Alibabacloud Waf Config Backup

• Outcome: Review
• Latest audit: Jun 24, 2026 · 10:54 AM UTC
• Version: 0.0.1

Overview

This appears to be a real Alibaba Cloud WAF backup skill, but it needs review because it runs dynamically built shell commands with cloud credentials and exports sensitive security configuration.

Install only if you are comfortable reviewing and running the bundled Python script in an isolated environment. Use a read-only RAM user or short-lived credentials, avoid entering secrets in command-line arguments, and protect the generated workbook because it contains detailed WAF rules, protected assets, account topology, and raw configuration JSON. A safer version would remove shell=True, pass CLI arguments as argv arrays, and make plugin/config changes explicit and optional.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

last_err = ""
    for attempt in range(1, RETRY_MAX + 1):
        try:
            result = subprocess.run(
                cmd, shell=True, capture_output=True, text=True,
                timeout=CLI_TIMEOUT_SEC,
            )

• Confidence: 96% confidence
• Finding: The script builds shell command strings from dynamic values such as --profile, domain names, template IDs, resource names, and output-adjacent metadata, then executes them with subprocess.run(..., shell=True). If any of those values contain shell metacharacters or quote-breaking content, an attacker could achieve command injection and execute arbitrary commands in the environment running the backup.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill requires shell execution, network access, and file reads, but it does not declare permissions or boundaries for those capabilities. Because it invokes external installers, updates CLI plugins, and runs a bundled Python script that reads local files and accesses cloud APIs, the lack of explicit permission declarations weakens reviewability and increases the chance of overbroad or unexpected execution in the agent environment.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The guide shows access keys and secrets being passed directly on the command line, which can expose credentials via shell history, process listings, audit logs, and agent telemetry. In an automation-focused skill, this is more dangerous because users may copy these examples into CI jobs, terminals, or orchestrators where secrets are widely logged or retained.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide recommends non-interactive configuration for scripts and agents without warning that this can persist long-lived credentials in ~/.aliyun/config.json in plaintext-like form. In the context of an agent skill for cloud backup, that increases risk because the host may be multi-user, ephemeral-but-logged, or subject to artifact collection and debugging.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The workbook intentionally exports extensive WAF configuration, including raw JSON for domains, bindings, templates, and rules, into local .xlsx files with no sensitivity warning, access control, or redaction. These backups can expose security policy internals, protected asset inventory, account topology, and other operationally sensitive details that would materially aid an attacker if the file is shared, synced, or stored insecurely.

Unvalidated Output Injection

High

• Category: Output Handling

Content

import subprocess, json

def run_cli(cmd):
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    if result.returncode != 0:
        return None
    return json.loads(result.stdout)

• Confidence: 98% confidence
• Finding: The acceptance criteria explicitly endorse building CLI commands as strings and executing them with subprocess.run(..., shell=True), which creates a command-injection sink if any part of the command incorporates variable input such as region, instance ID, page parameters, output paths, or user-supplied baseline arguments. In this skill context, the tool is intended to interact with cloud configuration and local files, so successful injection could lead to arbitrary shell command execution, credential exposure, or tampering with backup artifacts.

Unvalidated Output Injection

High

• Category: Output Handling

Content

last_err = ""
    for attempt in range(1, RETRY_MAX + 1):
        try:
            result = subprocess.run(
                cmd, shell=True, capture_output=True, text=True,
                timeout=CLI_TIMEOUT_SEC,
            )

• Confidence: 97% confidence
• Finding: Using shell=True with a dynamically assembled command string creates an output/command injection path because untrusted values are inserted into a shell-interpreted context. In this skill, several command components come from user input or cloud-returned data, so maliciously crafted values could break command boundaries and run arbitrary shell commands on the host.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

f"--instance-id {instance_id} --rule-type {rule_type} "
                f"--query '{query_args}'")
    rules = paginate(base_cmd, "Rules", profile)
    return rules


# === Excel Writing Helpers ===

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

import subprocess, json

def run_cli(cmd):
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    if result.returncode != 0:
        return None
    return json.loads(result.stdout)

• Confidence: 97% confidence
• Finding: This pattern is a true vulnerability because the documented implementation couples tool invocation to a shell, allowing tool parameters to be abused as shell metacharacter carriers instead of remaining opaque arguments to the aliyun CLI. Given this skill's purpose—enumerating WAF configuration across accounts and writing workbooks—parameter abuse could escalate from malformed requests to arbitrary command execution and access to sensitive cloud metadata or local files.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

last_err = ""
    for attempt in range(1, RETRY_MAX + 1):
        try:
            result = subprocess.run(
                cmd, shell=True, capture_output=True, text=True,
                timeout=CLI_TIMEOUT_SEC,
            )

• Confidence: 95% confidence
• Finding: The skill delegates security-sensitive operations to an external CLI through a shell command whose parameters are assembled dynamically. That enables tool parameter abuse: attacker-controlled or API-sourced values can alter the invoked command, causing unintended CLI actions or arbitrary shell execution in the context of the user running the exporter.

Static analysis

No suspicious patterns detected.