alibabacloud-workbench-cli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 0.0.1

Overview

The skill is for legitimate Alibaba Cloud ECS administration, but its default setup asks users to run unverified remote installers and grant broad cloud access.

Review before installing. Use a pinned, verifiable installer instead of pipe-to-shell commands; prefer short-lived role or STS credentials over long-lived AK/SK; restrict RAM permissions to specific regions, accounts, and instance ARNs; and require explicit approval for upgrades, destructive remote commands, and overwrites.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:29

Finding

Unverified Remote Installer Download and Immediate Execution

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:296

Finding

Default RAM Policy Grants Remote Management Capabilities Across Wildcard Resources

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43

Finding

Long-Lived Cloud Credentials Are Written to a Plaintext Configuration File

Content

View full analysis

~/.workbench/config.json << 'EOF' { "current": "default", "profiles": { "default": { "mode": "AK", "access_key_id": "", "access_key_secret": "" } } } EOF # Set secure permissions chmod 600 ~/.workbench/config.json ``` ### Technical Analysis The instructions recommend writing a long-lived access key ID and secret directly to an unencrypted JSON file. Although the final `chmod 600` permission is appropriate for a user-owned credential file, it is applied only after shell redirection creates and populates the file. The initial file mode is controlled by the current process umask. With an insufficiently restrictive umask, the credential file may temporarily be readable by other local users before `chmod` executes. If the command is interrupted before the permission change, the broader permissions may persist. Even after permissions are corrected, the access key remains a reusable plaintext secret exposed to malware running as the same user, accidental backup collection, filesystem disclosure, or other local account compromise. This risk is amplified when the credential receives the wildcard remote-management policy documented elsewhere in the Skill. ### Attack Path 1. A user or agent enters a long-lived Alibaba Cloud access key into the documented shell block. 2. Shell redirection creates `~/.workbench/config.json` using permissions derived from the current umask. 3. Before `chmod 600` completes—or permanently if the sequence is interrupted—another local principal may read the file when the initial mode permits it. 4. Alternatively, malware or a process running as the same user reads the plaintext fi ...[truncated 826 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill fetches an external installer script from the internet and immediately executes it. This is a classic supply-chain risk: if the remote source is compromised or replaced, the agent or user will run attacker-controlled code locally with the current user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

Linux / macOS:

bash

curl -fsSL https://workbench-cli.oss-cn-hangzhou.aliyuncs.com/install.sh | bash

Windows (PowerShell):

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | bash pattern removes any opportunity for review between retrieval and execution, enabling immediate command chaining from untrusted network input into a shell. In an agent skill, this is even more dangerous because it normalizes automatic execution of arbitrary remote content as part of routine setup.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

Linux / macOS:

bash

curl -fsSL https://workbench-cli.oss-cn-hangzhou.aliyuncs.com/install.sh | bash

Windows (PowerShell):

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The documented workbench upgrade self-update capability allows the tool to modify its own executable after installation. In an agent-executed environment, self-modifying tools increase supply-chain and integrity risk because an automated workflow may fetch and run new code outside the original review boundary.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

│ ├── switch # Switch active profile │ ├── get # Show profile details │ └── delete # Delete a profile ├── upgrade # Self-update └── version # Print version info

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to install the CLI by piping a remotely fetched script directly into a shell, but it does not include an explicit integrity-verification or trust warning. In an agent context, this is especially dangerous because it encourages blind execution of network-delivered code, which could lead to arbitrary local code execution if the hosting endpoint, transport, or distribution pipeline is compromised.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill explicitly tells the agent to write persistent credentials into ~/.workbench/config.json, including long-lived AccessKey material in examples. This creates durable local secrets that may be reused by later processes, leaked via filesystem access, or mishandled by other tools, making the persistence especially risky in shared or automated agent environments.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

2. Configure credentials

Credentials are stored in ~/.workbench/config.json with 0600 permissions. As an Agent, write this file directly instead of using the interactive workbench config command.

bash

# Create config directory

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

EOF

Set secure permissions

chmod 600 ~/.workbench/config.json

text

**Config file schema by mode:**

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

6. File transfer

Built-in safety: The upload command has a built-in overwrite protection. When the remote destination file already exists, the CLI prompts for confirmation before overwriting:

text

Remote file "/root/id.txt" already exists (728 B, modified Jul 27 10:42). Overwrite? [y/N]

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 348)May include surrounding context.

md

| Session busy / attach errors | 7 | Another terminal is attached. Close it first, or use `workbench session close <id>`. |
| `cannot start daemon` / socket errors | 6 | Run `workbench daemon status`. If stopped, any command will auto-restart it. |
| Permission denied (RAM) | 4 | Attach the RAM policy from `## RAM Permissions` to the user or role. |
| `insecure permissions` | 2 | Run `chmod 600 ~/.workbench/config.json`. |
| STS token expired | 4 | If using `RamRoleArn` mode, the CLI auto-refreshes. If using static STS, update the token. |

Static analysis

No suspicious patterns detected.