The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes the official aliyun CLI tool through the subprocess module to perform API queries. It also supports automated installation of the requests library using pip if configured via the ACTIONTRAIL_AUTO_INSTALL environment variable. These operations are standard for a cloud management tool and are correctly scoped to administrative functions.
[EXTERNAL_DOWNLOADS]: The skill is configured to optionally download and install the requests package from PyPI. This is a standard dependency for the HTTP fallback backend and is only performed with explicit user opt-in.
[DATA_EXFILTRATION]: The skill performs network requests to official Alibaba Cloud endpoints (e.g., sts.aliyuncs.com and actiontrail.{region}.aliyuncs.com) to retrieve audit data. These operations target the vendor's own infrastructure and are essential for the skill's functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted audit log data which could potentially contain malicious instructions. While the skill implements robust masking for sensitive identifiers like AccessKey IDs and account UIDs, it represents a surface for indirect prompt injection if malicious content is placed within audit log fields.
Ingestion points: Audit event fields (e.g., eventName, resourceName) retrieved from the ActionTrail API in scripts/lookup_events.py.
Boundary markers: Not present in the generated Markdown output or Friendly Summary.
Capability inventory: Execution of CLI commands and network operations to official cloud endpoints.
Sanitization: The skill implements extensive masking for sensitive identifiers using logic in scripts/_cli.py, although it does not explicitly sanitize log content for natural language injection strings.

alibabacloud-actiontrail-diagnosis