Alibabacloud Waf Config Backup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:44 AM UTC
• Version: 0.0.1

Overview

This skill has a coherent WAF backup purpose, but its installer guidance and bundled script create serious local execution, dependency, and sensitive-data handling risks.

Review before installing. Do not let an agent run the curl-to-bash installer, unverified latest CLI archives, sudo install steps, or automatic plugin updates in a normal workstation or shared cloud-admin environment. Use only least-privilege read-only WAF credentials, configure secrets outside agent logs, treat generated workbooks as sensitive security backups, and prefer a fixed version that removes shell=True command execution and escapes Excel formula-like cell values.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:93

Finding

Unverified Remote Installer Executed Directly Through Bash

Content

View full analysis

= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see [references/cli-installation-guide.md](references/cli-installation-guide.md). ``` ### Technical Analysis The command passes the HTTP response body directly to Bash. The downloaded script is not pinned to a reviewed version and is not checked against a cryptographic checksum or signature before execution. Although the URL uses HTTPS and appears associated with Alibaba Cloud, transport encryption alone does not establish that the retrieved script is identical to the version reviewed with this Skill. The effective executable payload can change after publication of the Skill. Compromise of the CDN, origin server, DNS path, certificate infrastructure, or release process could therefore turn this installation command into arbitrary code execution. Executing the response as it streams also prevents meaningful inspection before execution. This behavior is not required for the declared read-only WAF export functionality. ### Attack Path 1. An attacker compromises or gains influence over the remote installer, hosting infrastructure, or delivery path. 2. The Agent follows the Skill instruction because Aliyun CLI is absent or outdated. 3. `curl` retrieves the attacker-controlled response. 4. Bash immediately interprets the response as shell code. 5. The payload executes with the privileges and environment of the user running the Agent. 6. The payload can inspect local files, steal cloud credentials, modify tools, or establish persistence before the backup begins. ### Impact Assessment Successful exploitation provides arbitrary local command execution wit ...[truncated 317 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/export_waf_config_backup.py:413

Finding

OS Command Injection Through Shell-Based Aliyun CLI Invocation

Content

View full analysis

OwnerUid mapping (max 100 per call).""" if not resource_names: return {} mapping = {} batch_size = 100 unique_names = list(dict.fromkeys(n for n in resource_names if n)) for i in range(0, len(unique_names), batch_size): batch = unique_names[i:i + batch_size] names_arg = ",".join(batch) cmd = (f"aliyun waf-openapi describe-defense-resource-owner-uid " f"--region {region_id} --instance-id {instance_id} " f"--resource-names \"{names_arg}\"") data = run_cli(cmd, profile) ``` ```python def fetch_domain_detail(region_id, instance_id, domain, profile): """Fetch single domain detail.""" cmd = f"aliyun waf-openapi describe-domain-detail --region {region_id} --instance-id {instance_id} --domain {domain}" data = run_cli(cmd, profile) time.sleep(API_DELAY) return data ``` ### Technical Analysis `subprocess.run(..., shell=True)` sends the assembled string to a command shell. The `profile` value is supplied directly through the `--profile` command-line argumen ...[truncated 2023 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/export_waf_config_backup.py:1325

