skills/aliyun/alibabacloud-aiops-skills/alibabacloud-migration-cas-cutover-review/Gen Agent Trust Hub
alibabacloud-migration-cas-cutover-review
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to execute a local Python script
scripts/cutover_reviewer.pyto perform its primary function. It also specifies the use of standard filesystem commands likelsandfindto locate user-supplied Excel manuals when the path is not explicitly provided. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data from Excel (.xlsx) workbooks. This presents a potential surface for indirect prompt injection if the workbook contains malicious instructions meant to influence the agent's response. The skill mitigates this risk by utilizing a specialized script that performs keyword and structural analysis rather than direct instruction execution, and by explicitly instructing the agent that the tool's output is for reference only.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of
openpyxl, a well-known and widely-used third-party Python library for reading and writing Excel files. This is a standard dependency for the skill's stated purpose. - [DATA_EXFILTRATION]: The skill includes a proactive desensitization mechanism in
scripts/cutover_reviewer.pythat automatically redacts sensitive information such as IP addresses, email addresses, phone numbers, and Alibaba Cloud instance IDs from the generated review reports to prevent accidental data exposure.
Audit Metadata