Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Alibabacloud Cfw Status Overview
v0.0.1Alibaba Cloud Firewall Status Overview Skill. One-click query of overall cloud firewall status including asset management, border firewall switch status, and...
⭐ 0· 18·0 current·0 all-time
byalibabacloud-skills-team@sdk-team
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's description and SKILL.md clearly require the Aliyun CLI (aliyun >= 3.3.1) and an Alibaba Cloud credential/profile with specific RAM permissions. However, the registry metadata declares no required binaries, no primary credential, and no required env vars — an internal mismatch. The skill also references another skill (ram-permission-diagnose) as a prerequisite but does not declare that dependency.
Instruction Scope
The runtime instructions are narrowly scoped to issuing aliyun cloudfw CLI commands and explicitly forbid reading local logs/files or asking the user for secrets, which is good. They require checking 'aliyun configure list' and aborting if no profile exists. A potential operational risk: the SKILL mandates immediate CLI execution and enabling auto plugin installation, which could result in the CLI fetching/running plugins automatically in the user's environment.
Install Mechanism
This is an instruction-only skill (no install spec), so nothing will be installed by the skill itself. The included docs instruct users how to install the Aliyun CLI from official aliyuncli.alicdn.com releases (expected). The concern is the guidance to run 'aliyun configure set --auto-plugin-install true' — enabling automatic plugin installs may let the CLI pull code at runtime; that behavior is not declared in the manifest.
Credentials
The skill requires access to Alibaba Cloud credentials and asks for specific RAM read-only permissions (or the system policy AliyunYundunCloudFirewallReadOnlyAccess). Yet the package metadata lists no required env vars or primary credential. This omission is disproportionate and could mislead users about what secrets/permissions will be needed. The referenced least-privilege guidance is appropriate, but the package should declare the credential requirement explicitly.
Persistence & Privilege
The skill does not request permanent presence (always: false), does not modify other skills or system-wide settings, and has no install hooks. Autonomous invocation is allowed (default) but is not combined with other high-risk privileges here.
What to consider before installing
This skill appears to do what it claims (query Cloud Firewall status via the Aliyun CLI), but the package metadata does not declare the actual runtime requirements. Before installing or running the skill: 1) Confirm you have the Aliyun CLI (>=3.3.1) installed from an official source and understand that the skill will execute aliyun cloudfw commands in your environment. 2) Run the skill only from an account/profile with least-privilege read-only RAM permissions (prefer a dedicated RAM user or read-only role, not root keys). 3) Be cautious about enabling 'auto-plugin-install' in the CLI — review what plugins the CLI would install and prefer to install them manually. 4) Because the manifest omits required binaries and credentials, ask the publisher to update the package metadata to list 'aliyun' as a required binary and to declare that an Alibaba Cloud credential/profile is the primary credential. 5) If you cannot confirm the credential/policy or cannot run in a controlled/test account, do not run the skill in production environments.Like a lobster shell, security has layers — review code before you run it.
latestvk976w84a9d3w4b137848dfbg6184eqye
License
MIT-0
Free to use, modify, and redistribute. No attribution required.