alibabacloud-sysom-diagnosis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:56 AM UTC
• Version: 0.0.7

Overview

The skill is mostly coherent for Alibaba Cloud SysOM diagnosis, but its installer tells users to run an unverified remote shell script, including a root-level option.

Install only if you trust the publisher and the external installer source. Prefer downloading the installer first, verifying a published checksum or signature, inspecting it, and using the user-local install path instead of the sudo pipeline. Use a least-privilege RAM role or user for SysOM diagnostics and do not paste AK/SK secrets into chat.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:65

Finding

Unverified Remote Installer Executed Through Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 65–80
Vulnerability Type: Unverified remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

curl -fsSL --connect-timeout 1000 https://sysom-prd-cn-hangzhou.oss-cn-hangzhou.aliyuncs.com/sysom_prd/skill_cli/install.sh \
  | sudo bash

bash

mkdir -p ~/.local/bin
curl -fsSL --connect-timeout 1000 https://sysom-prd-cn-hangzhou.oss-cn-hangzhou.aliyuncs.com/sysom_prd/skill_cli/install.sh \
  | bash -s -- -d "$HOME/.local/bin"

Technical Analysis

The Skill instructs the Agent to retrieve a mutable shell script from an external URL and execute the response immediately. It does not pin an installer version, verify a cryptographic checksum or signature, save the script for inspection, or validate the final destination after redirects.

HTTPS protects data in transit but does not establish the long-term integrity of the hosted object. Compromise of the hosting account, storage bucket, publishing pipeline, or other trusted delivery infrastructure could replace the reviewed installer with arbitrary code. That code would then execute without an additional integrity boundary.

The system-wide variant pipes the response into sudo bash, making the retrieved content root-privileged. The user-local variant avoids sudo but can still compromise the Agent account and access credentials available to that account. The version value in references/manifest.json does not mitigate this issue because it is not cryptographically bound to the installer or installed binaries.

Attack Path

1. The Agent checks for sysom-osops and finds that it is not installed.
2. Following SKILL.md, it invokes one of the documented installation pipelines.
3. An attacker who has compromised the hosted installer or its trusted publication path replaces install.sh with attacker-controlled shell commands.
4. curl retrieves the modified response.
5. The pipe sends the response d ...[truncated 1159 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both direct curl | bash installation pipelines.
2. Pin the installer and resulting CLI to an explicit, immutable release version.
3. Download the installer into a securely created temporary file without executing it.
4. Publish a SHA-256 or stronger digest through a separately protected channel and verify it before execution.
5. Cryptographically sign release artifacts and verify the signature against a pinned vendor public key.
6. Reject unexpected redirects and validate that the final resolved URL uses HTTPS and an explicitly approved hostname.
7. Make the verified installer available for inspection before it is executed.
8. Prefer signed operating-system packages or a signed package repository over shell-based installation.
9. Use user-local installation by default. Require a deliberate, separately explained decision before any root-level installation.
10. Document the exact files, directories, permissions, and configuration changes made by the installer.
11. Extend references/manifest.json to identify the exact release and expected hashes of every supported platform artifact.
12. Run installation with the minimum required privileges and prevent the installer from inheriting unrelated cloud credentials where operationally possible.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (13)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Fetching an external script over the network and piping it straight into sudo bash is a classic arbitrary-code-execution anti-pattern. In this skill's context, the command runs on the operator's control host, so compromise would affect the machine holding cloud credentials and diagnostic tooling, significantly increasing blast radius.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

sudo):

bash

curl -fsSL --connect-timeout 1000 https://sysom-prd-cn-hangzhou.oss-cn-hangzhou.aliyuncs.com/sysom_prd/skill_cli/install.sh \
  | sudo bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The pipe into sudo creates a dangerous command chain where untrusted remote content is executed immediately with elevated privileges. Chaining removes natural review points and makes accidental or malicious script changes instantly exploitable.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

bash

curl -fsSL --connect-timeout 1000 https://sysom-prd-cn-hangzhou.oss-cn-hangzhou.aliyuncs.com/sysom_prd/skill_cli/install.sh \
  | sudo bash

User-local install — no sudo, no root-owned paths. Works on both Linux and

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

This is the same external-script execution anti-pattern for user-local install. Although it avoids sudo, it still grants arbitrary code execution in the user's context, which can steal tokens, modify shell startup files, and tamper with future CLI behavior.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

bash

mkdir -p ~/.local/bin
curl -fsSL --connect-timeout 1000 https://sysom-prd-cn-hangzhou.oss-cn-hangzhou.aliyuncs.com/sysom_prd/skill_cli/install.sh \
  | bash -s -- -d "$HOME/.local/bin"

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md

# Classify Output Guide

Use `sysom-osops memory classify` as the local entry point for unclear memory
symptoms. It returns the same default Agent envelope as remote deep actions.

## What To Read

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

md

# Classify Output Guide

Use `sysom-osops memory classify` as the local entry point for unclear memory
symptoms. It returns the same default Agent envelope as remote deep actions.

## What To Read

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/classify-output-guide.md (reported line 3)May include surrounding context.

md

# Classify Output Guide

Use `sysom-osops memory classify` as the local entry point for unclear memory
symptoms. It returns the same default Agent envelope as remote deep actions.

## What To Read

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/deep-actions.md (reported line 11)May include surrounding context.

md

# Classify Output Guide

Use `sysom-osops memory classify` as the local entry point for unclear memory
symptoms. It returns the same default Agent envelope as remote deep actions.

## What To Read

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/parameter-guide.md (reported line 71)May include surrounding context.

md

Passing a flag a command does not define makes the CLI exit non-zero with
**empty stdout and empty stderr** — no envelope and no error message. Never
invent a flag: use only the parameters listed above, and confirm with
`sysom-osops <group> <command> --help` when unsure. See the empty-output rule in
`SKILL.md` for how to recover when it happens.

`--help` is reliable for checking the flags of a command that is already

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to download and immediately execute a remote installer script via a shell pipeline. This bypasses review and integrity verification, so a compromised hosting bucket, DNS/TLS interception, or malicious script update could lead to arbitrary code execution on the control host.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill recommends running the fetched installer under sudo, which magnifies the risk from the remote-script pattern into privileged arbitrary code execution. If the installer source is compromised or replaced, the attacker gains root-level access on the control host.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

bash

curl -fsSL --connect-timeout 1000 https://sysom-prd-cn-hangzhou.oss-cn-hangzhou.aliyuncs.com/sysom_prd/skill_cli/install.sh \
  | sudo bash

User-local install — no sudo, no root-owned paths. Works on both Linux and

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

privileges:

bash

mkdir -p ~/.local/bin
curl -fsSL --connect-timeout 1000 https://sysom-prd-cn-hangzhou.oss-cn-hangzhou.aliyuncs.com/sysom_prd/skill_cli/install.sh \
  | bash -s -- -d "$HOME/.local/bin"

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

md

For command parameters, read `references/deep-actions.md` and
`references/parameter-guide.md`. For OS and region support, read
`references/supported-environments.md`. These references are Skill material; do
not use remote target file tools to open `.claude/skills` paths on the diagnosed
host.
For Java symptom-to-type routing, consult `references/java/README.md`.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/java/memory/case-library.md (reported line 155)May include surrounding context.

md

### Incorrect narrative (avoid)

- Immediate identical re-run
- Declaring profiling unsupported without checking wait time

---

Static analysis

No suspicious patterns detected.