The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands, specifically curl for downloading API metadata and python3 for running a local validation script (check_sandbox.py) and processing JSON data.
[EXTERNAL_DOWNLOADS]: Fetches API definitions and cloud product metadata from official Alibaba Cloud domains (api.aliyun.com and next.api.aliyun.com). These sources are owned by the skill author (aliyun) and are used for legitimate functional discovery.
[SAFE]: The skill incorporates a robust safety mechanism via scripts/check_sandbox.py, which validates generated code against a strict whitelist of modules and forbids dangerous operations such as reflection, OS access, and credential extraction. This prevents the generation of malicious code that could harm the user's environment.
[PROMPT_INJECTION]: The skill processes user-provided natural language requests to generate executable code.
Ingestion points: User-provided cloud operation requests in SKILL.md workflow.
Boundary markers: The skill uses a predefined 'Sandbox Contract' and validation script to delineate safe behavior.
Capability inventory: The agent can perform subprocess execution (curl, python3) and file system writes to /tmp for validation purposes.
Sanitization: The check_sandbox.py script performs regex-based auditing of all generated code to block forbidden imports (os, subprocess, requests) and high-risk functions (eval, exec) before the output is shown to the user.

alibabacloud-mcp-core-script-generate