alibabacloud-ecs-install-extension

SUSPICIOUS. The core behavior aligns with the stated purpose and mostly uses official Alibaba Cloud tooling and APIs, so this is not confirmed malware. However, the skill has meaningful security risk because it performs high-impact remote installation actions, mandates plugin update/auto-plugin installation, references an inconsistent GitHub release repo for manual plugin fallback, writes full execution parameters to temp files, and invokes another skill for permission handling.

This fragment documents a legitimate cloud administration workflow, but it provides a high-impact mechanism for executing remotely supplied installation templates on ECS instances. It does not itself show malware or intentional sabotage. The main risk is trust in the Alibaba Cloud OOS templates, package sources, RAM permissions, and user-supplied parameters, plus possible exposure or tampering of files stored in /tmp. Review the referenced templates and package contents before execution.