Alibabacloud Tair Ai Assistant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:06 AM UTC
• Version: 0.0.1

Overview

The skill is a real Alibaba Cloud Tair diagnostics helper, but its install and setup instructions give it broader and riskier local/cloud authority than the diagnostic purpose requires.

Install only if you are comfortable with the Aliyun CLI and Alibaba Cloud credentials being used from this machine. Prefer a signed package manager or verified, pinned Aliyun CLI release; avoid curl-to-bash and unverified latest archives. Do not run broad plugin updates as part of this workflow, use a least-privileged RAM user or temporary credentials, avoid putting secrets in commands or prompts, and review/restore any global Aliyun CLI settings after use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:42

Finding

Mutable Remote Installer Is Piped Directly into Bash

Content

View full analysis

&2 ``` ### Technical Analysis The installation instruction downloads a shell script from an external URL and passes the response directly to Bash. The effective code being executed is therefore not contained in, versioned with, or reviewable from this Skill package. HTTPS protects the connection in transit under normal conditions, but it does not provide artifact-level integrity, version pinning, or protection against compromise of the upstream server, CDN, publishing account, or DNS/TLS infrastructure. The remote response can also change after the Skill has been audited. This behavior is not required for the core diagnostic operation. Aliyun CLI could instead be installed from a trusted package manager or from a version-pinned artifact whose signature or checksum is verified before execution. ### Attack Path 1. An attacker compromises the upstream installer, CDN, publishing process, or another component capable of changing the response from `aliyuncli.alicdn.com`. 2. A user or automation agent follows the Skill's installation instruction. 3. `curl` retrieves the attacker-controlled response. 4. The pipe supplies the response directly to Bash without saving, reviewing, or verifying it. 5. Bash executes the payload with the privileges of the invoking user. 6. If the user invoked the workflow with elevated privileges, the payload inherits those elevated privileges. ### Impact Assessment Successful exploitation permits arbitrary local command execution. Dep ...[truncated 299 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:38

Finding

Automatic and Unpinned Plugin Installation Expands Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/cli-installation-guide.md:41

Finding

Unverified Mutable CLI Archives Are Installed into a Privileged Executable Path

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:103

Finding

Long-Lived Cloud Credentials Are Entered Through Command-Line Arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` The guide also uses the same command-line pattern for STS and role-assumption configurations: ```bash aliyun configure set \ --mode StsToken \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --sts-token v1.0:XXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` The values shown are placeholders rather than actual committed credentials. The vulnerability arises when users replace them with real secrets and execute the documented commands. ### Technical Analysis Command-line arguments can be retained in interactive shell history, copied into terminal transcripts, captured by CI/CD logs, recorded by agent orchestration systems, or exposed through process inspection facilities while a command is running. The instructions encourage users to place both long-lived access-key secrets and temporary security tokens directly in the command line. This is avoidable because the declared workflow supports OAuth, ECS RAM roles, named profiles, and other credential-provider mechanisms. The executable Skill script itself does not parse `~/.alibabacloud/credentials` or hardcode credentials. The reference to that path in `references/acceptance-criteria.md:207` is explicitly a prohibited example, not implemented access. ### Attack Path 1. A user substitutes a real access key, secret, or STS token into the documented command. 2. The command is stored in shell history, term ...[truncated 886 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (25)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Piping a remotely fetched installer directly into bash allows arbitrary code from the remote endpoint or any compromised distribution path to execute immediately on the host. In this skill context, the danger is elevated because the installation step is presented as a prerequisite, increasing the likelihood that users will run it without independent verification.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

bash

# Install aliyun CLI
curl -fsSL https://aliyuncli.alicdn.com/install.sh | bash
aliyun version  # Verify >= 3.3.1

# Enable automatic plugin installation

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The command chains network retrieval directly into code execution via '| bash', removing any inspection boundary and making compromise of the download source immediately exploitable. This is especially risky in a skill document because it normalizes a dangerous pattern as standard setup procedure.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

bash

# Install aliyun CLI
curl -fsSL https://aliyuncli.alicdn.com/install.sh | bash
aliyun version  # Verify >= 3.3.1

# Enable automatic plugin installation

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 206)May include surrounding context.

