alibabacloud-terraform-import

SUSPICIOUS. The skill's capabilities mostly match its stated Alibaba Cloud Terraform import purpose, and its documented endpoints/install sources are largely official. However, the mandatory use of an MCP CallCLI intermediary for authenticated cloud API access introduces a nontrivial trust boundary, and the skill has broad authority to enumerate account resources and mutate local Terraform state. No clear credential theft, covert behavior, or malicious exfiltration is evident, so this is not malware, but it carries medium security risk.