T03 · Remote Payload Retrieval and Execution
Error
- Location
references/cli-installation-guide.md:11- Finding
Unverified Remote Installer Is Executed Directly by Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
Alibabacloud Sls Query
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a legitimate Alibaba Cloud SLS log-query helper, but its setup documentation contains unsafe installer and credential-handling guidance that users should review before installing.
Install only after replacing the setup flow with verified Aliyun CLI installation steps and safer credential handling. Do not paste Alibaba Cloud access keys into agent sessions, shell history, scripts, or logs; prefer least-privilege, short-lived, or role-based credentials scoped to the needed SLS project and Logstore.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
references/cli-installation-guide.md:49- Finding
Cloud Credentials Are Recommended in Command-Line Arguments and Environment Variables
- Content
View full analysis
\ --access-key-secret \ --region cn-hangzhou ``` The guide further recommends this mechanism for automation: ```text All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` It also documents persistent environment-based credentials: ```bash export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret export ALIBABA_CLOUD_REGION_ID=cn-hangzhou ``` ### Technical Analysis Supplying an access-key secret or STS token as a command-line argument can expose it through shell history, process inspection, command auditing, CI/CD logs, terminal recording, or Agent transcripts. Environment variables reduce some command-line exposure but remain readable by the current process and potentially by child processes, debugging tools, crash reports, or other processes operating under the same identity. The recommendation to use secret-bearing non-interactive flags in “agent-driven automation” is particularly risky because Agent tool invocations and outputs may be logged or retained. It also conflicts with the root Skill instructions in `SKILL.md:33-40`, which state that users must configure credentials outside the session and that the Skill must never read, echo, print, or request access-key values. The placeholder credentials shown in the repository are not themselves live secrets. The vulnerability is the documented workflow that encourages users to substitute real ...[truncated 1301 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/cli-installation-guide.md:288- Finding
Troubleshooting Guidance May Print Stored Credential Configuration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (56)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
3.1 Build the index-search segment first (left of
|)Collect every filter that can be expressed in index-search syntax and place it before the first
|. Use*if no filter applies.text * and "payment failed" and status: "500" and not path: "/healthz"
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The listed triggers include generic phrases such as "日志查询", "日志分析", and "log query", which can apply to many logging tools and common support requests, not just Alibaba Cloud SLS. This creates ambiguity about when the skill should activate and increases the risk of unintended invocation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Using the machine's local timezone without user confirmation can silently query the wrong time window, leading to incorrect log analysis, missed incidents, or disclosure of unintended data ranges. In a security and observability context, time-bound accuracy is critical, so implicit timezone assumptions materially increase operational risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Piping a remotely downloaded script directly into /bin/bash executes unreviewed code from the network with the user's privileges, creating a supply-chain and remote-code-execution risk if the source, transport, or distribution endpoint is compromised. In an agent skill, this is more dangerous because users may copy commands verbatim without independently inspecting the installer.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The guide demonstrates configuring long-lived access keys via command-line flags and environment variables, which can expose secrets through shell history, process listings, CI logs, and mismanaged environment propagation. In the context of an automation-oriented skill, this is especially risky because users may paste real credentials into terminals or scripts exactly as shown.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 1. Log in to Aliyun Console: <https://ram.console.aliyun.com/> 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once ### Configuration Modes
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Restrict permissions chmod 600 ~/.aliyun/config.jsonTroubleshooting
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill is described as helping with SLS log query and analysis through the aliyun CLI, but this guide instructs users to install generic product plugins like ECS, VPC, and RDS and to explore unrelated services such as Function Compute. Those capabilities are not justified by the skill's declared SLS-focused purpose and broaden the operational context beyond log-query assistance.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This manifest’s user-facing name, descriptions, use cases, and notes are entirely in Chinese, with no indication that the skill is region-specific or that users can choose another language. Under the stated policy, forcing a specific language without opt-in or justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This manifest uses Chinese for the skill name, description, parameter descriptions, use cases, and notes, which effectively forces a specific language for users consuming the skill metadata. The policy allows locale constraints only when they are explicitly offered as a choice or clearly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This manifest uses Chinese for the name, description, parameter text, notes, and use cases, which imposes a specific language on users without any opt-in or stated regional justification. The policy for natural-language violations requires flagging forced language or locale constraints when no user choice is provided.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This manifest uses Chinese for the skill name, description, parameter notes, use cases, and important notes, with no indication that the skill is region-specific or that users can choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This manifest contains user-facing natural-language fields such as the skill name, description, use cases, and notes entirely in Chinese. That effectively forces a specific language/locale without indicating user choice or documenting a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest explicitly states that province, city, and country names are returned in Chinese via phrases like '省份名称（中文）' and '国家名称（中文）'. This imposes a specific language/locale in the skill behavior without any visible opt-in, alternative locale option, or documented regional justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This manifest contains user-facing natural-language fields such as the skill name and descriptions entirely in Chinese. Under the policy, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This manifest uses Chinese for the skill name and description, which imposes a specific language on users without any opt-in or indication that the skill is intentionally region-specific. The policy explicitly flags language or locale constraints when no user choice or justification is provided.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This manifest uses Chinese for the skill name, description, notes, and function descriptions, which imposes a specific language on users without any opt-in or explanation of a region-specific requirement. Under the policy, forcing a language or locale without user choice is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This manifest contains user-facing natural language such as the skill name, description, and function notes exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This manifest uses Chinese for the skill name, description, parameter descriptions, notes, and examples, which effectively forces a specific language for users consuming the skill definition. The file does not indicate that the skill is region-specific or provide any opt-in or alternative language support, which matches the language/locale policy violation criteria.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest says "在所有场景中都适用" (applicable in all scenarios), which is an extremely broad trigger/scope description for a manifest file. This lacks boundaries or exclusion conditions, making it unclear when the skill should or should not be invoked and increasing the risk of unintended activation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire overview is written in Chinese and does not indicate any option for users to choose another language or locale. Under the policy rule for natural-language violations, a skill that effectively requires one language without opt-in should be flagged unless the locale restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language content for the category, description, parameter documentation, examples, and scenarios is written entirely in Chinese, which effectively constrains the skill to a specific language/locale. The file does not offer a language choice or explain that this is a region-specific skill, so it conflicts with the language/locale policy criteria.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest states "在所有场景中都适用" and "适用于所有场景", which makes the skill's invocation scope ambiguous and extremely broad rather than constrained to specific contexts. This increases the chance of unintended activation because no exclusions, limits, or negative examples are provided.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The category and description are written only in Chinese, which can impose a language expectation on users without offering a language choice or documenting a justified locale restriction. Under the policy, language-specific behavior should be opt-in or clearly justified as region-specific.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This manifest states "在所有场景中都适用" (applicable in all scenarios), which is an extremely broad activation condition for a manifest file. It does not provide scope boundaries, exclusions, or negative examples, increasing the risk of unintended invocation outside appropriate contexts.
- Content
Static analysis
No suspicious patterns detected.