Alibabacloud Waf Quick Showcase

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:57 AM UTC
• Version: 0.0.2

Overview

This skill has a coherent Alibaba Cloud WAF demo purpose, but it asks users to install or update mutable CLI components and creates publicly reachable billable cloud resources with under-scoped safeguards.

Review before installing. Use a test Alibaba Cloud account with the narrow custom RAM policy, avoid `curl | bash` and unverified `latest` binaries, do not enable automatic plugin installation unless you accept that local CLI behavior may change, confirm expected costs, prefer SSH keys or temporary credentials over reusable passwords, and restrict or remove the public ECS security-group rule after testing.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16

Finding

Unverified Remote Installation Script Executed Directly by Bash

Content

View full analysis

= 3.3.3. If not installed or version too low, run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update. ``` ```text If not installed or version too low, run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update. ``` ### Technical Analysis The downloaded response is passed directly to Bash without being saved, inspected, version-pinned, or verified using a cryptographic checksum or signature. Consequently, the effective code executed by the Skill can change after the Skill itself has been reviewed. HTTPS authenticates the connection to the endpoint but does not protect users if the hosting service, CDN, vendor account, DNS infrastructure, or installation script is compromised. It also does not make a mutable script reproducible. This behavior exceeds the minimum privileges necessary for the declared WAF deployment workflow. Aliyun CLI can instead be installed through a trusted package manager or from a pinned and cryptographically verified release. ### Attack Path 1. An attacker compromises the installation endpoint, CDN, publishing account, or upstream script. 2. The attacker modifies `setup.sh` to include arbitrary shell commands. 3. A user or Agent follows the mandatory prerequisite instruction. 4. `curl` retrieves the attacker-controlled response. 5. Bash executes the response immediately with the privileges of the invoking user. 6. The payload can access local files, steal cloud authentication material, alter tools, or establish further compromise. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the Skill. If the ...[truncated 297 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:41

Finding

Mutable CLI Binary Installed into a Privileged Executable Path Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:19

Finding

Mandatory Automatic Installation and Update of Unpinned CLI Plugins

Content

View full analysis

[MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. ``` The pre-flight instructions repeat this behavior: ```bash aliyun plugin update aliyun configure set --auto-plugin-install true ``` ### Technical Analysis The Skill requires automatic plugin installation and unconditional updating of existing plugins without identifying approved versions or requiring an integrity and release review. This makes execution dependent on mutable external components that may change independently of the audited Skill. Updating every existing plugin also exceeds the workflow's minimum requirements. The declared workflow only needs the plugins supporting the VPC, ECS, and WAF commands; unrelated locally installed plugins do not need to be updated. ### Attack Path 1. A plugin repository, release artifact, maintainer account, or distribution channel is compromised. 2. A malicious plugin version is published as the current update. 3. The mandatory `plugin update` command downloads the changed component, or automatic installation retrieves it when a command is first invoked. 4. The CLI loads or executes the plugin in the authenticated user's context. 5. The malicious plugin accesses local credentials or modifies cloud operations and their displayed results. ### Impact Assessment A malicious plugin may execute with the local user's privileges and within an authenticated cloud-management context. It could read Aliyun configuration and OAuth material, intercept the ECS password, perform cloud API calls using available permissions, or falsify command responses. Unconditional updates a ...[truncated 99 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:351

Finding

Plaintext ECS Password Passed Through Process Command-Line Arguments

Content

View full analysis

\ --vswitch-id \ --instance-name web-server \ --host-name web-server \ --internet-charge-type PayByTraffic \ --internet-max-bandwidth-out 5 \ --system-disk-size 40 \ --system-disk-category cloud_essd_entry \ --password \ --amount 1 ``` ### Technical Analysis Redacting the command displayed to the user does not protect the actual operating-system process arguments. Depending on the execution environment, plaintext arguments may be exposed through process inspection, shell history, terminal recording, Agent traces, audit systems, debugging output, crash reports, or telemetry. The risk is amplified because the new ECS instance receives a public IP address and has an internet-accessible service. Password-based provisioning is not the least-exposure option when SSH keys or another secure bootstrap mechanism can be used. ### Attack Path 1. The user gives the Agent an ECS login password. 2. The Agent interpolates the plaintext password into the CLI argument list. 3. A local process monitor, shell-history mechanism, trace collector, session recorder, or diagnostic system captures the invocation. 4. An attacker obtains the recorded password. 5. The attacker uses the password against the publi ...[truncated 459 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:302

