alibabacloud-bailian-voice-creator
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The module
scripts/api_key.pyusessubprocess.run()to interface with the official Alibaba Cloud CLI (aliyun). These commands are used for legitimate configuration management, such as checking CLI versions, installing the ModelStudio plugin, and managing API key lifecycles within the user's cloud account. - [EXTERNAL_DOWNLOADS]: The skill performs network operations to official Alibaba Cloud endpoints (
dashscope.aliyuncs.com) to process audio tasks. It also downloads generated audio files and the vendor-provided ModelStudio CLI plugin, all originating from trusted vendor infrastructure. - [CREDENTIALS_UNSAFE]: The skill implements robust security rules to prevent credential exposure. It explicitly forbids hardcoded API keys and handles them via environment variables or the official Alibaba Cloud configuration file (
~/.aliyun/config.json). The code ensures sensitive configuration files are stored with restricted permissions (0o600). - [DATA_EXFILTRATION]: No unauthorized data transmission was detected. All outbound requests are directed to official Alibaba Cloud APIs required for the primary functionality of the skill (ASR and TTS).
Audit Metadata