alibabacloud-agentloop-management

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). references/ai.md and references/apm.md require runtime fetching of addon templates via aliyun cms2 integration addon get and then extracting/rendering codeTemplate text (outsider-authored content from a remote service), which can include free-form template text that is inserted into the agent’s LLM context for rendering.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime installation commands that fetch and execute remote code (curl ... | bash to https://aliyuncli.alicdn.com/setup.sh) and runtime agent downloads from http://arms-apm-{regionId}.oss-{regionId}... which are executed (e.g., wget/unzip and java -javaagent), so these external URLs enable remote code execution during skill runtime.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill docs for literal high-entropy credentials. I flagged the explicit authToken value in the example "real response" JSON because it is a non-placeholder, random-looking token that is described in the docs as the LicenseKey / authentication token (sensitive). Other high-entropy-looking values in the docs were ignored because they are not credentials or are clearly examples/placeholders:
• The user-agent session-id examples (32 hex chars) are session identifiers, not access credentials — ignore.
• Workspace examples containing asterisks are redacted/masked examples — ignore.
• Template placeholders like {LicenseKey}, {workspace}, YOUR_API_KEY, etc., are documentation placeholders and intentionally ignored.
• Example PID/serviceId strings are identifiers, not credentials granting access, so I did not flag them.