Alibabacloud Terraform Import

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 0.0.1

Overview

This is a coherent Alibaba Cloud Terraform import helper, but it needs review because it can install a privileged CLI binary and alter Terraform state with incomplete safeguards.

Install only if you are comfortable giving the workflow Alibaba Cloud read access and local Terraform state authority. Review every command before execution, avoid the curl/tar/sudo installer unless you verify the official binary, use least-privilege RAM credentials, keep generated .import, tfstate, and plan files out of source control, and require manual confirmation before any terraform state rm, force-unlock, apply, cron, or CI setup.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:53

Finding

Unverified Privileged Installation of a Mutable Remote Binary

Content

View full analysis

Remediation

View remediation

-linux-amd64.tgz" echo " $tmp_dir/aliyun-cli.tgz" | sha256sum --check - tar -tzf "$tmp_dir/aliyun-cli.tgz" tar -xzf "$tmp_dir/aliyun-cli.tgz" -C "$tmp_dir" sudo install -m 0755 "$tmp_dir/aliyun" /usr/local/bin/aliyun ``` The URL, pinned version, and checksum must come from the official Alibaba Cloud release channel. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:351

Finding

Plaintext Duplication of Potentially Sensitive Terraform State

Content

View full analysis

.import/tf_state.json 2>&1 ``` Related backup instructions: ```bash # Manually pull remote state terraform state pull > backup.tfstate ``` ```bash # Or use terraform state pull terraform state pull > backup_$(date +%Y%m%d_%H%M%S).tfstate ``` ### Technical Analysis Terraform state and plan representations can contain a complete infrastructure inventory, private addresses, resource identifiers, configuration values, and secret material stored by providers. Marking a Terraform value as sensitive generally controls display behavior; it does not guarantee that the underlying value is absent from state. The Skill creates additional plaintext state copies without requiring restrictive file permissions, encryption, cleanup, or version-control exclusions. The `.import/tf_state.json` artifact is placed under the Terraform working directory, increasing the likelihood that it will be archived or accidentally committed. The command also redirects standard error into the JSON output through `2>&1`. Any diagnostic output can corrupt the JSON file, potentially causing downstream parsing failures while still leaving a partial sensitive artifact on disk. ### Attack Path 1. The Skill runs `terraform show -json` or the user follows a `terraform state pull` backup instruction. 2. Terraform writes sensitive state content to `.import/tf_state.json` or a plaintext backup file. 3. The file inherits permissions based on the user's current `umask`, with no explicit enforcement of owner-only access. 4. The artifact remains in the working directory after processing. 5. Another local user, a backup process, a CI artifact collector, or a source-control operatio ...[truncated 731 chars]

Remediation

View remediation

state-export.err | python3 extract-dependencies.py ``` 2. If a file is required, create it in a securely allocated temporary directory: ```bash umask 077 tmp_dir="$(mktemp -d)" trap 'rm -rf "$tmp_dir"' EXIT terraform show -json > "$tmp_dir/tf_state.json" ``` 3. Keep standard error separate from JSON output. 4. Explicitly set generated state and backup files to mode `0600`. 5. Encrypt retained state backups using an approved key-management mechanism. 6. Define and document a retention and secure-deletion policy. 7. Add the following patterns, as appropriate, to `.gitignore` and CI artifact exclusions: ```gitignore .import/ *.tfstate *.tfstate.* *.tfplan drift.tfplan ``` 8. Warn users that Terraform state may contain secrets even when HCL variables are marked `sensitive`. 9. For remote state, use an encrypted backend with tightly scoped access control, locking, audit logging, and versioning. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/incremental-sync.md:206

Finding

Predictable Sensitive Terraform Plan File in Shared Temporary Storage

Content

View full analysis

&1 PLAN_EXIT=$? ``` ### Technical Analysis The incremental-sync script writes the Terraform plan to a fixed, predictable path under the shared `/tmp` directory. Terraform plans can contain sensitive infrastructure values and detailed resource configuration. The script does not securely allocate the destination, enforce restrictive permissions, detect pre-existing filesystem objects, or remove the plan after use. A fixed path also causes collisions between concurrent executions or different users. Depending on operating-system and Terraform file-opening behavior, an attacker with local access may be able to anticipate or interfere with the path. At minimum, the plan remains as a residual sensitive artifact after the script finishes. This risk is amplified if the optional cron recommendation is adopted because the attacker can predict both the filename and approximate execution time. ### Attack Path 1. A local attacker observes that the incremental-sync workflow uses `/tmp/drift.tfplan`. 2. The attacker waits for or predicts a manual or scheduled drift check. 3. Terraform writes the plan to the known path, or interacts unsafely with a pre-existing object at that path depending on platform behavior. 4. The attacker reads the residual plan, interferes with its location, or exploits a collision between executions. 5. Sensitive infrastructure data is disclosed, or the drift-check workflow is disrupted. ### Impact Assessment The primary impact is confidentiality loss involving resources represented in the generated plan. Exposed data may include resource identifiers, network topology, configuration values, and provider-man ...[truncated 353 chars]

Remediation

View remediation

&2 exit "$plan_exit" fi ``` If the plan must be retained, move it to an access-controlled encrypted storage location and apply a defined retention period. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (18)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The chained command combines network download, archive extraction, and a privileged move into a single shell line, which reduces user visibility into each step and makes it easier to execute unsafe content end-to-end. This is especially dangerous in an agent context because failures or compromise in the earlier stages can immediately propagate into a privileged installation action.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

