alibabacloud-cli-guidance
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of the official Alibaba Cloud CLI through scripts and archives hosted on aliyuncli.alicdn.com. These are legitimate vendor resources provided for tool installation and are documented as such.- [REMOTE_CODE_EXECUTION]: Installation instructions include commands to execute a remote shell script (setup.sh) from the vendor's domain via curl piped to bash. While this pattern typically carries risk, in this context it is the official installation method provided by aliyun (the skill author and vendor) for their command-line utility.- [COMMAND_EXECUTION]: The skill enables the agent to execute cloud management commands using the aliyun CLI or MCP tools. It provides structured guidance to ensure commands are formed correctly and securely, prioritizing managed MCP tools over local shell execution.- [CREDENTIALS_UNSAFE]: The documentation covers the setup of cloud credentials (AccessKeys, STS tokens). It mitigates risks by including a dedicated security guide (references/installation-guide.md and references/ram-policies.md) that promotes least-privilege access, the use of temporary tokens, and secure local storage practices. It explicitly warns users never to commit credentials to version control.
Audit Metadata