ClawHub
Back to skill

Security audit

alibabacloud-support

Security checks for vulnerabilities and agentic risk

Overview

This Alibaba Cloud support-ticket skill is mostly purpose-aligned, but it can replace its own installed code from GitHub during normal rule refresh, which needs user review before installation.

Install only if you are comfortable with this skill using your configured aliyun CLI identity for support-ticket operations and with its built-in client updater changing the installed skill code from the upstream GitHub source. Use a least-privilege Alibaba Cloud identity where possible, review ticket previews before confirming writes, and avoid installing in environments where self-modifying agent skills are not acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (61)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared purpose focuses on ticket management, but the documented behavior also includes self-updating local code, fetching and installing remote rule content, maintaining local state, and invoking external CLI subprocesses. This mismatch can mislead reviewers and users about the true attack surface, especially because remote content ingestion and local overwrites materially increase execution risk beyond ordinary support-ticket handling.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
calling `aliyun workorder ...` directly, on editing the installed `SKILL.md` or

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md
calling `aliyun workorder ...` directly, on editing the installed `SKILL.md` or

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.

md
calling `aliyun workorder ...` directly, on editing the installed `SKILL.md` or

Self-Modification

High
Category
Rogue Agent
Confidence
99% confidence
Finding

The skill includes a self-update mechanism that can replace local skill files, which is an inherently high-risk capability because it changes executable behavior after deployment. Even with pinning and validation claims, any updater expands the trust boundary to remote content, update logic, and rollback handling, creating supply-chain and persistence risk.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
response for `CreateTicket` triggers one automated query-based reconciliation and nothing
   else; other ambiguous writes stop with an explicit "do not retry" instruction.
4. Degradation is silent for the customer only when the published result still holds: rule
   sources, self-update and optional fields may fail, and the workflow continues with the
   built-in generic template.

## Observability

Self-Modification

High
Category
Rogue Agent
Confidence
99% confidence
Finding

This line confirms the presence of self-update as a supported operational feature, reinforcing that the skill can modify or replace local components. A support-ticket skill with built-in update capability has a broader and more dangerous attack surface because compromise of update sources or logic can lead to arbitrary code persistence.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
writes it back to the process environment so nested processes share the same session id.

`scripts/aliyun_support.py` prints a single machine-readable JSON document on stdout and
progress or degradation notes on stderr; `rules update` and `self-update` report
`sourceType`, `sourceCommit`, `githubError`, `ossError`, `degraded` and `effectiveSource`, so
a fallback is always visible in the output, never only in prose.

Self-Modification

High
Category
Rogue Agent
Confidence
99% confidence
Finding

Advertising self-update status and self-update update as first-class commands exposes self-modification directly in the public interface. This increases the likelihood of misuse, accidental triggering, or adversarial prompting to initiate code replacement behavior under the guise of ordinary support actions.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md
| Command | Required | Optional |
|---|---|---|
| `doctor` | — | `--home` |
| `self-update status` / `self-update update` | — | `--force` |
| `rules status` / `rules update` | — | `--oss-url`, `--oss-prefix`, `--force` |
| `match` | `--input` (a file, or `-` for stdin) | `--product` |
| `draft` | `--input` (a JSON file, or `-` for stdin) | — |

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

Including self-update in the default orchestration flow means code-update logic is intertwined with routine ticket handling. This is especially dangerous because a user invoking a benign support workflow may indirectly trigger network-based maintenance behavior that changes local code or trust state.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

text
customer problem
   └─ doctor (readiness gate) ─┬─ self-update status ─┐
                               ├─ rules update ───────┤  best effort, never blocking
                               └─ catalog ────────────┘
   └─ match → resolved issue type or generic fallback

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

The documented preflight explicitly runs self-update status, showing that updater logic is expected during ordinary execution. Even status checks can normalize the updater pathway and encourage network trust decisions during routine use, increasing exposure to supply-chain or logic-manipulation issues.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

bash
python3 scripts/aliyun_support.py doctor
python3 scripts/aliyun_support.py self-update status
python3 scripts/aliyun_support.py rules update

