alibabacloud-dataphin-skills
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill kit executes Dataphin management commands using the official
aliyunCLI and Python scripts. This is the core functionality intended for DevOps automation and resource management within the Dataphin platform. - [EXTERNAL_DOWNLOADS]: Documentation and scripts facilitate the installation of official Alibaba Cloud tools from
aliyuncli.alicdn.comand recognized package registries. These sources are considered well-known and trusted for the intended usage. - [INDIRECT_PROMPT_INJECTION]: The skill provides capabilities to execute user-defined SQL and import YAML/JSON configurations. While this ingestion surface exists, the instructions explicitly require the agent to obtain human-in-the-loop (HITL) confirmation for all write and update operations, which effectively mitigates the risk of unauthorized or malicious execution.
- [DYNAMIC_EXECUTION]: Some internal scripts utilize Python's
importlibto load local validation modules. These operations are performed on static, local file paths within the skill's own directory structure and do not involve loading unverified external code at runtime.
Audit Metadata