alibabacloud-cadt-deploy-on-aliyun
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a custom CLI dispatcher and Python library to execute local build tools (Maven, Gradle, npm, pip, Go) and the official
aliyunCLI. This behavior is the primary intended function of the skill for orchestrating cloud deployments. - [EXTERNAL_DOWNLOADS]: The skill facilitates the transfer of application artifacts via Alibaba Cloud Object Storage Service (OSS). It also manages a local Python virtual environment, downloading and installing standard dependencies like
jsonschemafrom official registries. - [PROMPT_INJECTION]: The skill processes user-provided deployment scripts and build configurations. To mitigate the risk of indirect prompt injection, it implements mandatory HITL (Human-In-The-Loop) gates, such as the 'G4 Install Checklist', which requires the user to review and confirm the full deployment configuration before any write operations are executed.
- [DATA_EXFILTRATION]: The skill accesses local cloud configuration files (e.g.,
~/.aliyun/config.json) and account identity information to authorize API calls. This data is handled exclusively through official Alibaba Cloud CLI tools and SDKs, consistent with the vendor's legitimate deployment operations.
Audit Metadata