ClawHub
Back to skill

Security audit

Alibabacloud Waf Protectionconfig Backup

Security checks for vulnerabilities and agentic risk

Overview

The skill's WAF backup purpose is legitimate, but its setup and reference instructions include risky system changes, unverified installs, and unsafe credential-handling examples.

Install only after reviewing the setup path. Prefer an already installed, verified Aliyun CLI; avoid curl-to-bash and mutable latest binaries; do not run broad plugin updates or enter cloud secrets in command arguments or agent transcripts. Treat generated .xlsx backups as sensitive security data and store them with restricted access or encryption.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:39
Finding

Unverified Remote Script Is Executed Directly by Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:39-42
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable code:

bash
**Pre-check: Aliyun CLI >= 3.3.3 required**

> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for detailed instructions.

Technical Analysis

The command passes the HTTP response directly to Bash. The effective code is not included in the audited project and can change after the Skill has been reviewed. There is no version pinning, checksum validation, cryptographic signature verification, local inspection, or confirmation of the downloaded payload.

HTTPS protects the connection in transit but does not establish that a mutable script remains safe over time. Compromise of the hosting origin, CDN, release process, DNS/TLS trust path, or vendor account could therefore turn this installation command into an arbitrary-code execution channel.

Installing the CLI may be necessary when it is absent, but executing an unverified mutable script is not the minimum privilege or safest mechanism required for the declared read-only backup functionality.

Attack Path

  1. An attacker compromises or gains control over setup.sh, its hosting infrastructure, or a relevant delivery dependency.
  2. The attacker modifies the response to contain malicious shell commands.
  3. A user or Agent follows the Skill's installation instruction.
  4. curl downloads the modified response and streams it directly into Bash.
  5. Bash executes the payload with all permissions available to the invoking account.
  6. The payload can subsequently access local files, installed credentials, backup output, or establish additional execution mechanisms.

I

...[truncated 386 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash pipeline.
  • Prefer a trusted operating-system package repository or package manager.
  • If direct installation is unavoidable, download a fixed, versioned release as a separate step.
  • Verify a vendor-published cryptographic signature and pinned SHA-256 checksum before extraction or execution.
  • Display the exact version and source to the user and obtain explicit approval before installation.
  • Run installation with user-level permissions wherever possible.
  • Do not execute a mutable latest installer or other remotely supplied shell source directly.

T08 · Insecure Dependencies

Error
Location
SKILL.md:44
Finding

Automatic and Unpinned Plugin and Python Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:44-53
Vulnerability Type: Unpinned executable dependencies and automatic plugin updates
Risk Level: High

Vulnerable code:

bash
**Pre-check: Aliyun CLI plugin update required**

> [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date.

**Pre-check: Python openpyxl library required**

> Excel (.xlsx) output requires the `openpyxl` Python library.
> ```bash
> pip3 install openpyxl
> ```

Technical Analysis

The Skill mandates automatic plugin installation and updates every existing Aliyun CLI plugin, including plugins unrelated to WAF backup. It also installs openpyxl without a pinned version, package hash, lockfile, isolated environment, or constrained package repository.

Plugins and Python packages contain executable code. Their installation therefore expands the trusted computing base beyond the audited Skill. A compromised repository, malicious release, dependency takeover, or altered transitive dependency could lead to code execution.

Updating all existing plugins exceeds the minimum scope required by the declared functionality. The backup only needs the relevant WAF functionality and should not modify unrelated local tooling.

Attack Path

  1. An attacker compromises a plugin or Python package release, publishing infrastructure, or transitive dependency.
  2. The Skill enables automatic plugin installation, updates installed plugins, or retrieves the current unpinned openpyxl release.
  3. The compromised component is installed without hash or signature verification.
  4. The component executes during installation, plugin loading, an Aliyun CLI command, or Python import.
  5. It gains access to the invoking user's local environment and any credentials available to the CLI proc ...[truncated 429 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not enable global automatic plugin installation.
  • Install only the specific WAF plugin required by the workflow.
  • Pin exact plugin and Python package versions.
  • Verify package signatures or hashes where supported.
  • Use a lockfile and pip --require-hashes for Python dependencies.
  • Install Python dependencies in a dedicated virtual environment rather than the global interpreter.
  • Constrain downloads to approved repositories.
  • Require explicit user approval before changing installed dependencies.
  • Do not update unrelated existing plugins as part of a read-only backup operation.

