alibabacloud-core

The skill repeatedly authorizes autonomous execution of local commands, cloud discovery, file generation, Terraform imports, and even optional package installation with only limited confirmation points. In a high-impact cloud/IaC context, this can lead to unintended host changes, writes to the working directory, imports against the wrong account or region, and large-scale state manipulation before the user has reviewed each sensitive action.

The installation example recommends non-interactive mode with -y, explicitly skipping confirmation for skill installation. This reduces human oversight for an action that can modify the environment, install globally, and pull in transitive content (--full-depth) from packages or dependent skills. In the context of an agent skill marketplace, suppressing confirmation makes accidental or over-broad installs materially more likely.

The skill directs the agent to perform network access and local file reads/validation activities, but these capabilities are not transparently declared as permissions. This creates a trust and review gap: operators may approve or install the skill expecting only code generation, while the workflow also instructs external metadata retrieval and local checker usage.

The skill metadata declares only Alibaba Cloud MCP tools, but the workflow later relies on reading a local validator script path and interacting with the local filesystem. This hidden capability increases the effective privilege surface and can mislead reviewers or orchestrators that rely on declared permissions for isolation decisions.

The skill instructs the agent to use environment access, read and write arbitrary files in a target directory, and execute shell commands, yet no declared permissions are present to make those capabilities explicit or constrain them. This creates a trust and containment problem: callers may invoke what appears to be a code-generation skill without realizing it can modify the filesystem and run commands, increasing the chance of unintended side effects or abuse if the skill is triggered in a sensitive workspace.

The skill instructs the agent to execute a generated CLI command after discovery and generation steps, but it does not require strict validation that the generated command exactly matches user intent, approved API/action, and safe parameter constraints before execution. In a skill whose core purpose is driving cloud administrative actions, this creates a realistic output-injection risk: unsafe, over-privileged, or user-manipulated command content could be propagated into remote execution, potentially causing unauthorized state changes or costly operations.

The skill recommends piping a remotely fetched script directly into bash, which creates a classic supply-chain and remote code execution risk. If the hosting endpoint, network path, or delivered script is compromised, the user will execute attacker-controlled code immediately, often with the user's privileges.

Although the skill says it only suggests commands, its documented workflow writes attacker-influenced command strings to /tmp and runs a local Python validator against them. That creates real side effects and a local execution path, undermining the 'suggest-only' safety model and potentially exposing the host to parser or toolchain abuse.

The skill explicitly instructs fallback to external HTTP fetching plus local shell and python command execution for metadata extraction. For a code-generation skill, this unnecessarily expands the attack surface and can lead the agent to access remote content and run local commands based on adversarial or malformed inputs.

The skill instructs the agent to create a local file and invoke python3 on a local script without a strong functional need visible to the user. This expands the attack surface from cloud-command suggestion into host interaction, which can be abused if generated content or environment assumptions trigger unsafe behavior in the validator path.

The skill states that it is read-only and creates no resources, but later instructs the agent to install additional skills using npx commands. Installation changes the local or global environment, may fetch and execute package-managed content, and can introduce code from downstream skills, so the read-only claim is materially misleading. This increases the chance an agent or user will approve actions under a false assumption of safety.

The skill contains conflicting guidance: it says to use only the local alibabacloud-core MCP server, yet earlier instructions authorize HTTP fetching and local shell commands. Such contradictions undermine safety boundaries and make it more likely the agent will choose the broader, riskier execution path.

The file explicitly tells users not to include shell metacharacters in CallCLI input, but later includes examples such as 2>&1 for ACK and FC commands. This inconsistency can cause unsafe copying of command strings into the MCP tool or local shell contexts, undermining the stated safety boundary and increasing the risk of command misuse or injection-adjacent behavior.

The trigger list contains very broad phrases such as '阿里云' and '帮我找一个 skill', which can match ordinary conversation and cause the skill to activate in contexts where the user did not actually request catalog search or installation guidance. Unintended invocation is risky here because the skill can steer the agent toward network lookups and optional package installation workflows. The danger is amplified by the skill's broad Alibaba Cloud scope and install guidance.

The workflow instructs writing generated content to /tmp/aliyun-runscript.py and repeatedly validating it without clearly surfacing that a local file will be created or overwritten. While /tmp is lower risk than arbitrary paths, silent file creation still violates least surprise and can affect local state unexpectedly.

The skill instructs users to place long-lived cloud credentials in environment variables without an explicit warning about shell history, process inheritance, CI log leakage, or preferring short-lived credentials. In a cloud administration context, this can lead to credential exposure and unauthorized access if users copy these patterns into shared or poorly isolated environments.

These RAM and KMS discovery commands enumerate identity objects, attached policies, and key metadata, all of which are sensitive security-relevant information. In a skill designed for Terraform import and resource discovery, exposing such commands without an explicit warning or least-privilege guidance makes accidental over-collection and disclosure more likely.

RDS, Redis, and MongoDB inspection commands can reveal database names, account names, connection addresses, IP whitelists, and other configuration details that materially aid reconnaissance. In the context of an import/migration skill, this is more dangerous because broad discovery is expected, so the absence of explicit sensitivity warnings increases the chance that confidential infrastructure details will be collected or surfaced unnecessarily.

The workflow silently writes generated commands to a local file despite presenting itself as a command-suggestion skill. Lack of disclosure matters because user prompts may contain sensitive identifiers, and persisting them locally creates unnecessary data-retention and privacy risk on the host.

The documentation explicitly includes --insecure as a way to force HTTP, which can disable transport security and expose credentials, tokens, and API payloads to interception or tampering. In a CLI guidance skill, this is more dangerous because users may copy commands directly into production workflows, and the warning is too brief to adequately discourage unsafe use.

The document includes an installation command that performs a global package/skill install with -g -y, which suppresses confirmation and can modify the user's environment immediately. In a verification guide, this is risky because readers may execute it during testing without a clear warning about system changes, trust implications, or the need to review the package/skill before installation.

The examples send user-derived search phrases directly to an external Alibaba Cloud endpoint without any privacy notice, minimization guidance, or warning against including secrets, internal project names, or sensitive business context. In a skill-discovery workflow, users may paste operational needs or internal standards queries that can leak confidential information to a third-party service.

The security group templates include an ingress rule allowing TCP/80 from 0.0.0.0/0 and an egress rule allowing all traffic to 0.0.0.0/0, but the surrounding guidance does not warn that these are internet-exposed defaults that may be unsafe for many environments. In an import/migration skill, users may copy these patterns directly into production Terraform, normalizing overly permissive network access and increasing exposure of workloads to the public internet.

The guidance recommends using --log-level debug and states it reveals the full request/response cycle, including serialized parameters and response bodies, but it does not warn that these logs may contain credentials, tokens, request signatures, or sensitive cloud resource data. In a CLI guidance skill, users may copy this advice directly into real production environments, increasing the likelihood of accidental secret exposure in terminals, shell history, CI logs, or shared troubleshooting output.

The guide recommends executing a remote install script directly via curl piped to bash, which runs downloaded code without prior inspection or integrity verification. In an agent skill context, this is more dangerous because users or automations may copy-paste or execute the command verbatim, so a compromised CDN, MITM in weaker environments, or malicious upstream change could lead to arbitrary code execution.