The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes the official aliyun CLI via a Python wrapper. The execution uses subprocess.run with shell=False and performs rigorous validation on all dynamic arguments, including regex checks for metric IDs and range checks for pagination parameters.
[EXTERNAL_DOWNLOADS]: The documentation provides instructions for installing the Aliyun CLI from official vendor sources on GitHub. These instructions correctly mandate SHA256 checksum verification to ensure the integrity of the downloaded binaries before execution.
[DYNAMIC_EXECUTION]: The helper script dynamically constructs CLI commands from a hardcoded allowlist of read-only API actions (list-evaluation-metadata, list-evaluation-results, list-evaluation-metric-details). It uses shutil.which and os.path.realpath to resolve the executable path securely.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from cloud API responses to generate Markdown reports. While this represents a data ingestion surface, the risk is mitigated by the skill's read-only nature and the use of structured JSON parsing before text generation.

alibabacloud-governance-evaluation-report