Alibabacloud Yike Storyboard

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:37 AM UTC
• Version: 0.0.2

Overview

The skill has a coherent Alibaba Cloud storyboard workflow, but it asks for risky CLI installation and persistent plugin changes and has weak safeguards around uploading local files.

Review before installing. Use only a dedicated, least-privilege Alibaba Cloud RAM user/profile for this skill; avoid the curl-to-bash installer; do not enable global auto-plugin installation or update unrelated plugins; confirm the exact resolved file path before upload; and assume submitted manuscripts/scripts are transmitted to Alibaba Cloud/Yike for processing.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:25

Finding

Unverified Remote Script Is Downloaded and Executed Directly

Content

View full analysis

Verify version >= 3.3.3. If not installed or version is too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update, > or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions. ``` ### Technical Analysis The installation instruction pipes content retrieved from an external URL directly into `bash`. The downloaded payload is not pinned to a version and is not validated using a cryptographic checksum or signature before execution. HTTPS protects the connection in transit, but it does not ensure that the remote script remains unchanged after the Skill has been reviewed. Compromise of the hosting infrastructure, CDN, DNS or TLS trust chain, or the publisher's release process could cause arbitrary attacker-controlled shell commands to be returned and executed. The Aliyun CLI is a legitimate prerequisite for the declared workflow, but remote-to-shell execution is not the minimum capability required to install it. The included installation guide already provides alternatives that separate downloading from execution. ### Attack Path 1. An attacker compromises the remote setup script, its hosting infrastructure, or another component in the delivery chain. 2. The user or Agent follows the Skill prerequisite and executes the documented `curl | bash` command. 3. `curl` retrieves the current mutable response without saving it for review or validating its integrity. 4. `bash` immediately executes the response under the privileges of the user running the Skill. 5. The payload can access files, credentials, network resources, and cloud configuration available to that user. ### Impact Assessment Successful exploitation permits arbitrary command execution with the privileges of the invokin ...[truncated 422 chars]

Remediation

View remediation

aliyun-cli.tgz" | sha256sum -c - tar -xzf aliyun-cli.tgz ``` The URL and checksum must come from an authenticated official release and must be pinned to the reviewed version. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Global Automatic Plugin Installation and Unpinned Plugin Updates

Content

View full analysis

Then **[MUST]** run the following commands to configure CLI: > ```bash > # Enable auto plugin installation > aliyun configure set --auto-plugin-install true > > # Update plugins to latest > aliyun plugin update > > # Set region to cn-shanghai (required for ICE service) > aliyun configure set --region cn-shanghai > ``` ### 2. ICE Plugin Installation > **Pre-check: ICE CLI Plugin required** > > ```bash > aliyun plugin install --names ice > ``` > > Verify plugin is installed: > ```bash > aliyun ice --help > ``` ``` ### Technical Analysis The Skill requires the ICE plugin, but it also instructs the Agent to enable automatic plugin installation globally and update all installed plugins to their latest available versions. No reviewed version, integrity hash, signature requirement, or trusted repository constraint is specified. Updating unrelated plugins exceeds the minimum dependency changes required for storyboard generation. Enabling automatic installation also persists a broader CLI configuration change beyond the immediate operation, allowing future commands to retrieve components without an explicit per-plugin decision. This behavior creates a mutable supply-chain boundary: the code executed by subsequent CLI operations can differ from the components present when the Skill was audited. ### Attack Path 1. An attacker compromises a plugin release, plugin repository, publisher account, or dependency-delivery channel. 2. The user follows the mandatory instructions and enables global automatic plugin installation. 3. `aliyun plugin update` retrieves the current versions of all installed plugins, including plugins unrelated to the Skill. 4. The unpinned ICE plugin or another updated plugin is installed without an integrity value tied t ...[truncated 627 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/upload_to_oss.sh:61

Finding

File-Path Validation Allows Upload of Arbitrary Readable Files Through Symlink Aliases

