Security audit
Security checks for vulnerabilities and agentic risk
The skill is purpose-aligned, but it needs Review because it stores cloud credentials locally and recommends privileged unverified installers and recurring sync tasks.
Review this skill before installing. Use temporary or least-privilege Alibaba Cloud credentials, avoid saving AK/SK or STS tokens in project JSON, avoid curl-to-bash and sudo pipe installers unless you independently verify the source, keep automatic plugin installation disabled, and only enable scheduled sync after confirming the exact directory, cloud bucket, command, frequency, and removal procedure.
references/aliyun-cli-installation-guide.md:13Unverified Remote Installation Scripts Are Executed Directly
SKILL.md:120Resolved Alibaba Cloud Credentials Are Persisted in Plaintext
SKILL.md:231Scheduled Synchronization Creates an Insufficiently Hardened Persistence Channel
references/aliyun-cli-installation-guide.md:112Automatic CLI Plugin Installation Expands the Unreviewed Supply-Chain Boundary
The skill instructs execution of rm -f ~/.pyenv/shims/.pyenv-shim && pyenv rehash, which is a filesystem-modifying command outside the skill's own working directory and normal package-install scope. Even if intended as troubleshooting, destructive shell guidance can be misapplied in automated environments, normalized for future unsafe command use, and violates least-surprise for a storage-management skill.
# Try running pyenv rehash manually first (~/.pyenv/shims/.pyenv-shim can be removed safely)
rm -f ~/.pyenv/shims/.pyenv-shim && pyenv rehash
# Then retry pip install
pip install tablestore-agent-storage==1.0.4
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Credentials Configuration
This document describes how to configure access credentials for the `tablestore-agent-storage` SDK using the Alibaba Cloud Credentials tool and the default credential chain.
## Prerequisites
The guide instructs users to fetch an executable archive from an external URL and install it, but does not provide any checksum, signature verification, or authenticity validation steps. While downloading vendor-hosted binaries is common, omission of integrity verification increases supply-chain risk: a compromised mirror, CDN path, or tampered artifact could lead to execution of malicious code.
# Linux x86_64 (recommended)
curl -o ossutil-linux-amd64.zip https://gosspublic.alicdn.com/ossutil/v2/2.2.1/ossutil-2.2.1-linux-amd64.zip
unzip ossutil-linux-amd64.zip
cd ossutil-2.2.1-linux-amd64
chmod 755 ossutil
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
unzip ossutil-linux-amd64.zip cd ossutil-2.2.1-linux-amd64 chmod 755 ossutil sudo mv ossutil /usr/local/bin/ && sudo ln -s /usr/local/bin/ossutil /usr/bin/ossutil
```bash
Piping curl output directly into sudo bash is a classic unsafe chaining pattern that converts remote content into immediate privileged execution. In this skill context, users may follow setup docs mechanically while preparing storage tooling for agent systems, making the unsafe convenience pattern especially dangerous because it can compromise the host that manages the knowledge base.
Or use the one-click installation script (ossutil 1.x):
sudo -v ; curl https://gosspublic.alicdn.com/ossutil/install.sh | sudo bash
Step 3: Verify installation
The trigger list includes very broad phrases such as "knowledge base" and "agent storage," which can cause the skill to activate in contexts where the user did not intend to manage Alibaba Cloud resources. Unintended invocation is risky here because the skill is capable of installing packages, creating cloud instances, persisting configuration, and preparing sync automation.
The skill requires persisting configuration to disk and its recommended format includes credential fields, but it does not present a clear up-front warning that secrets may be written locally. Users may unknowingly allow storage of sensitive cloud credentials in a predictable path, increasing the chance of leakage via source control, backups, or local compromise.
The skill tells the agent not to request plaintext AK/SK from the user, but then provides code and a config schema that persist access_key_id, access_key_secret, and sts_token to a local JSON file. That creates a clear pathway for long-lived secret exposure at rest, especially if file permissions, redaction, and encryption are not enforced.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
---
## Things You Must NOT Do
- Never ask the user for plaintext AK/SK, and never expose credentials via `echo`, `print`, or logging. Handle all secrets exclusively through backend code.