Finding

Spreadsheet Formula Injection Through Cloud-Controlled Cell Values

Content

View full analysis

31: sheet_name = sheet_name[:31] ws = wb.create_sheet(sheet_name) write_header(ws, L["headers"]["rules"]) flat_rows = [] for ds in DEFENSE_SCENES: scene_name = ds["scene"] scene_label = L["scene_labels"].get(scene_name, scene_name) for r in scene_rules_map.get(scene_name, []) or []: flat_rows.append((scene_name, scene_label, r)) if not flat_rows: write_empty_placeholder(ws) auto_width(ws) ws.freeze_panes = "A2" return for row_idx, (scene_name, scene_label, r) in enumerate(flat_rows, 2): tid = r.get("TemplateId", "") ws.cell(row=row_idx, column=1, value=scene_label) ws.cell(row=row_idx, column=2, value=r.get("RuleId", "")) ws.cell(row=row_idx, column=3, value=r.get("RuleName", "")) ws.cell(row=row_idx, column=4, value=get_rule_purpose(r.get("RuleName", ""), scene_name, lang)) ws.cell(row=row_idx, column=5, value=tid) ws.cell(row=row_idx, column=6, value=fmt_status(r.get("Status", ""), L)) ws.cell(row=row_idx, column=7, value=fmt_origin(r.get("DefenseOrigin", ""), L)) ws.cell(row=row_idx, column=8, value=fmt_epoch_ms(r.get("GmtModified", ""))) config = r.get("Config", "") config_str = config if isinstance(config, dict): config_str = json.dumps(config, ensure_ascii=False) action, conditions = parse_rule_config(config, scene_name) ws.cell(row ...[truncated 2399 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:102

Finding

Mandatory Automatic Installation and Updating of Unpinned Dependencies

Content

View full analysis

[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ```bash aliyun configure set --auto-plugin-install true aliyun plugin update ``` Python dependency: ```bash pip install "openpyxl>=3.1.2" ``` ``` ### Technical Analysis The Skill requires automatic plugin installation and unconditional plugin updates. It also permits any future `openpyxl` version satisfying a lower-bound-only constraint. The actual code executed during a later Skill invocation may therefore differ from the components reviewed during this audit. Automatic plugin installation broadens the execution surface and can retrieve components when commands are first used. Unconditional updating also replaces previously reviewed plugins without an explicit need for the backup operation. The Python dependency specification lacks an exact version and integrity hash. ### Attack Path 1. An upstream package repository, plugin repository, maintainer account, or distribution path is compromised. 2. A malicious or unexpectedly altered dependency version becomes the latest eligible release. 3. The Agent follows the mandatory update or installation instructions. 4. The altered package or plugin is downloaded and installed. 5. Installation-time or runtime code executes in the authenticated backup environment. 6. The malicious component can access cloud credentials, API responses, and generated workbooks. ### Impact Assessment Impact depends on the privileges of the installation environment. A compromised dependency could execute arbitrary code as the invoking user, access Aliyun CLI credentials, alter ...[truncated 207 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:39

Finding

Downloaded CLI Archives Installed Without Cryptographic Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:101

Finding

Documentation Encourages Cloud Secrets in Command-Line Arguments

Content

View full analysis

\ --access-key-secret \ --region cn-hangzhou ``` All `aliyun configure` commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts. ``` The guide also provides literal command-line secret patterns: ```bash aliyun configure set \ --mode StsToken \ --access-key-id LTAI5tXXXXXXXX \ --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \ --sts-token v1.0:XXXXXXXXXXXXXXXX \ --region cn-hangzhou ``` ### Technical Analysis Passing access-key secrets and STS tokens as command-line arguments can expose them through shell history, process listings, terminal recording, debugging output, CI logs, or Agent execution traces. Recommending this approach for scripts, CI/CD, and Agent-driven automation increases the likelihood that credential-bearing commands will be persisted in logs. This guidance conflicts with the safer instructions in `SKILL.md`, which prohibit asking users to place literal AK/SK values in conversation or commands. ### Attack Path 1. A user follows the guide and substitutes real access keys or an STS token into the command. 2. The shell records the command in history, or automation records it in a build or Agent log. 3. During execution, another local process may also inspect the command-line arguments where the operating system permits it. 4. An attacker or unauthorized log reader obtains the retained secret. 5. The attacker authenticates to Alibaba Cloud with the exposed identity until the credential is ...[truncated 664 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (19)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill recommends piping a remote script directly into bash (curl ... | bash) to install or update the CLI. This creates a supply-chain and remote-code-execution risk: if the remote content, transport, mirror, or DNS path is compromised, the agent could immediately execute attacker-controlled code on the host.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low, run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to install/update, or see references/cli-installation-guide.md.