T08 · Insecure Dependencies

Error
Location
references/cli-installation-guide.md:21
Finding

Unverified Mutable CLI Binary Is Installed into a Privileged System PATH

Content
View full analysis

Vulnerability Details

File Location: references/cli-installation-guide.md:21-30
Additional Locations: references/cli-installation-guide.md:36-71, references/cli-installation-guide.md:74-93
Vulnerability Type: Unverified binary installation with elevated system modification
Risk Level: High

Representative vulnerable code:

bash
**Using Binary**
```bash
# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/
text

Equivalent Linux instructions download mutable `latest` archives and execute:
```bash
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

The Windows instructions modify the machine-wide PATH:

powershell
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

Technical Analysis

The guide downloads mutable latest archives without validating a cryptographic signature or checksum. It then uses sudo to place the extracted executable in /usr/local/bin, a system-wide command location. The Windows procedure similarly changes the machine-level PATH.

A binary installed under the trusted aliyun command name will later run while Alibaba Cloud credentials are available. This creates both a supply-chain risk and a privilege-boundary problem. A read-only WAF backup does not inherently require replacing a system-wide executable or changing machine-wide environment settings.

Attack Path

  1. An attacker substitutes or compromises a mutable CLI archive or its delivery infrastructure.
  2. The user downloads the archive without validating its identity or integrity.
  3. The archive is extracted, and its aliyun executable is moved into a system-wide PATH ...[truncated 808 chars]
Remediation
View remediation

Remediation Suggestions

  • Prefer signed packages from a trusted operating-system package repository.
  • Replace mutable latest URLs with fixed versioned release URLs.
  • Publish and verify SHA-256 checksums and cryptographic signatures before extraction.
  • Install the CLI in a user-scoped directory instead of /usr/local/bin whenever possible.
  • Avoid machine-wide PATH changes for this Skill.
  • Require explicit user approval before any privileged installation.
  • Verify the installed binary's version, signature, ownership, and resolved path before authenticated use.
  • Separate download, verification, extraction, and installation into auditable steps.

T09 · Insecure Skill Coding Practices

Error
Location
references/cli-installation-guide.md:101
Finding

Cloud Credentials Are Recommended as Literal Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: references/cli-installation-guide.md:101-112
Additional Locations: references/cli-installation-guide.md:125-180, references/cli-installation-guide.md:256-270, references/cli-installation-guide.md:368-382, references/cli-installation-guide.md:444-452
Vulnerability Type: Sensitive credential exposure through command arguments and automation logs
Risk Level: High

Vulnerable code:

bash
### Quick Start

```bash
aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

text

Other examples also place access-key secrets and STS tokens directly in arguments:
```bash
aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Technical Analysis

Passing credentials as command-line arguments can expose them through shell history, process inspection, terminal capture, CI/CD logs, Agent transcripts, audit records, and error reporting. Recommending this method specifically for scripts and Agent-driven automation increases the likelihood that credentials will be persistently recorded.

These instructions contradict the primary Skill's security rules at SKILL.md:64-68, which prohibit asking users to provide access keys in the conversation or command line and prohibit use of aliyun configure set with literal credentials. Because the installation guide is directly referenced by the Skill, users may follow the unsafe examples despite the primary warning.

Attack Path

  1. A user follows the reference ...[truncated 928 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove all examples that place access-key secrets, STS tokens, or private credentials directly in command arguments.
  • Remove the recommendation to perform credential configuration through Agent-driven automation.
  • Keep credential provisioning outside the Agent session.
  • Prefer workload identity, ECS RAM roles, OAuth, or another short-lived identity mechanism.
  • If local credential configuration is unavoidable, use an interactive no-echo input method or an approved secrets manager integration.
  • Warn users against shell history and process-list exposure.
  • Ensure CI/CD systems inject secrets through protected secret providers rather than command text.
  • Reconcile the guide with the primary Skill's prohibition against literal credentials.
  • Rotate and revoke any credential that may already have been exposed through logs or command history.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:223
Finding

Unvalidated Parameters Are Interpolated into Shell Commands and Python Source

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:223-224
Additional Locations: SKILL.md:126-144, references/waf3-backup-workflow.md:9-18, references/waf3-backup-workflow.md:104-114, references/waf2-backup-workflow.md:69-80
Vulnerability Type: Command injection, Python source injection, and unsafe recursive deletion
Risk Level: High