Self-Modification

High
Category
Rogue Agent
Confidence
99% confidence
Finding

This section describes automatic best-effort client self-update behavior during rules update, including downloading and installing SKILL.md and scripts/aliyun_support.py. Combining remote content retrieval with local installation in a customer-facing skill creates significant supply-chain and integrity risk, even if constrained by pinned commits and validation checks.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md
--help` listing, so it sends no request and needs no credential;
`capabilityMatrix[].available` reflects the plugin command surface, and
`permissionVerified: false` means the write permissions were deliberately not probed.
`rules update` also performs one best-effort client self-update check per seven-day cycle: it
only downloads `SKILL.md` and `scripts/aliyun_support.py` from the pinned commit, validates
frontmatter, the semver of the script `VERSION` constant, compilation and the `APP_NAME`
match, installs only a strictly higher version, and keeps a `0600` transaction record with the

Self-Modification

High
Category
Rogue Agent
Confidence
97% confidence
Finding

The documentation explicitly states that a fixed client version may reach the customer through release or self-update, confirming a supported code-replacement channel. Any self-update capability in an agent skill materially increases persistence and supply-chain risk because the skill can alter future behavior without full redeployment review.

Content

Scanner excerpt · SKILL.md (reported line 350)May include surrounding context.

md
attachment upload; attachments stay in the console.
- The client never patches itself at the customer site: encoding, PATH, authentication or API
  problems are solved with the documented commands, flags and environment variables, and a
  fixed client version reaches the customer only through a validated release or self-update.

## Error Handling

Self-Modification

High
Category
Rogue Agent
Confidence
97% confidence
Finding

The statement that self-update failures do not block other work confirms that updater logic is part of the runtime trust model. This means update-related network and state-management behavior coexists with production operations, which broadens the attack surface and can leave partially trusted update artifacts or state behind.

Content

Scanner excerpt · SKILL.md (reported line 364)May include surrounding context.

md
login, network failure and insufficient RAM permission — from `workorder_access_unavailable`,
and never fall back to another credential silently. When both rule sources fail, the client
returns the degraded generic template and keeps `match` and `draft` working; a failed
self-update never blocks rules, catalog or ticket work.

## Important Notes

Self-Modification

High
Category
Rogue Agent
Confidence
99% confidence
Finding

The script implements self-modifying behavior by downloading and replacing its own local files from a remote source. In an agent skill that handles support workflows, self-update is especially dangerous because compromise of the update channel or repository control can directly lead to arbitrary code replacement on the host.

Content

Scanner excerpt · scripts/aliyun_support.py (reported line 61)May include surrounding context.

python
HEX_32_PATTERN = re.compile(r"^[0-9a-f]{32}$")
# The version component of the User-Agent is declared only in
# references/manifest.json and is read from that file at runtime. It is never
# hardcoded here, never derived from the self-update VERSION constant, and never
# replaced by a placeholder when the manifest cannot be read.
MANIFEST_PATH = Path(__file__).resolve().parent.parent / "references" / "manifest.json"
SKILL_VERSION_PATTERN = re.compile(r"^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$")

Self-Modification

High
Category
Rogue Agent
Confidence
99% confidence
Finding

This location is part of the self-update subsystem that tracks and manages code replacement state for the local client. Any mechanism that enables the running skill to overwrite its own code materially increases supply-chain and persistence risk.

Content

Scanner excerpt · scripts/aliyun_support.py (reported line 1225)May include surrounding context.

python
return _install_client_bundle_locked(home, bundle)


def self_update_status(home: Path) -> dict[str, Any]:
    state = load_client_update_state(home)
    checked_at = state.get("checkedAt")
    try:

Self-Modification

High
Category
Rogue Agent
Confidence
99% confidence
Finding

The locked self-update path performs remote version resolution, bundle download, validation, and installation, enabling modification of executable skill files. This creates a direct avenue for hostile code deployment if upstream trust is broken.

Content

Scanner excerpt · scripts/aliyun_support.py (reported line 1246)May include surrounding context.

python
}


def _self_update_locked(home: Path, force: bool = False) -> dict[str, Any]:
    recovery = recover_client_update(home)
    local_bundle, local_version = read_local_client_bundle()
    previous = load_client_update_state(home)

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

This code enforces periodic update behavior and is part of the mechanism that can replace local code based on remote content. Automatic or semi-automatic update orchestration inside an agent skill is a high-risk pattern because it expands remote control over local execution.

Content

Scanner excerpt · scripts/aliyun_support.py (reported line 1252)May include surrounding context.

python
previous = load_client_update_state(home)
    if not force and time.time() - parse_checked_at(previous.get("checkedAt")) < CHECK_INTERVAL_SECONDS:
        return {
            **self_update_status(home),
            "updated": False,
            "reason": "checked_recently",
            "recovery": recovery,

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

This self-update error path confirms that the application is expected to modify itself at runtime and recover from failed replacements. The dangerous part is not the error handling but the existence of self-replacement capability.

