Security audit

Alibabacloud Waf Checkresponse Intercept Query

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly aligned with Alibaba Cloud WAF troubleshooting, but it asks for persistent CLI plugin changes and contains ambiguous instructions for changing WAF security settings.

Install only if you are comfortable letting an agent use Alibaba Cloud credentials for WAF/SLS investigation and potentially changing WAF logging or rule status. Prefer read-only RAM permissions first, avoid granting rule/log modification rights unless needed, and do not enable global Aliyun auto-plugin installation or update all plugins without separate review.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:17
Finding: Mandatory Automatic Plugin Installation and Unpinned Global Updates
Content: View full analysis
[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ``` ### Technical Analysis The Skill requires the Agent to enable automatic plugin installation globally and update all existing Aliyun CLI plugins. It does not identify the exact plugin versions required, pin audited versions, verify package integrity, or restrict the update to components needed for WAF diagnosis. This creates a mutable dependency boundary: code executed by later Aliyun CLI invocations may differ from the code present when the Skill was audited. Updating every installed plugin also affects unrelated cloud workflows and exceeds the minimum changes necessary for querying WAF logs. Because the Skill uses the Alibaba Cloud default credential chain, a malicious or compromised plugin could execute under the local user account while cloud credentials or instance-role permissions are available. ### Attack Path 1. A user or Agent loads the Skill and follows its mandatory prerequisites. 2. The Agent runs `aliyun configure set --auto-plugin-install true`, persistently enabling automatic plugin installation. 3. The Agent runs `aliyun plugin update`, retrieving mutable plugin code from the configured package source. 4. A compromised upstream release, repository, distribution channel, or plugin account supplies malicious plugin code. 5. A subsequent `aliyun` invocation loads or executes that plugin. 6. The plugin runs with the local user's privileges and may access the Aliyun CLI process environment, local configuration, or permissions available through the default Alibaba Cloud ...[truncated 591 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/rule-operations.md:5
Finding: Contradictory Rule-Operation Policy Permits Unintended WAF Configuration Changes
Content: View full analysis
**Note**: `modify-defense-rule` requires passing the complete rule configuration with complex parameters. It is recommended to use `modify-defense-rule-status` first. ``` ...[truncated 3309 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The implemented code largely matches the investigative portion of the description: it retrieves WAF-related logs from SLS, looks up the triggering rule ID, and fetches rule details for analysis. However, the description claims broader operational capabilities—specifically disabling problematic rules and managing WAF log collection settings—which are absent from this code chunk. The script is read-only: it calls aliyun sls get-logs and aliyun waf-openapi describe-defense-rule, both query operations. There are no API calls to update, disable, create, or manage WAF rules or log configuration. Also, while the description says it provides remediation guidance, the code only outputs analysis details and very limited generic suggestions if no logs are found. Thus the description overstates the actual capabilities of this code.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/get_waf_logs.py (reported line 369)May include surrounding context.
python
if key in parsed: print(f" {key}: {parsed[key]}") # Query and display rule details rule_id = log.get('final_rule_id') if rule_id and instance_id and region: print("\nRule Details:")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes powerful shell/CLI operations against Alibaba Cloud but declares no explicit tool scope or permission boundaries. In an agent environment, this increases the chance of unintended command execution or overbroad access because reviewers and runtime policy systems cannot easily constrain what the skill is allowed to do.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description does not prominently warn that the skill may enable WAF log collection and disable security rules, both of which materially affect security posture and data collection. Users may invoke the skill expecting passive diagnosis, but the documented workflow includes write operations that can reduce protection or expand logging without an upfront risk notice.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list includes broad phrases like 'request blocked' and '405 troubleshooting' that may match ordinary support conversations and invoke a skill capable of cloud-side investigation and state changes. Overbroad invocation increases the risk of accidental execution, unnecessary credential use, or prompting users into enabling logs or disabling protections in the wrong context.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/get_waf_logs.py (reported line 167)May include surrounding context.
python
] try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=60) if result.returncode == 0: try:

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/get_waf_logs.py (reported line 241)May include surrounding context.
python
] try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=30) if result.returncode == 0: try: