Alibabacloud Sms Send Short Message

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 0.0.2

Overview

This SMS skill is mostly aligned with Alibaba Cloud messaging, but it asks users or agents to run unverified installers and persistent CLI/plugin updates that deserve review before installation.

Review this skill before installing in production. Do not let an agent run the documented curl-to-bash installer, auto-update plugins, or use sudo without separate verification and approval. Use a dedicated least-privilege Alibaba Cloud RAM role, keep SMS sending behind explicit confirmation, and treat qualification-detail and delivery-detail outputs as sensitive personal data that should be redacted and not logged broadly.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:32

Finding

Unverified Remote Installer Executed Directly by Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32–34
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

> Run `aliyun version` to verify the version is >= 3.3.3. If not installed or the version
> is too low, run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install or
> update.

Technical Analysis

The installation instructions download a mutable shell script from an external URL and pass its response directly to Bash. The script is neither pinned to a reviewed version nor verified using a cryptographic signature or checksum before execution.

HTTPS provides transport protection but does not establish that all future content served from this URL will match the content reviewed during this audit. Compromise of the hosting infrastructure, CDN, DNS path, publication account, or upstream installer could therefore turn this command into an arbitrary-code-execution mechanism.

Installing the Alibaba Cloud CLI is relevant to the Skill's functionality, but executing an uninspected network response directly in a shell is not the minimum-risk or minimum-privilege installation method.

Attack Path

1. An attacker compromises the installer publication process, hosting service, CDN, DNS resolution path, or another trusted upstream component.
2. The attacker replaces or modifies setup.sh with malicious shell commands.
3. A user or agent follows the mandatory pre-check and runs the documented command.
4. curl retrieves the modified response and immediately streams it to Bash.
5. The payload executes with the privileges and environment of the invoking process.
6. It may read local files and environment variables, access configured Alibaba Cloud credentials, alter user-level configuration, make network connections, or establish persistence where the invoking account has permission.

Impact Assessment

Successful exploitation provides arbitrary command execution under ...[truncated 680 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | bash instruction.
2. Prefer an operating-system package manager with signed repository metadata and a version-pinned package.
3. For manual installation:
   • Download a version-specific artifact rather than a mutable latest installer.
   • Download the checksum or signature through a separately authenticated publication channel.
   • Verify the artifact using SHA-256 and, preferably, a vendor signing key.
   • Abort installation if verification fails.
   • Inspect or extract the artifact before executing or installing it.
4. Perform installation as an unprivileged user whenever possible. Request narrowly scoped elevation only for the final file placement step.
5. Record the approved CLI version and integrity value in the Skill documentation so the reviewed dependency cannot change silently.
6. Require explicit user approval before installing or updating local software.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36

Finding

Automatic Installation and Unpinned Updating of Executable CLI Plugins

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36–40
Additional Location: scripts/send_sms.sh, lines 169–178
Vulnerability Type: Insecure dependency lifecycle and supply-chain exposure
Risk Level: Medium

Vulnerable Code

From SKILL.md:

bash

**Pre-check: Aliyun CLI plugin update required**
> [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin
> installation.
> [MUST] run `aliyun plugin update` to ensure that any existing plugins on your local
> machine are always up-to-date.

From scripts/send_sms.sh:

bash

# Check whether the dysmsapi plugin is installed
check_plugin() {
    if ! aliyun dysmsapi --help &> /dev/null; then
        echo -e "${YELLOW}Installing the dysmsapi plugin...${NC}"
        aliyun plugin install --names dysmsapi
        if [ $? -ne 0 ]; then
            echo -e "${RED}Error: failed to install the dysmsapi plugin.${NC}"
            echo "Install it manually with: aliyun plugin install --names dysmsapi"
            exit 1
        fi
        echo -e "${GREEN}dysmsapi plugin installed successfully.${NC}"
    fi
}

Technical Analysis

The Skill mandates automatic plugin installation and unconditional updating to the newest available release. The wrapper also installs the dysmsapi plugin automatically if its help command is unavailable.

No plugin version, digest, or signature is pinned or independently verified by the project. Consequently, executable dependency content can change after this Skill has been reviewed. An upstream compromise or malicious future release could introduce code that executes in the authenticated CLI environment.

Installing the SMS plugin is functionally relevant, but silently installing or upgrading it is broader than necessary. A previously reviewed version could remain in use until an explicit, verified upgrade is approved.

Attack Path

1. An attacker compromises the Aliyun plugin publication account, repository, upda ...[truncated 1285 chars]

Remediation

View remediation

Remediation Suggestions

1. Disable automatic plugin installation by default.
2. Remove the requirement to run aliyun plugin update on every Skill execution.
3. Pin dysmsapi to a reviewed, compatible version.
4. Verify the plugin using a vendor signature or published cryptographic checksum before installation.
5. Require explicit user approval before installing or upgrading executable dependencies.
6. Separate dependency setup from routine SMS operations so normal invocations do not modify the local toolchain.
7. Fail safely with manual installation instructions when the required verified plugin is absent.
8. Run the CLI using a dedicated least-privilege RAM role containing only the actions needed for the selected operation.
9. Test upgrades in an isolated environment before approving them for production use.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description is mostly aligned with the Alibaba Cloud SMS domain and does accurately mention pre-send verification of signatures and templates, which the code supports via --verify. However, there is a material mismatch because the description explicitly claims support for both single send (SendSms, up to 1000 phone numbers) and batch send (SendBatchSms, up to 100 phone numbers each with distinct signature/template parameters). The code only implements a send command that calls aliyun dysmsapi send-sms; there is no implementation of send-batch-sms or any handling of per-recipient signature/template parameters. Additionally, the code includes broader operational capabilities—listing signatures/templates, querying sign/template status, querying send details, and querying send statistics—which are not clearly captured in the declared purpose. Those extras are related to SMS management, so they are a smaller mismatch than the missing batch-send feature, but they still mean the description does not fully represent actual behavior.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Piping a remotely fetched script directly into bash is a classic unsafe pattern because it executes network-supplied code without inspection or integrity verification. In this skill context, the command is framed as a mandatory pre-check, making it more likely an agent or operator will execute it automatically and thereby grant arbitrary code execution to whoever controls the distribution path or can tamper with it.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify the version is >= 3.3.3. If not installed or the version
> is too low, run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install or
> update.