Content

Scanner excerpt · scripts/aliyun_support.py (reported line 1310)May include surrounding context.

python
write_client_update_state(home, state)
        if isinstance(exc, ClientError):
            raise
        raise ClientError(f"the client self-update failed: {error}") from exc


def self_update(home: Path, force: bool = False) -> dict[str, Any]:

Self-Modification

High
Category
Rogue Agent
Confidence
99% confidence
Finding

The exported self_update entry point exposes direct code-replacement functionality. In the skill context, this is beyond the declared support-ticket scope and creates a powerful primitive for persistence or compromise if the update source is subverted.

Content

Scanner excerpt · scripts/aliyun_support.py (reported line 1313)May include surrounding context.

python
raise ClientError(f"the client self-update failed: {error}") from exc


def self_update(home: Path, force: bool = False) -> dict[str, Any]:
    with client_update_lock(home):
        return _self_update_locked(home, force=force)

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

This line is part of the callable self-update wrapper and contributes to runtime self-modification. The risk remains supply-chain compromise and unauthorized code changes on the local system.

Content

Scanner excerpt · scripts/aliyun_support.py (reported line 1315)May include surrounding context.

python
def self_update(home: Path, force: bool = False) -> dict[str, Any]:
    with client_update_lock(home):
        return _self_update_locked(home, force=force)


def best_effort_self_update(home: Path) -> dict[str, Any]:

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

Best-effort self-update means normal operations may opportunistically trigger update behavior, further broadening the chance of remote influence over local code. Hidden or background update attempts are especially risky in agent tooling.

Content

Scanner excerpt · scripts/aliyun_support.py (reported line 1318)May include surrounding context.

python
return _self_update_locked(home, force=force)


def best_effort_self_update(home: Path) -> dict[str, Any]:
    try:
        return self_update(home, force=False)
    except Exception as exc:

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

This line is within the fallback self-update flow and reflects continued support for runtime self-replacement. Even with rollback handling, the capability itself is unsafe for a support-ticket skill.

Content

Scanner excerpt · scripts/aliyun_support.py (reported line 1320)May include surrounding context.

python
def best_effort_self_update(home: Path) -> dict[str, Any]:
    try:
        return self_update(home, force=False)
    except Exception as exc:
        try:
            status = self_update_status(home)

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

Status recovery around self-update still indicates active support for self-modification. The code is designed to heal around update failures, which reinforces the presence of a high-risk update mechanism.

Content

Scanner excerpt · scripts/aliyun_support.py (reported line 1323)May include surrounding context.

python
return self_update(home, force=False)
    except Exception as exc:
        try:
            status = self_update_status(home)
        except Exception:
            status = {
                "checkedAt": None,

Self-Modification

High
Category
Rogue Agent
Confidence
97% confidence
Finding

The rule-update result structure explicitly carries self-update results, showing that ordinary rule management is coupled to code self-modification behavior. Combining data updates with code updates increases complexity and attack surface.

Content

Scanner excerpt · scripts/aliyun_support.py (reported line 1886)May include surrounding context.

python
def rules_update_result(
    state: dict[str, Any],
    self_update_result: dict[str, Any],
    *,
    updated: bool,
    source_type: str,

Self-Modification

High
Category
Rogue Agent
Confidence
97% confidence
Finding

Embedding selfUpdate results in operational outputs demonstrates that self-modification is part of standard workflows rather than a tightly controlled maintenance path. This makes accidental or unnoticed updater use more likely.

Content

Scanner excerpt · scripts/aliyun_support.py (reported line 1910)May include surrounding context.

python
"githubError": github_error,
        "degraded": degraded,
        "effectiveSource": effective_source,
        "selfUpdate": self_update_result,
    }
    if reason is not None:
        result["reason"] = reason

Self-Modification

High
Category
Rogue Agent
Confidence
97% confidence
Finding

Embedding selfUpdate results in operational outputs demonstrates that self-modification is part of standard workflows rather than a tightly controlled maintenance path. This makes accidental or unnoticed updater use more likely.

Content

Scanner excerpt · scripts/aliyun_support.py (reported line 1910)May include surrounding context.

python
"githubError": github_error,
        "degraded": degraded,
        "effectiveSource": effective_source,
        "selfUpdate": self_update_result,
    }
    if reason is not None:
        result["reason"] = reason

Static analysis

No suspicious patterns detected.