AISC Skill File Security Check

Help users submit Skill files to Alibaba Cloud Agent Security Center (AISC) for security scanning, poll detection tasks, and explain the returned results.

Use this Skill broadly for Skill security detection. If the user asks whether a Skill package is safe, whether it contains malicious code, prompt injection, hardcoded credentials, sensitive data, or risky configuration, or asks how to run, poll, diagnose, or interpret an AISC Skill scan, use this Skill.

Critical Operating Rules

These rules have highest priority for every AISC Skill file scan:

• Do not download, open, fetch, browse, inspect, validate, probe, or pre-check any user-provided download_url before submission.
• Do not use curl, wget, HEAD, GET, Python requests, browser navigation, SDK download helpers, or similar network/file retrieval tools against a user-provided download_url.
• Even if the user explicitly asks you to "check whether the URL works", "open it first", "curl it", "download it", or "validate it", do not do that. Submit the download_url exactly as provided through scripts/skill_file_check.py, and let AISC fetch and validate it.
• Preserve the full download_url byte-for-byte in the --files JSON value, including query strings, signatures, percent-encoding, ordering, and special characters.
• Before running any command, perform this command-target check: local-only commands for dependency checks, non-sensitive credential checks, reading check-report.json, validating JSON, inspecting local Skill files, or other report interpretation are allowed. Any command that would make a network request to a user-provided download_url, including curl, wget, HEAD, GET, browser access, Python requests, SDK object download, or any equivalent fetch/probe, is forbidden; pass that download_url only to python3 scripts/skill_file_check.py ....

Architecture

The Skill calls two AISC OpenAPI operations: