alibabacloud-cfw-ips-event
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches Aliyun CLI installation scripts and binary archives from the official vendor domain
aliyuncli.alicdn.com. This is a standard setup procedure for the vendor's toolset. - [COMMAND_EXECUTION]: Utilizes the
aliyuncommand-line interface to interact with the Cloud Firewall service. The instructions include setting environment variables for timeouts and enabling an AI-specific execution mode. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from security event logs (such as event names and source IPs) which are then processed into summary reports. It provides robust mitigations, including mandatory input validation for IPs and timestamps, and strict rules against shell concatenation to prevent command injection.
- [SAFE]: Implements secure authentication practices by explicitly instructing the agent to never read, print, or ask the user for sensitive credentials like AccessKey IDs or Secrets, requiring they be configured in the environment instead.
Audit Metadata