Content

View full analysis

/dev/null || echo "") if [ -z "$REAL_PATH" ]; then echo "Error: Cannot resolve file path: $LOCAL_FILE" exit 1 fi # Check if file exists if [ ! -f "$REAL_PATH" ]; then echo "Error: File not found: $LOCAL_FILE" exit 1 fi # Get file extension and validate FILE_EXT="${LOCAL_FILE##*.}" FILE_EXT_LOWER=$(echo "$FILE_EXT" | tr '[:upper:]' '[:lower:]') ``` The resolved file is later uploaded: ```bash run_with_timeout $UPLOAD_TIMEOUT aliyun ossutil cp "$REAL_PATH" "oss://${BUCKET}/${FILE_NAME}" \ --mode StsToken \ --access-key-id "$ACCESS_KEY_ID" \ --access-key-secret "$ACCESS_KEY_SECRET" \ --sts-token "$SECURITY_TOKEN" \ --endpoint "$ENDPOINT" 2>&1 || { ``` ### Technical Analysis The comment states that the resolved path will be verified as being under allowed directories, but no allowed-directory check is implemented. The script accepts any absolute path that does not contain `..`, provided the process can read it and its supplied name has an allowed extension. More importantly, the extension is derived from `LOCAL_FILE`, while the data uploaded is read from `REAL_PATH`. A symbolic link with a `.txt` or `.docx` name can point to a regular file of another name or type. `realpath` follows the link, and `[ -f "$REAL_PATH" ]` accepts the resolved regular file, but the script never rejects the original symlink or validates the resolved target against a trusted root. The network transfer itself is declared functi ...[truncated 1476 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a full storyboard/video creation workflow, including novel/script conversion and storyboard generation. However, the supplied code chunk only performs a narrow supporting operation: uploading a local text/document file to Alibaba Cloud OSS after fetching temporary upload credentials. It does not parse scripts, generate storyboards, create videos, or provide a conversational workflow. While file upload could be a supporting step in a larger storyboard pipeline, this code chunk's actual behavior is materially narrower and centered on cloud storage transfer, which is not accurately represented by the declared purpose.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to execute curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash, which downloads and immediately executes remote code without prior verification. If the remote host, transport path, or script content is compromised, this can lead to arbitrary code execution on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

> ```
> 
> Verify version >= 3.3.3. If not installed or version is too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update,
> or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions.
> 
> Then **[MUST]** run the following commands to configure CLI:

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

**Classification Guide:**

Evaluate the following features to determine if text is novel or script (don't judge solely by dialogue presence - novels can have extensive dialogue too):

| Feature | Script | Novel |
|---------|--------|-------|

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation guidance says to use the skill when users want to 'produce videos' or 'video creation', and the trigger list includes broad terms like 'storyboard' and 'video creation'. These phrases are generic enough to overlap with ordinary conversation and may cause unintended activation for requests unrelated to this specific Alibaba Cloud Yike storyboard workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The acceptance criteria includes an OSS CLI example with credential-bearing flags such as --access-key-id, --access-key-secret, and --sts-token, but provides no warning that these values are secrets and must never be hardcoded, logged, or shared. In a skill intended to guide users through a workflow, examples like this can normalize unsafe secret handling and lead users or downstream agents to expose cloud credentials in terminals, transcripts, or generated scripts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file is materially out of scope for a storyboard/video-creation skill and instead provides broad Alibaba Cloud CLI installation, authentication, credential handling, and plugin guidance. In an agent skill, unrelated cloud-administration content increases attack surface by enabling credential collection, environment modification, or unauthorized cloud operations that are not necessary for the advertised function.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide instructs users to pass access keys directly on the command line, which can leak secrets via shell history, process listings, terminal recordings, CI logs, and persisted CLI config. In the context of an agent skill, encouraging non-interactive secret entry is especially risky because automated tooling may capture and replay these values.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The document encourages creation and retention of long-lived AccessKey credentials for CLI use, which increases persistent credential footprint and the chance of later compromise. In a skill unrelated to cloud administration, normalizing persistent cloud credentials is unnecessarily dangerous because it primes users or agents to provision reusable secrets outside the skill’s legitimate scope.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Recommending debug logging for authentication troubleshooting without a warning can expose sensitive request metadata, credential-provider details, endpoints, and possibly tokens or signed request information in logs. Because this skill already discusses cloud credential setup, the absence of logging hygiene guidance makes accidental secret disclosure more likely.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script uploads a user-supplied local file to Alibaba OSS and prints a success message, but it does not provide an explicit warning, confirmation step, or data-handling notice before transmitting the file to a remote cloud service. In the context of a conversational storyboard/video-generation skill, users may provide scripts, manuscripts, or other sensitive creative content, so silent transmission creates privacy and data-exposure risk even if the upload is functionally intended.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The instructions require setting the CLI region to 'cn-shanghai' and present it as mandatory. While this may be technically necessary, the file does not frame it as a region-specific skill scope in the top-level description or otherwise offer user opt-in, which can conflict with locale-choice expectations under the policy.

Content

No source excerpt is available for this finding.