alibabacloud-ecs-vpc-publicnetwork-troubleshoot

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The scripts sts_create.py, ecs_public_troubleshoot.py, and vpc_service_public_troubleshoot.py use subprocess.run and subprocess.check_output to invoke the aliyun command-line interface.
  • Evidence: In scripts/ecs_public_troubleshoot.py, call_cli executes aliyun with parameters like bssopenapi, antiddos-public, and cloudfw to retrieve diagnostic data.
  • Context: These executions are used to retrieve metadata not available via the standard Python SDK common request and are restricted to read-only diagnostic queries.
  • [DATA_EXFILTRATION]: The skill performs network requests to *.aliyuncs.com domains using the aliyun-python-sdk-core library.
  • Evidence: call_api function in diagnostic scripts communicates with Alibaba Cloud OpenAPI endpoints for ECS, VPC, and STS services.
  • Context: These operations are consistent with the skill's primary purpose of diagnosing cloud infrastructure and target official vendor API endpoints.
  • [CREDENTIALS_UNSAFE]: The skill manages authentication tokens by caching them in a local file.
  • Evidence: scripts/sts_create.py writes temporary STS credentials to scripts/.sts_cache.json with file permissions set to 0o600 (owner read/write only).
  • Context: This is a standard practice for local credential management in CLI tools to avoid passing secrets via command-line arguments, which would be visible in process lists.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 09:31 AM
Security Audit — agent-trust-hub — alibabacloud-ecs-vpc-publicnetwork-troubleshoot