Vulnerable cleanup code:

bash
To remove backup files:
```bash
rm -rf {BACKUP_DIR}
text

**Python source interpolation:**
```python
python3 -c "
import json, sys
from openpyxl import Workbook
wb = Workbook()
# Create sheets, parse JSON responses, write rows
wb.save('{BACKUP_DIR}/waf3-{region}.xlsx')
"

Unquoted API-derived parameter interpolation:

bash
aliyun waf-openapi describe-protection-module-rules \
  --api-version 2019-09-10 \
  --region {region} \
  --instance-id {InstanceId} \
  --biz-region-id {region} \
  --domain {domain} \
  --defense-type {DefenseType} \
  --pager \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-waf-protectionconfig-backup/{session-id}

Technical Analysis

The Skill identifies BACKUP_DIR and regions as customizable parameters and derives domains and instance identifiers from API data. These values are inserted directly into shell command templates and, in the workbook example, into Python source code.

User confirmation does not provide syntactic validation or escaping. Shell metacharacters, whitespace, option-like values, command substitutions, or quote characters can alter command parsing. In particular, the unquoted rm -rf {BACKUP_DIR} operation can delete an unintended path or interpret a crafted value as additional shell syntax. A quote in BACKUP_DIR or region can also terminate the Python string supplied to python3 -c and inject Python expressions.

The workflow notes that domains containing special characters should be quoted, but the documented comman ...[truncated 1241 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not construct commands through textual interpolation.
  • Pass every value as a discrete argument using an argument array or subprocess.run([...], shell=False).
  • Pass paths to Python through sys.argv or another data channel instead of embedding them in python3 -c source.
  • Strictly allowlist supported region values.
  • Validate instance identifiers, defense types, and scene values against their documented formats.
  • Quote shell variables consistently, including domain names and paths.
  • Resolve BACKUP_DIR to a canonical path and require it to be a descendant of an approved backup root.
  • Reject empty paths, /, home directories, parent traversal, option-like values, control characters, and shell metacharacters.
  • Replace rm -rf with guarded deletion implemented through a safe filesystem API.
  • Require a separate explicit confirmation immediately before destructive cleanup.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to pipe a remotely fetched script directly into bash, which executes unverified code from the network with the user's privileges. If the distribution endpoint, TLS trust chain, CDN path, or script content is compromised, this becomes an immediate arbitrary code execution vector on the local system.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
**Pre-check: Aliyun CLI >= 3.3.3 required**

> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for detailed instructions.

**Pre-check: Aliyun CLI plugin update required**

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill exports full WAF protection configurations into local Excel workbooks, which can contain sensitive security metadata such as protected domains, rule logic, address books, and blacklists. The skill describes backup and storage practices but does not clearly warn users that these files are sensitive artifacts requiring controlled storage, limited access, encryption, and defined retention, increasing the chance of unintended disclosure from local disks or shared workstations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documented cleanup command uses rm -rf {BACKUP_DIR} without an explicit warning that deletion is irreversible and depends on correct path expansion. In operational use, users may copy or adapt this command incorrectly, potentially deleting unintended local data if the variable is empty, altered, or misread.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md
1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The guide recommends exporting long-lived access keys as environment variables but does not warn that secrets in environment state can leak through CI job logs, inherited child processes, shell startup files, crash dumps, or accidental debugging output. In the context of an automation-oriented skill, this is more dangerous because users are explicitly encouraged to use non-interactive scripting and CI/CD, where environment-based secret exposure is a common failure mode.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash
# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This workflow explicitly exports WAF instance, domain, and protection-rule data into local .xlsx files, which can expose sensitive security posture details if stored on an unsecured host or shared broadly. While configuration backup is the stated purpose of the skill, the document does not include any warning, minimization guidance, or storage protections for the generated files, increasing the risk of unintended disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The workflow explicitly exports WAF protection configuration data, resource details, rule definitions, and address data into local .xlsx files without any warning, access control guidance, or handling requirements for sensitive output. These backups can expose security posture, protected resources, IP blocklists, and rule logic to anyone with filesystem access, increasing the risk of unauthorized disclosure and facilitating follow-on attacks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

SQP-3 applies to all file types and includes language or locale policy violations. The example config sets "language": "en", which forces a specific language in the presented configuration without opt-in, while the document does not mention that this is optional or show alternatives.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.