Error: Using Python SDK to manage credentials

from alibabacloud_das20200116.client import Client as DAS20200116Client

Error: Parsing credentials from .env file

Error: Parsing credentials from ~/.alibabacloud/credentials

text

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · scripts/call_yaochi_agent.sh (reported line 43)May include surrounding context.

sh

Options:
  --session-id <id>    Session ID for multi-turn conversation
  --profile <name>     Specify aliyun CLI profile
  --debug, -d          Enable debug mode
  --help, -h           Show help information

Examples:

External Script Fetching

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The script instructs users to install a dependency using 'curl ... | bash', which executes remote script content directly without verification. If the distribution endpoint, DNS, TLS trust chain, or mirror is compromised, users could run attacker-controlled code on their systems. In an admin-focused cloud skill, this is more dangerous because likely users have privileged cloud access configured locally.

Content

Scanner excerpt · scripts/call_yaochi_agent.sh (reported line 63)May include surrounding context.

sh

check_dependencies() {
    if ! command -v aliyun &>/dev/null; then
        echo "Error: aliyun CLI not found, please install (>= 3.3.1)" >&2
        echo "Install: curl -fsSL https://aliyuncli.alicdn.com/install.sh | bash" >&2
        echo "See: references/cli-installation-guide.md" >&2
        exit 1
    fi

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents shell-based execution paths but does not declare any explicit tool scope or allowed-tools boundary. That makes its effective capabilities broader and less auditable, increasing the chance that an agent runtime may permit command execution without clear least-privilege constraints.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

macOS:

brew install jq

Ubuntu/Debian:

sudo apt-get install jq

text

## Parameter Confirmation

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

macOS:

brew install jq

Ubuntu/Debian:

sudo apt-get install jq

text

## Parameter Confirmation

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Although the skill presents itself as query/diagnostics-only, it instructs the user to change global CLI state by enabling AI mode and setting a user agent, then later disabling it. Global state changes can affect other sessions, workflows, or accounts on the same machine and violate user expectations about the skill being non-mutating.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This document substantially expands the skill from a Tair/Redis-focused assistant into a general Alibaba Cloud CLI onboarding guide, including broad account configuration and multi-service usage. In an agent skill, that scope expansion increases the chance the agent will request or act on powerful cloud credentials unrelated to the declared purpose, enlarging the attack surface and enabling unintended operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Advertising support for installing and using all published Alibaba Cloud product plugins grants unjustified breadth beyond the assistant's stated Tair/Redis purpose. In a skill context, this can normalize arbitrary plugin enablement and make it easier for downstream prompts or operators to extend the agent into unrelated, potentially sensitive cloud operations.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/call_yaochi_agent.sh (reported line 72)May include surrounding context.

sh

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/call_yaochi_agent.sh (reported line 73)May include surrounding context.

sh

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The guide instructs users to create long-lived AccessKey pairs and then demonstrates storing them in CLI configuration, which can lead to persistent credentials on disk for a broadly scoped cloud account. In the context of a Tair-focused assistant, encouraging durable account secrets instead of preferring temporary credentials or instance roles increases compromise impact if the workstation, repository, or agent environment is exposed.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The verification and debugging sections use ECS administration commands as the operational example instead of Tair-specific commands. That encourages validation of broad cloud account access and may cause users or agents to test credentials against unrelated services, confirming privilege and facilitating misuse beyond the intended Redis assistant scope.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The verification procedure instructs operators to invoke a live networked agent and Alibaba Cloud APIs using the currently configured credentials, but it does not warn that prompts, metadata, instance identifiers, and possibly diagnostic output will be transmitted off-host. The debug workflow and multi-turn session handling also increase the chance of exposing sensitive operational context in stderr, logs, shell history, or support artifacts during verification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script prints the full user query to stderr before sending it to Alibaba Cloud. Queries in this skill are likely to contain instance IDs, operational details, and potentially sensitive troubleshooting context, so echoing them without masking or opt-in can leak data into terminal logs, CI logs, shell history captures, or monitoring systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script transmits arbitrary user queries and account-context-derived requests to a remote Alibaba Cloud endpoint, but it provides no explicit privacy notice or confirmation step. In the Tair/Redis administration context, prompts may include production topology, instance IDs, memory usage details, or incident data, increasing the sensitivity of what is sent off-host.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The cleanup section characterizes the skill as only query/diagnostics oriented, yet earlier instructions require enabling auto-plugin install, installing a DAS plugin, updating plugins, and toggling AI-Mode. While these actions do not create Tair resources, they do have side effects on the host CLI environment, which contradicts the broader impression of a side-effect-free diagnostic skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The sample configuration sets "language": "en", which can be interpreted as prescribing a specific language/locale. Under the policy, forcing a language without opt-in is a natural-language policy concern unless the document offers a choice or justifies the constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The reference links to https://help.aliyun.com/zh/cli/, which directs users to a specific locale. Because the document does not mention that this is the Chinese version or offer an alternative locale, it may violate the language-choice policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.