alibabacloud-ebs-disk-events

Pass

Audited by Gen Agent Trust Hub on Aug 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data returned from the Alibaba Cloud EBS DescribeEvents API, including a free-text Description field. This field contains external content that could potentially be used for indirect prompt injection if an attacker can influence the event metadata.
  • Ingestion points: API output from aliyun ebs describe-events processed in SKILL.md and references/verification-method.md.
  • Boundary markers: None identified for delimiting API response content during processing.
  • Capability inventory: Shell command execution via aliyun CLI and data processing with jq and jmespath.
  • Sanitization: No specific sanitization or filtering is described for the API response fields before they are presented to the agent context.
  • [EXTERNAL_DOWNLOADS]: The installation guide references downloading the Alibaba Cloud CLI and EBS plugin from aliyuncli.alicdn.com. These are official resources provided by the vendor.
  • [DATA_EXFILTRATION]: The skill implements a session tracking mechanism by generating a unique SKILL_SESSION_ID and appending it to the --user-agent header for all CLI commands. This transmits a session identifier to the vendor's API endpoints for observability and traceability purposes.
  • [COMMAND_EXECUTION]: The skill requires the execution of shell commands using the aliyun CLI to interact with cloud services. The instructions include parameter confirmation steps to ensure user oversight before execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 12, 2026, 02:02 AM
Security Audit — agent-trust-hub — alibabacloud-ebs-disk-events