Alibabacloud Tablestore Ops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:23 AM UTC
• Version: 0.0.1

Overview

The skill is mostly a read-only Alibaba Cloud Tablestore helper, but its setup guidance includes unverified privileged CLI installation and overbroad cloud permission examples that users should review before installing.

Review this before installing. Use a verified, pinned Aliyun CLI release if possible, avoid system-wide sudo installation unless you explicitly need it, and prefer a user-local PATH. Use temporary or role-based Alibaba Cloud credentials where available, or a dedicated RAM user with only read-only Tablestore permissions. Do not copy the RAM examples that attach AliyunOTSFullAccess or include ots:CreateInstance for this read-only workflow, and redact any AccessKey-related output from logs, chats, and tickets.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:39

Finding

Mutable External Binaries Are Downloaded and Executed Without Integrity Verification

Content

View full analysis

- Always download directly from the official CDN to ensure you get the latest version > - The otsutil subcommand automatically downloads and manages the Tablestore CLI binary on first use ``` From `references/cli-installation-guide.md:165-169`: ```markdown ### First Run On the first run, `aliyun otsutil` automatically downloads the Tablestore CLI binary: ```bash aliyun otsutil help ``` ``` From `references/cli-installation-guide.md:222-230`: ```bash 2. If version is below 3.3.0, download the latest version from CDN: ```bash # Remove old version (if installed via homebrew) brew uninstall aliyun-cli 2>/dev/null # Download latest from CDN curl -L -o aliyun-cli.tgz https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-universal.tgz ...[truncated 3255 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/ram-policies.md:198

Finding

Read-Only Skill Provides Commands That Grant Full or Resource-Creation Permissions

Content

View full analysis

\ --user-agent AlibabaCloud-Agent-Skills # Create custom policy aliyun ram create-policy \ --policy-name OTSInstanceManagement \ --policy-document '{"Version":"1","Statement":[{"Effect":"Allow","Action":["ots:CreateInstance","ots:GetInstance","ots:ListInstance"],"Resource":"acs:ots:*:*:instance/*"}]}' \ --user-agent AlibabaCloud-Agent-Skills ``` ### Technical Analysis The project explicitly describes itself as a read-only Tablestore operations skill. Its legitimate operations require only the following actions: - `ots:GetInstance` - `ots:ListInstance` - `ots:ListTable` - `ots:DescribeTable` However, the actionable policy examples instruct users to attach `AliyunOTSFullAccess`, which grants all Tablestore actions, or create a custom policy containing `ots:CreateInstance`. Neither full administrative access nor instance-creation access is required for the documented listing and description workflow. The examples therefore violate the principle of least privilege and contradict the skill's declared security boundary. Although executing these commands requires an identity already authorized to administer RAM policies, a user following the guide can unnecessarily expand the target identity's privileges. ### Attack Path 1. An administrator follows the “Applying Policies” section to prepare a user for this read-only skill. 2. The administrator runs the provided `attach-policy-to-user` command. 3. The target identity receives `AliyunOTSFullAccess` rather than read-only permissions. 4. Alternatively, the administrator creates and later attaches the documented custom policy containing `ot ...[truncated 1405 chars]

Remediation

View remediation

\ --user-agent AlibabaCloud-Agent-Skills ``` 4. Prefer a minimal custom policy containing only the four actions required by this skill: ```json { "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "ots:GetInstance", "ots:ListInstance", "ots:ListTable", "ots:DescribeTable" ], "Resource": "acs:ots:*:*:instance/*" } ] } ``` 5. Further restrict the resource expression to the required regions, account, instances, and tables where Alibaba Cloud supports that granularity. 6. Add an explicit warning that full-access policies must not be used for this workflow. 7. Require administrators to inspect effective permissions after attachment and remove superseded broad policies. 8. Prefer temporary role sessions or STS credentials over long-lived AccessKeys. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The custom policy creation example includes ots:CreateInstance in documentation scoped to read-only operations. That silently expands permissions from inspection to resource creation, violating least privilege and creating a path for unauthorized infrastructure changes or abuse of cloud resources.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 76% confidence

Finding

The installation instructions require sudo mv aliyun /usr/local/bin/, which normalizes privileged execution of a freshly downloaded binary before any integrity verification steps are shown. If the download source, network path, or local environment is compromised, this can lead to privileged placement and later execution of malicious code.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify installation and version (must be 3.3.0+)
aliyun version

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest and documentation repeatedly frame the skill as covering only read/query operations, with no create, update, or delete actions. However, aliyun otsutil config changes persisted CLI configuration and aliyun otsutil use changes the active table context, so the implemented workflow is not purely read-only behavior even if it does not mutate remote Tablestore data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill includes sample output from aliyun otsutil config that displays credential-related fields, even if masked, without warning that the actual command output may expose sensitive material to a terminal transcript, logs, or chat capture. In an agent context where command output may be relayed back to users or stored, this increases the chance of inadvertent credential disclosure.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 358)May include surrounding context.

