Alibabacloud Waf Cname Config Export

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:03 AM UTC
• Version: 0.0.1

Overview

The skill performs a coherent WAF configuration export, but its install and credential guidance creates avoidable security risk around cloud credentials and system-wide CLI installation.

Install only if you are comfortable reviewing and hardening the setup steps yourself. Use an already trusted Aliyun CLI installation, avoid curl-to-bash and unverified latest binaries, do not paste real access keys into commands or the agent session, prefer short-lived or role-based read-only credentials, and store the generated Excel file as sensitive infrastructure data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/alibabacloud_waf_cname_config_export.py:36

Finding

Mutable Remote Installation Script Is Piped Directly to Bash

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:39

Finding

Unverified Mutable CLI Binaries Are Installed into a System-Wide Executable Path

Content

View full analysis

Remediation

View remediation

aliyun-cli-linux-amd64-vX.Y.Z.tgz" | sha256sum --check - ``` 4. Extract into a newly created directory with restrictive permissions and inspect the archive file list before installation. 5. Prefer a trusted package manager that validates signed repository metadata. 6. Avoid installing directly into a privileged system path unless necessary. If system-wide installation is required, elevate only the final verified file-placement step. 7. Verify the installed binary against the expected digest after copying it. 8. Document the exact source URL, version, checksum, signing identity, and verification failure behavior. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:103

Finding

Documentation Encourages Passing Cloud Credentials Through Command-Line Arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` The guide also supplies analogous command-line examples for STS tokens, multiple named profiles, role assumption, key rotation, and token renewal. ### Technical Analysis Users are expected to replace the placeholders with actual access keys and secrets. Supplying credentials in command-line arguments can expose them through: - Shell history files. - Process listings and process-monitoring tools. - Terminal recording and session capture. - CI/CD logs and command tracing. - Agent transcripts or automation logs. - Error-reporting and observability systems that record executed commands. This guidance conflicts with the primary security rules in `SKILL.md:48-51`, which state that the Agent must never ask users to input access keys directly or use `aliyun configure set` with literal credential values. A user following the referenced guide can therefore bypass the safer behavior required by the main Skill instructions. The strings shown in the examples are placeholders rather than confirmed live credentials. The risk occurs when users substitute real values as instructed. ### Attack Path 1. A user follows the configuration guide. 2. The user substitutes an actual access-key ID, secret, or STS token into the command. 3. The command is stored in shell history, captured in an Agent transcript, logged by CI/CD, or observed through local process inspection. 4. An actor with access to the relevant history, logs, monitoring interface, or hos ...[truncated 696 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (19)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The script prints a one-line command that pipes a remotely fetched script directly into bash to install the CLI. Although not executed automatically, recommending curl | bash encourages unsafe supply-chain behavior: a compromised host, CDN, DNS path, or installer endpoint could lead to arbitrary code execution on the operator's machine.

Content

Scanner excerpt · scripts/alibabacloud_waf_cname_config_export.py (reported line 36)May include surrounding context.

python

try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
    except FileNotFoundError:
        print("  [Error] `aliyun` CLI not found. Install via: curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash")
        sys.exit(1)
    except subprocess.TimeoutExpired:
        print(f"  [Error] CLI command timed out after {timeout}s: {' '.join(args[:3])}...")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes shell/CLI commands extensively but does not declare any tool scope such as allowed-tools or permissions. That omission weakens execution boundaries and reviewability, making it easier for an agent runtime to grant broader shell access than the skill function actually requires. In a skill that reads cloud configuration and writes files, missing scope increases the blast radius of misuse or prompt-injection-induced command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill exports WAF domain, backend, certificate, and routing details into an Excel file but does not warn that the artifact contains sensitive infrastructure configuration. This increases the risk of accidental disclosure through insecure storage, email sharing, synced folders, or retention on multi-user systems. In this context, the exported data can materially aid reconnaissance of protected applications and backend topology.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill hard-codes a two-locale operating model centered on Chinese mainland and non-Chinese mainland regions, and later mandates querying both regardless of user intent. This imposes a locale-specific workflow rather than offering an opt-in choice or clearly scoping the skill as a region-specific compliance tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill mandates enabling Alibaba Cloud CLI AI-mode and setting a custom user-agent even though the export workflow only needs standard read-only API calls and local file generation. Requiring an unnecessary privileged or agent-integrated mode expands the attack surface, may alter how commands are processed or logged, and can create unintended data exposure channels during a task involving sensitive WAF configuration.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide recommends non-interactive use of aliyun configure set with --access-key-secret on the command line, which exposes secrets to shell history, process listings, terminal logging, and CI job logs. In an agent/automation skill, this is more dangerous because users may copy-paste the example directly into scripts or orchestrated runs where plaintext credentials are captured persistently.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document shows plaintext credentials in both config-file JSON and environment-variable examples without prominently warning that these values are sensitive and may leak through source control, support bundles, screenshots, crash dumps, or inherited process environments. Although the values are placeholders, the pattern normalizes insecure secret handling and can lead operators to store real keys in recoverable plaintext locations.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/alibabacloud_waf_cname_config_export.py (reported line 34)May include surrounding context.

python

if cli_profile:
        cmd.extend(["--profile", cli_profile])
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
    except FileNotFoundError:
        print("  [Error] `aliyun` CLI not found. Install via: curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash")
        sys.exit(1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script writes detailed WAF configuration data, including domains, backends, ports, certificate identifiers, and resource-group metadata, to a local Excel file without warning or protections. In a security-admin context this data is sensitive infrastructure inventory and can materially aid reconnaissance if the file is stored insecurely or shared inadvertently.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill's stated workflow includes generating an Excel export file, which is a filesystem side effect. Saying 'No resources created — no cleanup needed' contradicts that behavior because the run does create an output artifact that may need user awareness or optional cleanup.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The verification instructions prescribe sheet names as "Chinese Mainland" and "Non-Chinese Mainland," which imposes a specific geographic/locale categorization in the skill's natural-language interface. The file does not offer alternative locale wording or explain why this terminology is required for a region-specific compliance context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

When no domains exist, the script still performs an unnecessary describe-domain-detail API call solely as a probe. This exceeds the documented export-only behavior and creates unexpected API activity that can confuse audits, trigger alerts, or violate least-privilege expectations in tightly controlled environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The inline comment claims the extra probe is required by SKILL.md, but that behavior is not consistent with the script's stated purpose. Misleading justification around unnecessary API calls is risky because it can normalize hidden side effects and make reviewers less likely to question unexpected behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.