bash

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The acceptance criteria explicitly endorses subprocess.run(cmd, shell=True, ...) with a string command, which is a command-injection sink if any part of cmd is derived from user input, filenames, regions, instance IDs, or other runtime data. In this skill’s context, the script builds and executes cloud-management CLI commands and may also consume user-provided paths such as baselines, making shell invocation more dangerous because successful injection could execute arbitrary OS commands under the operator’s privileges and expose cloud credentials or alter backup outputs.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 123)May include surrounding context.

md

import subprocess, json

def run_cli(cmd):
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    if result.returncode != 0:
        return None
    return json.loads(result.stdout)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This is the same core issue as AST4 in a tool-execution context: the script lets dynamic parameters flow into a shell command executed by subprocess.run with shell=True. In this skill, many values are sourced from cloud APIs and CLI parameters, so a maliciously crafted value or unexpected upstream response could abuse the tool invocation path to run arbitrary local commands.

Content

Scanner excerpt · scripts/export_waf_config_backup.py (reported line 432)May include surrounding context.

python

last_err = ""
    for attempt in range(1, RETRY_MAX + 1):
        try:
            result = subprocess.run(
                cmd, shell=True, capture_output=True, text=True,
                timeout=CLI_TIMEOUT_SEC,
            )

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/export_waf_config_backup.py (reported line 686)May include surrounding context.

python

f"--instance-id {instance_id} --rule-type {rule_type} "
                f"--query '{query_args}'")
    rules = paginate(base_cmd, "Rules", profile)
    return rules


# === Excel Writing Helpers ===

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to use shell commands, read local reference files, and access networked cloud APIs, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent environment, that omission weakens enforcement and review of what the skill is permitted to do, increasing the chance of overbroad execution or abuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest says this skill is for backing up Alibaba Cloud WAF 3.0 configuration to an Excel workbook, but this file explicitly claims support for installing and using all published Alibaba Cloud product plugins. That materially broadens the documented scope from WAF backup into general-purpose Alibaba Cloud CLI enablement.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide presents copyable commands for configuring long-lived access keys before clearly warning about their sensitivity, which can normalize insecure credential handling. In an agent/automation context, users may paste real secrets into shell history, logs, screenshots, or persisted config files without understanding the exposure risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented next steps direct users to install arbitrary product plugins and explore commands for services like ECS and FC, which is not necessary to the declared purpose of exporting WAF configuration. This makes the skill’s documented behavior broader than a focused WAF backup utility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This exporter writes a highly sensitive backup to local disk, including WAF topology, domains, backends, bindings, member-account IDs, and raw JSON configuration fields. Even if intended functionality, saving this data without an explicit sensitivity warning, secure default path, or protective controls increases the risk of accidental disclosure through shared workstations, backups, or source-controlled directories.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The script builds shell command strings from dynamic values such as profile names, domains, instance IDs, template IDs, resource names, and output-adjacent parameters, then executes them with subprocess.run(..., shell=True). If any of those values contain shell metacharacters or are user-controlled via CLI arguments or upstream API data, this can lead to command injection and arbitrary command execution under the operator's account.

Content

Scanner excerpt · scripts/export_waf_config_backup.py (reported line 432)May include surrounding context.

python

last_err = ""
    for attempt in range(1, RETRY_MAX + 1):
        try:
            result = subprocess.run(
                cmd, shell=True, capture_output=True, text=True,
                timeout=CLI_TIMEOUT_SEC,
            )

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This file teaches multiple generic Alibaba Cloud authentication modes, including cross-account role assumption and ECS role chaining, as a standalone capability. While some credential setup is expected, the breadth of general authentication guidance exceeds what is clearly justified for a single-purpose WAF backup skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example config sets "language": "en", which presents a fixed language setting in natural-language-facing configuration. There is no accompanying note that users may choose their preferred language or that English is only an example default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI sets --lang choices to zh, en, or all, and defaults to all, which forces bilingual output even when the user did not request a language or locale. The policy allows locale constraints only when the user is offered a choice or the constraint is clearly justified; here a choice exists, but the default still imposes specific locales without opt-in.

Content

No source excerpt is available for this finding.