alibabacloud-cdn-refresh-preload
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external tools including the aliyun CLI, curl, dig, and openssl via subprocess for diagnostic purposes. These calls are found in
scripts/cdn_refresh_preload.py,scripts/cdn_probe.py, andscripts/sts_token.py. - [SAFE]: Command execution is secured in
scripts/cdn_probe.pyusingshlex.splitandsubprocess.run(shell=False). It implements a robust validation layer that checks for shell metacharacters, enforces a binary whitelist, and uses an argument blacklist to prevent unauthorized file writes or data exfiltration via curl or openssl. - [SAFE]: The skill uses
aliyun sts get-caller-identityto verify identity and derive account information for reports. It explicitly avoids manual credential handling, instructing users and the agent to rely on the platform's default CLI configuration (~/.aliyun/config.json), which is a secure identity management practice. - [SAFE]: The skill ingests external data from cloud APIs and HTTP headers to generate diagnostic reports. This attack surface is mitigated by the use of structured report templates and the restricted, read-only scope of the underlying scripts.
Audit Metadata