alibabacloud-dataworks-data-ops
Fail
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Aliyun CLI installation script and binaries from official Alibaba Cloud domains (aliyuncli.alicdn.com).
- [REMOTE_CODE_EXECUTION]: Instructs the user to download and execute the vendor's official setup script (setup.sh) by piping it directly to bash. This is the documented installation method for the Aliyun CLI.
- [COMMAND_EXECUTION]: Utilizes the aliyun command-line interface to interact with DataWorks APIs. It also performs standard shell operations for calculating business dates and managing file installation (e.g., date, tar, mv).
- [PRIVILEGE_ESCALATION]: Includes instructions to use sudo for moving the CLI binary to a system path (/usr/local/bin/), which is a standard procedure for installing command-line tools.
- [INDIRECT_PROMPT_INJECTION]: The skill represents a vulnerability surface for indirect prompt injection because it ingests untrusted data that could contain malicious instructions.
- Ingestion points: Reads task instance logs and workflow details via get-task-instance-log and get-workflow (SKILL.md, references/related-commands.md).
- Boundary markers: No explicit delimiting or 'ignore' instructions are used when processing the ingested log content.
- Capability inventory: The skill can execute various aliyun CLI commands to query and manage DataWorks resources.
- Sanitization: There is no evidence of sanitization or filtering applied to the ingested log content before it is displayed or used in the agent's context.
Recommendations
- HIGH: Downloads and executes remote code from: https://aliyuncli.alicdn.com/setup.sh - DO NOT USE without thorough review
Audit Metadata