Automatically handle missing tools based on output:
- aliyun CLI missing (macOS): Run `brew install aliyun-cli`
- aliyun CLI missing (Linux): Run `curl -sSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz && sudo mv aliyun /usr/local/bin/`
- terraform missing (macOS): Run `brew tap hashicorp/tap && brew install hashicorp/tap/terraform`
- terraform missing (Linux): Direct user to https://developer.hashicorp.com/terraform/install for manual installation (requires root)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The incremental sync flow instructs removing Terraform state entries when cloud resources are not found, but does not require a destructive-operation warning or explicit confirmation. Incorrect detection, transient API errors, region mismatch, or permission issues could cause the agent to remove valid state bindings, leading to drift, accidental recreation, or loss of management over production infrastructure.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 407)May include surrounding context.

md

For detailed incremental sync procedures, refer to `references/incremental-sync.md`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 419)May include surrounding context.

md

For detailed incremental sync procedures, refer to `references/incremental-sync.md`.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The skill advertises automatic execution of environment checks, discovery, HCL generation, and state import, with user confirmation only at key points. In a high-impact infrastructure management context, broad autonomy increases the chance that sensitive operations are performed without granular review, amplifying the risk of unintended writes, imports, and configuration changes.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

# Alibaba Cloud Resource Terraform Import Wizard

Step-by-step guide to import existing resources under an Alibaba Cloud account into local Terraform management. Automatically performs environment checks, resource discovery, HCL generation, state import, etc. Users only need to confirm at key decision points.

Two modes are supported:
- **One-time migration**: Complete Phase 1-9 end to end

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs automatic installation and execution of shell commands that modify the host system, including downloading a binary over the network and moving it into /usr/local/bin, without requiring an explicit warning or approval step. In an agent setting, this increases the risk of unreviewed system modification and supply-chain exposure, especially because the workflow is described as automatic rather than user-driven.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill includes a command that uses sudo to place a downloaded binary into a privileged system path, which elevates the consequences of any installation mistake or supply-chain compromise. In an agent workflow, normalizing privileged execution without a strong warning and explicit approval can lead to unauthorized system changes or execution of untrusted code as root.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

Automatically handle missing tools based on output:
- aliyun CLI missing (macOS): Run `brew install aliyun-cli`
- aliyun CLI missing (Linux): Run `curl -sSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz && sudo mv aliyun /usr/local/bin/`
- terraform missing (macOS): Run `brew tap hashicorp/tap && brew install hashicorp/tap/terraform`
- terraform missing (Linux): Direct user to https://developer.hashicorp.com/terraform/install for manual installation (requires root)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill requires enabling aliyun CLI AI-Mode and setting a custom User-Agent before any CLI use, but does not disclose what metadata may be transmitted or obtain user consent. This creates a privacy and governance risk because session characteristics and tool usage context may be shared externally without the user's informed approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The workflow directs the agent to generate provider files, intermediate artifacts, HCL, ID mappings, and other import data on local disk, which can contain sensitive infrastructure identifiers and configuration details. Without a warning about local persistence and file permissions, users may unintentionally expose account topology, resource IDs, and potentially sensitive Terraform inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file provides a broad catalog of resource-discovery commands spanning networking, compute, storage, databases, DNS, RAM, KMS, and container services, but it does not clearly warn that command output can expose sensitive infrastructure topology, account inventory, IAM relationships, security group rules, IP allowlists, and encryption key metadata. In a Terraform import skill, this increases the chance that an agent or user will over-collect and display sensitive cloud-environment details during discovery, especially when outputs are copied into chat logs, artifacts, or generated files.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/incremental-sync.md (reported line 253)May include surrounding context.

bash

# Check every Monday at 9am
# Add to crontab (crontab -e):
# 0 9 * * 1 cd /path/to/terraform && bash incremental-sync.sh >> /var/log/tf-sync.log 2>&1

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The GitHub Actions example instructs users to place Alibaba Cloud access keys into CI secrets and run terraform init and terraform plan against real infrastructure, but it does not warn about secret scope, least-privilege, log exposure, PR/fork risks, or the fact that plan/refresh performs live cloud reads. In the context of an infrastructure-import skill, this can lead users to overexpose credentials or unknowingly grant CI broad read access to production environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/resource-hub-api.md (reported line 5)May include surrounding context.

md

Four APIs form the complete resource discovery and relationship building pipeline, with native product APIs as fallback.

API documentation entry: `https://api.aliyun.com/api/ResourceCenter/2022-12-01/`

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation presents terraform force-unlock <lock-id> as a standard operation without an immediate, prominent warning that using it while another Terraform process is still active can lead to concurrent state modification and state corruption. In a skill focused on importing and managing existing Alibaba Cloud resources with Terraform, users are likely to follow operational snippets directly, which makes under-warning this command materially risky.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file is for an Alibaba Cloud Terraform import/migration skill, but it embeds full resource creation templates for VPCs, ECS, EIP, NAT, OSS, RDS, SLB, and DNS. In this context, that expands the skill from state import assistance into provisioning guidance, increasing the chance that an agent or user creates or modifies infrastructure unintentionally during a migration workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples include ingress from 0.0.0.0/0 and internet-exposed constructs such as EIPs without an explicit exposure warning or least-privilege defaults. In a migration/import skill, users may treat templates as authoritative and reproduce publicly reachable services or permissive network rules, expanding attack surface immediately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guidance recommends broad use of lifecycle.ignore_changes for operational and sensitive fields without warning that this can suppress legitimate drift, configuration errors, or unauthorized infrastructure changes. In an import/sync skill, users may adopt these snippets to force a clean plan, masking real discrepancies that should be investigated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The file imposes a strict command-format policy as a universal requirement, which functions as a language/style constraint without offering user choice. Although technically motivated, the wording is absolute and does not provide opt-in or context-sensitive flexibility.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/terraform-patterns.md:150