The Agent Skills Directory

[COMMAND_EXECUTION]: The bundled Python scripts execute commands using subprocess.run with list-based arguments and shell=False, which is a security best practice to prevent shell injection. Additionally, a dedicated _validate_command function checks for null bytes and newlines in arguments to provide defense-in-depth.
[EXTERNAL_DOWNLOADS]: The documentation references official Alibaba Cloud CLI installation scripts from aliyuncli.alicdn.com. These are official vendor resources and are documented with clear security warnings advising users to review script contents before execution rather than piping directly to bash.
[CREDENTIALS_UNSAFE]: The skill implements strict security rules regarding credentials. It explicitly forbids the agent from reading or printing access keys and instructs users to perform configuration tasks in a separate terminal session. It uses aliyun configure list only to verify profile status without exposing secret values.
[PROMPT_INJECTION]: The skill defines a mandatory 'Mutation Confirmation Protocol' and 'Parameter Confirmation' steps, ensuring that the AI agent must obtain explicit user approval before performing any cloud resource modifications, effectively mitigating risks of unauthorized actions through manipulated instructions.
[DATA_EXFILTRATION]: Data handling is localized to the user's environment via the CLI. The result analyzer script omits raw customer content from SLS logs by default, requiring explicit authorization (--include-content) to access potentially sensitive data.

alibabacloud-agentloop-evaluation