ClawHub
Back to skill

Security audit

alibabacloud-waf-rule-effectiveness-check

Security checks for vulnerabilities and agentic risk

Overview

The skill’s core WAF diagnosis is read-only, but its setup guidance is broader and riskier than the stated WAF-only purpose.

Install only if you are comfortable reviewing the setup steps. Use a least-privilege WAF read-only RAM policy, avoid curl-to-bash and command-line secrets, prefer verified/package-manager installation, and do not grant or configure broader Alibaba Cloud access than the WAF checks require.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
This reference file materially expands the skill’s operational scope from read-only WAF rule-effectiveness diagnosis into generic Alibaba Cloud CLI installation, authentication, profile management, plugin installation, and broader product usage. In an agent skill, this kind of overbroad enablement increases the chance the agent will request unnecessary credentials, access unrelated services, or perform actions outside the declared least-privilege WAF troubleshooting purpose.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The guide walks users through configuring long-lived credentials and multiple high-capability authentication modes for broad Alibaba Cloud access, despite the skill being described as read-only WAF troubleshooting only. That mismatch makes unnecessary credential collection and privilege expansion more likely, which is dangerous in agent-driven environments where operators may over-trust provided setup instructions.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill includes an explicit `curl | bash` installation path for Aliyun CLI. Piping a remote script directly into a shell executes unverified code from the network in the user's environment, creating a supply-chain execution risk if the source is compromised, intercepted, or unexpectedly changed.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The examples encourage passing access keys directly on the command line and storing them in plaintext configuration, which can leak through shell history, terminal logging, CI job logs, screenshots, and local file compromise. Although the document later mentions best practices, it does not clearly warn at the point of use that these specific examples expose sensitive credentials.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The document presents a curl-to-bash installer that executes code fetched at runtime from a remote endpoint. Even though it notes this is an alternative and recommends manual installation first, it still normalizes a high-risk pattern without a strong warning about supply-chain, TLS interception, mirror compromise, or script-change risks.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
> [MUST] Verify: `aliyun version` — must be >= 3.3.3.
> - **Preferred (no remote script execution):** download `https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz`
>   (macOS: `aliyun-cli-macosx-latest-{amd64|arm64}.tgz`), `tar tzf` to inspect, `tar xzf`, `sudo mv aliyun /usr/local/bin/`.
> - **Alternative:** `/bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh)"`
> - **Update (CLI >= 3.3.5):** `aliyun upgrade`. Full instructions: `references/cli-installation-guide.md`.
Confidence
90% confidence
Finding
The documented installation flow includes `sudo mv aliyun /usr/local/bin/`, which normalizes running privileged operations during setup. While moving a binary into a system path is common, pairing privileged steps with downloaded artifacts increases the blast radius if the binary is tampered with or the preceding verification is skipped.

Static analysis

No suspicious patterns detected.