Security audit

alibabacloud-waf-rule-effectiveness-check

Security checks for vulnerabilities and agentic risk

Overview

The skill’s core WAF diagnosis is read-only, but its setup guidance is broader and riskier than the stated WAF-only purpose.

Install only if you are comfortable reviewing the setup steps. Use a least-privilege WAF read-only RAM policy, avoid curl-to-bash and command-line secrets, prefer verified/package-manager installation, and do not grant or configure broader Alibaba Cloud access than the WAF checks require.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This reference file materially expands the skill’s operational scope from read-only WAF rule-effectiveness diagnosis into generic Alibaba Cloud CLI installation, authentication, profile management, plugin installation, and broader product usage. In an agent skill, this kind of overbroad enablement increases the chance the agent will request unnecessary credentials, access unrelated services, or perform actions outside the declared least-privilege WAF troubleshooting purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide walks users through configuring long-lived credentials and multiple high-capability authentication modes for broad Alibaba Cloud access, despite the skill being described as read-only WAF troubleshooting only. That mismatch makes unnecessary credential collection and privilege expansion more likely, which is dangerous in agent-driven environments where operators may over-trust provided setup instructions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill includes an explicit curl | bash installation path for Aliyun CLI. Piping a remote script directly into a shell executes unverified code from the network in the user's environment, creating a supply-chain execution risk if the source is compromised, intercepted, or unexpectedly changed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The examples encourage passing access keys directly on the command line and storing them in plaintext configuration, which can leak through shell history, terminal logging, CI job logs, screenshots, and local file compromise. Although the document later mentions best practices, it does not clearly warn at the point of use that these specific examples expose sensitive credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The document presents a curl-to-bash installer that executes code fetched at runtime from a remote endpoint. Even though it notes this is an alternative and recommends manual installation first, it still normalizes a high-risk pattern without a strong warning about supply-chain, TLS interception, mirror compromise, or script-change risks.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The documented installation flow includes sudo mv aliyun /usr/local/bin/, which normalizes running privileged operations during setup. While moving a binary into a system path is common, pairing privileged steps with downloaded artifacts increases the blast radius if the binary is tampered with or the preceding verification is skipped.
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
> [MUST] Verify: `aliyun version` — must be >= 3.3.3. > - **Preferred (no remote script execution):** download `https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz` > (macOS: `aliyun-cli-macosx-latest-{amd64|arm64}.tgz`), `tar tzf` to inspect, `tar xzf`, `sudo mv aliyun /usr/local/bin/`. > - **Alternative:** `/bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh)"` > - **Update (CLI >= 3.3.5):** `aliyun upgrade`. Full instructions: `references/cli-installation-guide.md`.