alibabacloud-aisc-skill-inspection
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a Python wrapper script (
scripts/skill_file_check.py) to interface with the Alibaba Cloud AISC API. It executes standard CLI subcommands (submit, poll, run) to manage security scanning tasks. - [EXTERNAL_DOWNLOADS]: The skill communicates with official Alibaba Cloud API endpoints (aisc.cn-shanghai.aliyuncs.com) to submit scanning requests and retrieve results. This is normal functionality for a cloud-connected tool.
- [SAFE]: The instructions include robust safety constraints that explicitly prohibit the agent from downloading or probing user-provided URLs locally using tools like
curlorwget. This design effectively mitigates Server-Side Request Forgery (SSRF) and local execution risks by ensuring that potentially malicious files are only handled by the remote AISC scanning service. - [SAFE]: The skill uses the official
alibabacloud_credentialsSDK to handle authentication, ensuring that credentials are managed via the standard provider chain rather than being hardcoded or exposed in logs.
Audit Metadata