alibabacloud-bailian-memory
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.run()inscripts/api_key.pyto interact with the Alibaba Cloud CLI (aliyun) for automated API key generation, workspace retrieval, and plugin installation. These are documented administrative tasks necessary for the skill's setup and trace back to official vendor tooling. - [DATA_EXPOSURE]: The skill manages
DASHSCOPE_API_KEYthrough an automated modulescripts/api_key.py. It explicitly instructs the agent to avoid hardcoding or exposing keys and handles storage securely in the standard Alibaba Cloud CLI configuration file (~/.aliyun/config.json) with restricted file permissions (0o600). - [EXTERNAL_DOWNLOADS]: The skill downloads the
aliyun-cli-modelstudioplugin using the officialaliyun plugin installcommand. These downloads originate from Alibaba Cloud's official distribution channels and are considered safe vendor resources. - [SAFE]: The skill implements a mandatory 'get → confirm → delete → verify' flow for memory deletions to prevent accidental data loss. It also uses a session-based
User-Agentfor observability and strictly communicates with official DashScope endpoints (dashscope.aliyuncs.com).
Audit Metadata