Alibabacloud Waf Rule Management

• Outcome: Review
• Latest audit: Jul 8, 2026 · 8:19 AM UTC
• Version: 0.0.1

Overview

This appears to be a legitimate Alibaba Cloud WAF diagnostic skill, but it uses sensitive cloud credentials and local diagnostic files in ways that are broader and less clearly controlled than its read-only, text-only framing suggests.

Install only if you are comfortable giving the agent read-only access to Alibaba Cloud WAF configuration and SLS logs. Use a dedicated least-privilege RAM user or temporary credentials, confirm the active Alibaba Cloud account and region before any command runs, do not paste secrets into chat, treat any saved rule/log JSON as sensitive, and delete temporary diagnostic files after use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares only Bash and Read as allowed tools, but its workflow clearly performs file reads across the references/ and scripts/ directories and makes networked cloud API calls through the Alibaba Cloud CLI. This mismatch weakens policy transparency and can cause an agent or reviewer to underestimate the real execution surface, especially around local file access and outbound requests.

Context-Inappropriate Capability

Medium

• Confidence: 76% confidence
• Finding: The skill requires executing arbitrary local interpreters or crypto tools (`python3` or `openssl`) solely to generate a session identifier. Invoking general-purpose local executables expands the attack surface and creates unnecessary dependence on host tooling unrelated to the stated cloud-diagnostic function, which is risky in agentic environments.

Context-Inappropriate Capability

Medium

• Confidence: 79% confidence
• Finding: The skill instructs installation of an Alibaba Cloud CLI plugin, which is an environment-modifying action inconsistent with a read-only diagnostic role. In managed or sensitive environments, package/plugin installation introduces supply-chain and persistence risk and can change the host state without clear user-scoped controls.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The reference explicitly documents `aliyun waf-openapi <Action>` invocation patterns for WAF 3.0, including generic action execution with arbitrary parameters, even though the skill is described as a read-only, text-only diagnostic assistant. This creates a capability mismatch: an agent or operator could use the guide to perform live configuration changes, expanding the skill from diagnostics into mutation of security controls and increasing the chance of accidental or unauthorized policy changes.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The troubleshooting content includes actionable `aliyun waf-openapi` CLI commands that perform direct API interactions, which conflicts with the stated skill boundary of a read-only, text-only diagnostic assistant centered on console guidance and SLS log queries. Even though the shown operations are describe/query calls rather than explicit mutations, this expands the operational scope of the skill, can normalize shell/API execution, and may lead an agent or user to rely on higher-privilege credentials and non-console actions contrary to the declared trust model.

Missing User Warnings

Low

• Confidence: 73% confidence
• Finding: The skill directs execution of local shell commands such as `which aliyun`, `aliyun version`, and a Python/OpenSSL helper without a clear, explicit user-facing execution warning immediately before those actions. In agent settings, even benign local commands should be transparently announced because they reveal host state and can normalize silent command execution.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly instructs the skill to use the default credential chain with no account-selection warning or confirmation step. In a multi-account or privileged environment, this can cause the agent or user to query the wrong Alibaba Cloud account, unintentionally exposing metadata about production WAF instances or creating cross-tenant confusion during troubleshooting. The skill is described as read-only, which reduces direct modification risk, but unauthorized or unintended data access is still a meaningful security issue.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guidance explicitly instructs saving WAF rule configuration and log entries to /tmp, which can expose potentially sensitive operational data on a shared or multi-user system. Temporary directories are commonly world-accessible or more broadly readable than intended, and the files may persist longer than expected, increasing the chance of accidental disclosure or misuse.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: Hardcoding a default region of `cn-hangzhou` without explicit user confirmation can cause queries to run against the wrong regional environment, leading to misleading diagnostics or unintended access attempts in a different tenancy context. In a security troubleshooting workflow, silent regional assumptions reduce operator awareness and can produce incorrect conclusions about whether protections or logs exist.

Static analysis

No suspicious patterns detected.