❌ WRONG

bash

# Assuming cn-hangzhou without asking user
aliyun otsutil list_instance -r cn-hangzhou

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide instructs users to download a remote archive and install a binary into a system PATH location with elevated privileges, which goes beyond the skill's stated read-only Tablestore querying purpose. Even if the CDN is official, this expands the trust boundary to remote software delivery and creates supply-chain and system-modification risk for a skill that should ideally focus on operating an already-installed CLI.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The instruction to run sudo mv aliyun /usr/local/bin/ requires elevated privileges to place a downloaded binary into a system-wide executable path. In the context of a read-only operations skill, asking for root-level file modification is broader than necessary and raises the impact of any mistake or supply-chain compromise.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 36)May include surrounding context.

md

tar -xzf aliyun-cli.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify version (MUST be 3.3.0 or later)
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This line repeats the use of sudo to install a downloaded CLI binary into a privileged system location. Elevated installation increases host modification risk and is not tightly aligned with the read-only operational scope of the skill.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 63)May include surrounding context.

md

tar -xzf aliyun-cli.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify version (MUST be 3.3.0 or later)
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This Linux ARM64 installation path also uses sudo for binary placement, carrying the same elevated-privilege and supply-chain implications as the other platform sections. Because the skill is framed as read-only cloud querying, requiring root-level local changes is an unnecessary risk amplifier.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 82)May include surrounding context.

md

tar -xzf aliyun-cli.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify version (MUST be 3.3.0 or later)
aliyun version

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document directs users to configure long-lived AccessKey credentials interactively, including AccessKey Secret entry, despite the skill being scoped to read-only Tablestore operations. This is dangerous because it normalizes handling of sensitive cloud credentials and encourages use of persistent secrets where safer temporary or role-based mechanisms would better fit the narrow task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide shows users entering long-lived AccessKey ID and AccessKey Secret interactively without any warning about credential sensitivity, rotation, logging exposure, or safer alternatives. In a cloud environment, this can train users into insecure secret-handling practices and increase the risk of credential theft or overprivileged access if the host or shell environment is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The troubleshooting section recommends uninstalling an existing package-manager version and replacing it with a manually downloaded binary using sudo, without prominent warning about system changes, provenance verification, rollback, or package-manager conflicts. This can lead users to overwrite trusted software management paths and increases the chance of unsafe binary replacement or operational breakage.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The troubleshooting flow again instructs users to move a freshly downloaded binary into /usr/local/bin with sudo, reinforcing unsafe privileged replacement behavior during remediation. Replacing binaries in a troubleshooting context is especially risky because users may act quickly without validating provenance or understanding package-manager consequences.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 230)May include surrounding context.

md

# Download latest from CDN
   curl -L -o aliyun-cli.tgz https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-universal.tgz
   tar -xzf aliyun-cli.tgz
   sudo mv aliyun /usr/local/bin/
   
   # Verify
   aliyun version  # Should show 3.3.0+

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Including a full-access attachment example at the point where users are told how to apply permissions is dangerous because readers commonly reuse commands verbatim. In the context of a read-only skill, this normalizes overprivileged IAM grants and increases the likelihood of accidental excessive access in production accounts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file is explicitly for Tablestore read-only operations, but the example command tells users to attach the managed policy AliyunOTSFullAccess, which grants ots:* on *. In a copy-paste workflow, this can cause users or automation to provision far broader privileges than intended, enabling write, delete, and administrative actions well beyond schema/instance inspection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The top-level documentation repeatedly frames the command set as 'Read-Only', but the same file includes config and use, which change local client state/configuration. This is an active contradiction in the documentation's characterization of the documented behavior, not merely an omission.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes the skill as 'Read-Only Operations' for querying Tablestore instances and tables, but this reference documents aliyun otsutil config, which changes local CLI configuration state rather than only querying remote resources. That is broader than a purely read-only querying scope, even though it does not modify Tablestore data itself.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation includes sample output fields for AccessKeyId and AccessKeySecret, even if partially masked, without an explicit warning about credential exposure. In agent-assisted or logged environments, users may copy, print, or persist real command output containing secrets, increasing the chance of credential leakage through logs, transcripts, screenshots, or saved files.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The desc command documentation explicitly supports -o, --output to save results to a local JSON file. While the remote Tablestore action is read-only, local file creation/modification exceeds a strict read-only interpretation in the manifest description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The verification guide instructs users to run credential and instance configuration commands even though the skill is presented as read-only query functionality. While otsutil config and credential setup do not directly modify Tablestore data, they expand the operational scope into authentication and environment configuration, increasing the chance that a higher-privilege context is introduced or mishandled.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Telling the user to create an instance if it does not exist exceeds the declared read-only scope and normalizes use of provisioning actions adjacent to a query-only skill. This can cause operators or downstream agents to perform infrastructure changes under the assumption they are still within a safe read-only workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The end-to-end workflow bundles read-only inspection with configuration and local file export steps, broadening the skill from pure querying into environment manipulation and data persistence. This increases the risk that a supposedly low-risk skill is granted or used with more privilege and capability than intended.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The security rules explicitly state that AccessKey values should never be echoed or printed. Later, the example response for aliyun otsutil config shows AccessKeyId and AccessKeySecret fields being printed, which contradicts that stated guidance even though the values are masked.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The sample interactive configuration includes Default Language [zh]: en, which directs the user toward a specific language setting rather than presenting it as an option. Under the policy, forcing or steering a locale without opt-in can be a natural-language policy concern unless the constraint is justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The guide tells users to run aliyun sts GetCallerIdentity, which invokes a separate identity service outside the stated Tablestore read-only operations scope. Identity verification is useful troubleshooting, but it is not part of the manifest's declared Tablestore querying purpose.

Content

No source excerpt is available for this finding.