alibabacloud-ebs-disk-events
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data returned from the Alibaba Cloud EBS DescribeEvents API, including a free-text
Descriptionfield. This field contains external content that could potentially be used for indirect prompt injection if an attacker can influence the event metadata. - Ingestion points: API output from
aliyun ebs describe-eventsprocessed inSKILL.mdandreferences/verification-method.md. - Boundary markers: None identified for delimiting API response content during processing.
- Capability inventory: Shell command execution via
aliyunCLI and data processing withjqandjmespath. - Sanitization: No specific sanitization or filtering is described for the API response fields before they are presented to the agent context.
- [EXTERNAL_DOWNLOADS]: The installation guide references downloading the Alibaba Cloud CLI and EBS plugin from
aliyuncli.alicdn.com. These are official resources provided by the vendor. - [DATA_EXFILTRATION]: The skill implements a session tracking mechanism by generating a unique
SKILL_SESSION_IDand appending it to the--user-agentheader for all CLI commands. This transmits a session identifier to the vendor's API endpoints for observability and traceability purposes. - [COMMAND_EXECUTION]: The skill requires the execution of shell commands using the
aliyunCLI to interact with cloud services. The instructions include parameter confirmation steps to ensure user oversight before execution.
Audit Metadata