Finding

Public ECS Origin Rule Allows Direct WAF Bypass

Content

View full analysis

\ --permissions '[{"Policy":"Accept","Priority":"1","IpProtocol":"TCP","PortRange":"80/80","SourceCidrIp":"0.0.0.0/0"}]' \ --connect-timeout 10 --read-timeout 30 \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-waf-quick-showcase ``` ### Technical Analysis The security-group rule permits every IPv4 address to connect directly to the ECS origin on TCP port 80. The verification guide also instructs users to retrieve and access the ECS public IP directly. If WAF is intended to filter and clean traffic before it reaches the application, unrestricted direct origin access creates an alternate path that does not traverse WAF. An attacker who discovers the ECS public IP can therefore send requests directly to the application. The rule exceeds the minimum network privileges necessary for a WAF-protected origin. Origin traffic should be restricted to documented WAF back-to-origin ranges or private service connectivity wherever the platform supports it. ### Attack Path 1. The workflow assigns a public IP address to the ECS instance. 2. The security group permits `0.0.0.0/0` to reach TCP port 80. 3. An attacker discovers the public IP through scanning, DNS history, logs, certificates, or other metadata. 4. The attacker sends malicious HTTP requests directly to the ECS address. 5. The traffic reaches the application without passing through WAF inspection. 6. Any application vulnerability can then be targeted without the advertised filtering controls. ### Impact Assessment The WAF control may be bypassed completely for direct-origin traffic. The exposed scope is the public HTTP service on the newly created ECS instance. Consequenc ...[truncated 188 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (18)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This line directs the user to fetch and immediately execute https://aliyuncli.alicdn.com/setup.sh through the shell. That pattern is inherently dangerous because any compromise of the remote endpoint, CDN path, TLS trust chain, or script contents results in arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

**Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see `references/cli-installation-guide.md` for installation instructions.

**Pre-check: Aliyun CLI plugin update required**

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The same unsafe remote-script execution pattern appears again in the pre-flight checks, this time as a mandatory operational step before use. Repetition and positioning in a required checklist increases the chance that users will follow it unquestioningly, amplifying the risk of supply-chain compromise and arbitrary code execution.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

> **IMPORTANT: Must proactively ask and help users complete the following checks before running**
> 
> 1. **CLI Version**: Run `aliyun version` to confirm version >= 3.3.3. If not installed or version too low, run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update.
>    Then [MUST] run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.
> 2. **Authentication Configuration**: Run `aliyun configure list` to confirm authentication status is Valid
> 3. **Auto Plugin**: Run `aliyun configure set --auto-plugin-install true`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs users to execute a remote installer via curl ... | bash, which runs code fetched over the network without prior inspection, integrity verification, or pinning to a trusted checksum/version. In an agent skill context, this is especially risky because it normalizes immediate execution of external code as part of the workflow, creating a supply-chain and remote code execution path if the host, transport, or script is compromised.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 185)May include surrounding context.

md

### 2. Use RAM Users (Not Root Account)

✔️ **Do**: Create RAM users with specific permissions
✔️ **Do**: Use OAuth login for RAM users

### 3. Principle of Least Privilege

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 202)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The guide broadens scope from a WAF/ECS showcase into general-purpose CLI plugin installation and exploration, including unrelated services. In an agent skill context, this can encourage overbroad capabilities and permissions, increasing attack surface and the chance the skill is used to access or modify resources beyond its intended purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown contains substantive operational guidance and safety warnings entirely in Chinese, including the key security recommendation section, but does not indicate that the skill is region- or language-specific or provide any user language choice. That can violate language/locale policy when users are not explicitly opted into Chinese content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file documents multiple destructive operations such as deleting VPCs, vSwitches, security groups, instances, releasing WAF instances, and removing cloud resources, but it provides no warning about potential data loss, service interruption, or irreversibility. Under the markdown-specific SQP-2 criteria, descriptions that omit warnings about behaviors affecting user data or system integrity should be flagged.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill content and operational instructions are presented only in Chinese, which effectively forces a specific language for users. Under the stated policy, language restrictions should either be optional for the user or explicitly justified as region- or audience-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document’s scenario and purpose are written in Chinese, and the rest of the acceptance criteria also consistently require Chinese-language usage without any indication that this skill is region-specific or that users may opt into another language. This can violate a language/locale policy when a skill implicitly constrains interaction language without user choice or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation explicitly states "Only OAuth authentication mode is supported" and that no AccessKey management is required, but later provides configuration steps for --mode EcsRamRole. This is an active contradiction in the file's own guidance, not just an omission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The document states 'Only OAuth authentication mode is supported' at L104-L107 and labels OAuth as 'Required' at L109-L113, but then provides ECS RAM Role configuration as another usable mode at L116-L125. This natural-language instruction imposes a rigid mode requirement without offering a clear user choice or narrowly justified exception, which is inconsistent with the stated policy and can mislead users about permitted locales/modes of operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file content is entirely in Chinese, including descriptions and headings, with no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific audience. This can violate the language/locale policy when a specific language is imposed without user opt-in or explicit justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file includes a verification script that retrieves and prints the ECS public IP address to the terminal. Although this is part of verification, the document does not warn users that it will display potentially sensitive infrastructure details, which falls under missing user disclosure for markdown content.

Content

No source excerpt is available for this finding.