**Pre-check: Aliyun CLI plugin update required**

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

Linux

wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz tar -xzf aliyun-cli-linux-latest-amd64.tgz && sudo mv aliyun /usr/local/bin/

aliyun version # must be >= 3.3.3

text

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The single-detail API response includes highly sensitive PII such as legal-person ID numbers, admin ID numbers, phone numbers, and document/image URLs. Embedding guidance for retrieving this data in a skill whose stated purpose is SMS sending creates unnecessary access to sensitive identity data, increasing the risk of privacy breaches, overcollection, and accidental disclosure through logs or model output.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation trigger is broad enough to match many generic user requests about texting, notifications, reminders, or campaigns. In an agent ecosystem, overbroad routing can cause this skill to activate in situations where the user did not clearly intend to send SMS, increasing the chance of unauthorized messaging actions, privacy mistakes, or costly misuse.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The documentation instructs use of sudo mv to place a binary into /usr/local/bin, which requires elevated privileges. If an agent or user follows this blindly after downloading an unverified artifact, a compromised or tampered binary could be installed system-wide with privileged trust, expanding impact beyond the skill itself.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

Linux

wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz tar -xzf aliyun-cli-linux-latest-amd64.tgz && sudo mv aliyun /usr/local/bin/

aliyun version # must be >= 3.3.3

text

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document adds qualification-enumeration and audit-inspection capabilities that go beyond the skill's declared purpose of sending SMS. This expands the effective privilege scope of the skill and enables account reconnaissance about qualification records, approval state, company identity, and related metadata that are not necessary for simply sending messages.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/sms-qualification.md (reported line 35)May include surrounding context.

md

### Parameters

| Parameter                    | Required | Description                                                                                          |
| ---------------------------- | -------- | ---------------------------------------------------------------------------------------------------- |
| --api-version                | Yes      | Fixed to `2017-05-25`                                                                                |
| --qualification-group-name   | No       | Qualification name filter                                                                            |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/sms-qualification.md (reported line 37)May include surrounding context.

md

| Parameter                    | Required | Description                                                                                          |
| ---------------------------- | -------- | ---------------------------------------------------------------------------------------------------- |
| --api-version                | Yes      | Fixed to `2017-05-25`                                                                                |
| --qualification-group-name   | No       | Qualification name filter                                                                            |
| --company-name               | No       | Company name filter                                                                                  |
| --state                      | No       | Audit state filter: `INIT` / `NOT_PASS` / `PASS` / `NOT_FINISH` / `CANCEL`                           |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/sms-qualification.md (reported line 39)May include surrounding context.

md

| ---------------------------- | -------- | ---------------------------------------------------------------------------------------------------- |
| --api-version                | Yes      | Fixed to `2017-05-25`                                                                                |
| --qualification-group-name   | No       | Qualification name filter                                                                            |
| --company-name               | No       | Company name filter                                                                                  |
| --state                      | No       | Audit state filter: `INIT` / `NOT_PASS` / `PASS` / `NOT_FINISH` / `CANCEL`                           |
| --work-order-id              | No       | Audit work-order ID filter                                                                           |
| --legal-person-name          | No       | Legal person name filter                                                                             |

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest presents the skill as one for sending SMS messages, with optional pre-send verification of signature and template approval status. This script also exposes account-enumeration and reporting capabilities such as listing all SMS signatures/templates, querying send details, and querying send statistics, which go beyond the described send-and-verify workflow.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The script defaults to sending SMS without pre-validating that the signature and template are approved. In an agent skill context, unsafe defaults matter because automated callers may omit --verify and trigger unintended sends, failed deliveries, operational abuse, or unexpected charges using whatever credentials are configured.

Content

Scanner excerpt · scripts/send_sms.sh (reported line 202)May include surrounding context.

sh

local template_code=""
    local template_param=""
    local out_id=""
    local verify=false

    while [[ $# -gt 0 ]]; do
        case $1 in

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest explicitly claims support for both SendSms and SendBatchSms, including batch sends where each phone number can have its own signature and template parameters. In the implementation, the send path only invokes aliyun dysmsapi send-sms and there is no command or code path for send-batch-sms, so the advertised batch capability is absent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file documents SMS-sending permissions but does not warn that sending messages can incur charges and transmits recipient phone numbers and message content to an external Alibaba Cloud service. In a skill specifically designed to send SMS, this omission can lead to unintended costs and privacy surprises for users or operators, even if it is not a code-execution or privilege-escalation flaw.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file documents fields such as PhoneNum and Content, and later shows a query-send-details example using a real-looking phone number and parsing per-message details. Under the markdown-file criteria for SQP-2, the skill description should warn that the workflow may surface personal data and message contents that affect user privacy.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/send_sms.sh:202