alibabacloud-live-assistant
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes subprocess calls to interact with system utilities such as ping, traceroute, and the Aliyun CLI. These calls are implemented using list-based arguments to prevent shell injection, and the operations are confined to diagnostic probing as requested by the user.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external diagnostic logs to identify traffic abuse. This ingestion surface is managed through programmatic, regular expression-based parsing within the scripts, with the resulting statistics being interpreted by the agent under predefined diagnostic guidelines.
- [EXTERNAL_DOWNLOADS]: The skill connects to ipinfo.io (a well-known geolocation service) and fetches official logs from Alibaba Cloud infrastructure to provide network and usage insights. These requests target reputable endpoints and are necessary for the skill's primary diagnostic functions.
- [SAFE]: The skill implements active secret redaction for cloud authentication parameters and strictly adheres to a read-only policy for cloud services, mitigating risks of accidental configuration changes or credential leakage.
Audit Metadata