alibabacloud-agent-toolkit-install
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill utilizes pipe-to-shell installation patterns for 'uv' and the Alibaba Cloud CLI. Specifically, it executes
curl -LsSf https://astral.sh/uv/install.sh | shandbash -c "$(curl -fsSL https://aliyuncli.alicdn.com/install.sh)". These resources originate from well-known services and the official vendor infrastructure associated with the skill author. - [EXTERNAL_DOWNLOADS]: The skill downloads the agent toolkit using
npx openplugin aliyun/alibabacloud-agent-toolkit, fetching packages from the official NPM registry. - [COMMAND_EXECUTION]: Extensive use of shell commands to manage environment state, including
uv,aliyunCLI, andnpx. The skill also includes a Windows PowerShell script (scripts/install-aliyun-cli-windows.ps1) that downloads the CLI binary fromaliyuncli.alicdn.comand updates the user's PATH environment variable. - [INDIRECT_PROMPT_INJECTION]: The skill processes output from external CLI tools.
- Ingestion points: Commands in
SKILL.md(Steps 3, 5, 6) capture CLI output fromaliyun sts get-caller-identityandaliyun openapiexplorer. - Boundary markers: None identified.
- Capability inventory: The skill has the capability to execute shell commands and cloud API calls across several steps.
- Sanitization: No specific sanitization or escaping of the CLI output is implemented before the agent interprets the results.
Audit Metadata