alibabacloud-dts-doc-parse
Warn
Audited by Socket on Oct 10, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS. The core purpose is coherent—cloud document parsing requires uploading files—but the trust model is not: the skill mandates a separate `dtscli` installed via download-and-execute from an OSS bucket, while external evidence indicates Alibaba's official docs use a different CLI/plugin. That mismatch, plus the black-box CLI handling credentials and uploads, and a broken manifest identity check, makes the skill high risk even without clear malicious exfiltration behavior.
Confidence: 89%Severity: 82%
Audit Metadata