alibabacloud-dataworks-data-agent
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user prompts, local file URIs, and dataset context metadata, which are subsequently interpolated into aliyun CLI parameters.
- Ingestion points: The prompt-agent-session API parameters in SKILL.md include the 'Text' field for user messages, 'Uri' for file attachments, and double-encoded JSON 'Context'.
- Boundary markers: Absent. The skill provides no instructions for delimiting or wrapping user input to prevent it from being interpreted as instructions by the Data Agent.
- Capability inventory: The skill has the capability to execute aliyun CLI commands and access local files specified via file:/// URIs in SKILL.md.
- Sanitization: Absent. No specific sanitization or validation logic is defined for user-supplied data before it is embedded in the JSON payload of the shell command.
- [COMMAND_EXECUTION]: The skill's primary function is to execute shell commands using the aliyun CLI tool. The inclusion of user-controlled text within the --params flag (which is single-quoted in examples) presents a potential shell injection surface if the agent does not correctly escape user input when constructing the command.
- [DYNAMIC_EXECUTION]: The skill utilizes a simple Python one-liner (python3 -c "import uuid; print(uuid.uuid4())") to generate a UUID for the session-id at runtime. This is a routine use of dynamic execution for a specific utility task.
Audit Metadata