify the artifact using an independently published SHA-256 checksum: ```bash echo "<EXPECTED_SHA256> aliyun-cli.tar.gz" | sha256sum --check - ``` 5. Prefer cryptographic signature verification when the publisher provides signed release metadata. 6. Abort installation if integrity verification fails. 7. Prefer a trusted operating-system package manager or a manually reviewed, versioned binary where available. 8. Do not recommend elevated execution unless the installation destination specifically requires it, and clearly disclose any requested privileges. 9. After installation, verify the binary version and provenance before allowing it to access configured cloud credentials.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

raise RuntimeError("GetAlert returned a different rule ID")
        if not isinstance(rule.get("schedule"), dict) or not isinstance(rule.get("displayName"), str):
            raise RuntimeError("GetAlert response is missing schedule or displayName")
        return rule


def update_mute(args):

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes shell commands, reads local files, and directs networked cloud API access, but it does not declare any explicit tool scope such as allowed-tools or permissions. That leaves the agent with ambiguous authority boundaries and increases the chance of over-broad execution, especially in a cloud-management skill capable of modifying alerting resources.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

prove evaluation or delivery success.
- **NEVER** run `aliyun configure get`.
- **NEVER** extract or print AccessKey IDs, AccessKey secrets, or STS tokens
  from configuration files, environment variables, or command output. Never ask
  users to paste credentials. Let the CLI use its configured authentication.

## Reference Documents

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown file documents commands including `delete-alert` and `delete-resource-record`, as well as configuration-changing operations like create, update, enable, and disable, but provides no warning that these actions can modify or remove monitoring configuration. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or system integrity.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The text instructs users to let the action policy use `sls.builtin.cn` when its content/language is suitable. This introduces a specific locale recommendation in natural language without an explicit user opt-in or alternative language choice, which can violate language/locale policy requirements.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

command.extend(["--" + option, value])
    if body is not None:
        command.extend(["--body", json.dumps(body, ensure_ascii=False)])
    result = subprocess.run(command, capture_output=True, text=True)
    if result.returncode:
        # Do not print the command, which contains the complete rule body.
        raise RuntimeError("{} failed (exit {}): {}".format(

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: This code treats only two locales as known and emits a warning for any other locale, embedding an organizational language/locale preference directly into the skill behavior. Because the file does not document user choice or a region-specific justification, this can be a natural-language policy issue under the locale policy rule.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The file states documented locale values as `zh-CN` and `en-US`, which may constrain output language behavior. Because the instruction does not mention user opt-in or a clear region-specific justification, it can be read as imposing a language/locale restriction.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: Every documentation link points to the `/zh/` locale, which imposes a specific language on users without indicating that Chinese is optional or required for a region-specific reason. This is a natural-language policy issue because the file does not offer an alternative locale or explain the constraint.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

"--user-agent", args.user_agent,
    ]
    for option in ("region", "endpoint", "profile"):
        value = getattr(args, option)
        if value:
            command.extend(["--" + option, value])
    if body is not None:

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Static analysis

No suspicious patterns detected.