alibabacloud-dataworks-data-agent

Pass

Audited by Gen Agent Trust Hub on Aug 31, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user prompts, local file URIs, and dataset context metadata, which are subsequently interpolated into aliyun CLI parameters.
  • Ingestion points: The prompt-agent-session API parameters in SKILL.md include the 'Text' field for user messages, 'Uri' for file attachments, and double-encoded JSON 'Context'.
  • Boundary markers: Absent. The skill provides no instructions for delimiting or wrapping user input to prevent it from being interpreted as instructions by the Data Agent.
  • Capability inventory: The skill has the capability to execute aliyun CLI commands and access local files specified via file:/// URIs in SKILL.md.
  • Sanitization: Absent. No specific sanitization or validation logic is defined for user-supplied data before it is embedded in the JSON payload of the shell command.
  • [COMMAND_EXECUTION]: The skill's primary function is to execute shell commands using the aliyun CLI tool. The inclusion of user-controlled text within the --params flag (which is single-quoted in examples) presents a potential shell injection surface if the agent does not correctly escape user input when constructing the command.
  • [DYNAMIC_EXECUTION]: The skill utilizes a simple Python one-liner (python3 -c "import uuid; print(uuid.uuid4())") to generate a UUID for the session-id at runtime. This is a routine use of dynamic execution for a specific utility task.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 31, 2026, 08:42 AM
Security Audit — agent-trust-hub — alibabacloud-dataworks-data-agent