alibabacloud-ecs-diagnose
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONOBFUSCATIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the Alibaba Cloud CLI installation script and compressed binaries from
aliyuncli.alicdn.com. These are official vendor resources required for the skill to function. - [REMOTE_CODE_EXECUTION]: Installation instructions include piping a setup script from
aliyuncli.alicdn.comdirectly intobash. This is a standard and official installation method for the Alibaba Cloud CLI. - [COMMAND_EXECUTION]: The skill utilizes the
aliyuncommand-line utility to perform diagnostic operations, such as checking instance status, security group rules, and network interface configurations. - [OBFUSCATION]: In
SKILL.md, Base64 encoding is applied to thecommand-contentparameter of thealiyun ecs run-commandtool. This is a technical requirement of the Alibaba Cloud CLI for passing command payloads. The decoded content consists of standard diagnostic commands (uptime, free, df, ps). - [PRIVILEGE_ESCALATION]: Manual installation steps provided in the reference guide suggest using
sudoto move thealiyunexecutable into a system path (/usr/local/bin/), which is a common practice for installing command-line tools. - [INDIRECT_PROMPT_INJECTION]: The skill processes output from remote commands executed on ECS instances via
aliyun ecs describe-invocations. This is a necessary component of the diagnostic workflow. - Ingestion points: Command output is retrieved from remote instances via
aliyun ecs describe-invocationsinSKILL.md. - Boundary markers: None identified.
- Capability inventory: Subprocess execution via
aliyun ecs run-commandand network-based API read operations. - Sanitization: None identified.
Audit Metadata