alibabacloud-devops
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill contains instructions to install the Alibaba Cloud CLI using a remote shell script via
bash -c "$(curl -fsSL https://aliyuncli.alicdn.com/install.sh)". This script is hosted on the official Alibaba Cloud CDN (aliyuncli.alicdn.com) and is the standard deployment method provided by the vendor (aliyun). As the skill author matches the resource vendor, this is considered a safe and expected operation.- [EXTERNAL_DOWNLOADS]: The skill utilizes thealibabacloud-devops-mcp-serverandmcporterpackages from the npm registry. It explicitly recommends using the official Alibaba Cloud npm mirror (registry.npmmirror.com) and suggests pre-installing these dependencies to ensure a secure and predictable execution environment.- [COMMAND_EXECUTION]: The instructions guide the agent to perform environment setup and DevOps operations using shell commands (aliyun devops,npx). These commands are necessary for the skill's primary function and are implemented with specific guidance on token security, including explicit rules against printing or leaking credentials.- [DATA_EXFILTRATION]: While the skill manages sensitive Personal Access Tokens for Alibaba Cloud Yunxiao, it includes robust security guidelines for the agent, such as never asking the user for plaintext tokens and never echoing token values in the console. All network operations are directed at official Alibaba Cloud API endpoints.
Audit Metadata