alibabacloud-bailian-memory

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run() in scripts/api_key.py to interact with the Alibaba Cloud CLI (aliyun) for automated API key generation, workspace retrieval, and plugin installation. These are documented administrative tasks necessary for the skill's setup and trace back to official vendor tooling.
  • [DATA_EXPOSURE]: The skill manages DASHSCOPE_API_KEY through an automated module scripts/api_key.py. It explicitly instructs the agent to avoid hardcoding or exposing keys and handles storage securely in the standard Alibaba Cloud CLI configuration file (~/.aliyun/config.json) with restricted file permissions (0o600).
  • [EXTERNAL_DOWNLOADS]: The skill downloads the aliyun-cli-modelstudio plugin using the official aliyun plugin install command. These downloads originate from Alibaba Cloud's official distribution channels and are considered safe vendor resources.
  • [SAFE]: The skill implements a mandatory 'get → confirm → delete → verify' flow for memory deletions to prevent accidental data loss. It also uses a session-based User-Agent for observability and strictly communicates with official DashScope endpoints (dashscope.aliyuncs.com).
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 09:42 AM
Security Audit — agent-trust-hub — alibabacloud-bailian-memory