- Do not request all configuration at once
- Do not output legacy version compatibility notes
- Do not provide an excessively long file type list by default
The guide instructs users to execute a shell command fetched directly from a remote URL, which is a risky supply-chain pattern because the downloaded script is not reviewed or integrity-checked before execution. In a skill context, users may copy-paste commands verbatim, so compromise of the distribution endpoint or unintended script changes could lead to arbitrary code execution on the host.
This section instructs users to run aliyun configure and provide Access Key Id and Access Key Secret, which are sensitive credentials. Although later lines include some security rules, the credential entry step itself lacks an upfront warning that these secrets grant cloud access and should only be entered on trusted machines with least-privilege credentials.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
embedding_config = EmbeddingConfiguration(
provider="openai", # Model provider
url="https://api.openai.com/v1/embeddings", # Embedding API URL
api_key="your-api-key", # API Key
model="text-embedding-3-small", # Model name
dimension=1536 # Vector dimension
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Alibaba Cloud Linux / CentOS
sudo yum install -y unzip
# Ubuntu / Debian
sudo apt install -y unzip
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Alibaba Cloud Linux / CentOS
sudo yum install -y unzip
# Ubuntu / Debian
sudo apt install -y unzip
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Alibaba Cloud Linux / CentOS
sudo yum install -y unzip
# Ubuntu / Debian
sudo apt install -y unzip
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Alibaba Cloud Linux / CentOS
sudo yum install -y unzip
# Ubuntu / Debian
sudo apt install -y unzip
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Alibaba Cloud Linux / CentOS
sudo yum install -y unzip
# Ubuntu / Debian
sudo apt install -y unzip
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Alibaba Cloud Linux / CentOS
sudo yum install -y unzip
# Ubuntu / Debian
sudo apt install -y unzip
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Alibaba Cloud Linux / CentOS
sudo yum install -y unzip
# Ubuntu / Debian
sudo apt install -y unzip
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Alibaba Cloud Linux / CentOS
sudo yum install -y unzip
# Ubuntu / Debian
sudo apt install -y unzip
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Alibaba Cloud Linux / CentOS
sudo yum install -y unzip
# Ubuntu / Debian
sudo apt install -y unzip
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
curl -o ossutil-linux-amd64.zip https://gosspublic.alicdn.com/ossutil/v2/2.2.1/ossutil-2.2.1-linux-amd64.zip unzip ossutil-linux-amd64.zip cd ossutil-2.2.1-linux-amd64 chmod 755 ossutil sudo mv ossutil /usr/local/bin/ && sudo ln -s /usr/local/bin/ossutil /usr/bin/ossutil
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
curl -o ossutil-linux-amd64.zip https://gosspublic.alicdn.com/ossutil/v2/2.2.1/ossutil-2.2.1-linux-amd64.zip unzip ossutil-linux-amd64.zip cd ossutil-2.2.1-linux-amd64 chmod 755 ossutil sudo mv ossutil /usr/local/bin/ && sudo ln -s /usr/local/bin/ossutil /usr/bin/ossutil
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
curl -o ossutil-linux-amd64.zip https://gosspublic.alicdn.com/ossutil/v2/2.2.1/ossutil-2.2.1-linux-amd64.zip unzip ossutil-linux-amd64.zip cd ossutil-2.2.1-linux-amd64 chmod 755 ossutil sudo mv ossutil /usr/local/bin/ && sudo ln -s /usr/local/bin/ossutil /usr/bin/ossutil
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
curl -o ossutil-linux-amd64.zip https://gosspublic.alicdn.com/ossutil/v2/2.2.1/ossutil-2.2.1-linux-amd64.zip unzip ossutil-linux-amd64.zip cd ossutil-2.2.1-linux-amd64 chmod 755 ossutil sudo mv ossutil /usr/local/bin/ && sudo ln -s /usr/local/bin/ossutil /usr/bin/ossutil
No suspicious patterns detected.