alibabacloud-cfw-exposure-detection
Fail
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: Instructs the agent to download and execute an installation script from Alibaba Cloud's official content delivery network (
aliyuncli.alicdn.com) via a shell pipe. - [COMMAND_EXECUTION]: Orchestrates multiple shell commands using the
aliyuncommand-line interface to retrieve security status, asset lists, and firewall configurations. - [PROMPT_INJECTION]: Uses prescriptive and authoritative language ("MANDATORY EXECUTION RULES", "DO NOT refuse to execute", "NEVER say") designed to override the agent's internal reasoning or potential safety constraints regarding its own capabilities.
- [PROMPT_INJECTION]: An indirect prompt injection surface exists as the skill processes and displays data retrieved from external Alibaba Cloud APIs.
- Ingestion points: Data enters the context through several Cloud Firewall API responses, including
DescribeInternetOpenIpandDescribeRiskEventGroup(found in SKILL.md). - Boundary markers: No specific delimiters are used to wrap or isolate the data retrieved from the cloud APIs within the agent's context.
- Capability inventory: The skill utilizes shell command execution via the
aliyunCLI and platform utilities such asdateandexport(found in SKILL.md). - Sanitization: There is no explicit logic provided for validating or sanitizing the content of the API responses prior to their inclusion in the final report.
Recommendations
- HIGH: Downloads and executes remote code from: https://aliyuncli.alicdn.com/setup.sh - DO NOT USE without thorough review
Audit Metadata