alibabacloud-mse-nacos-inspection
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill guides the user to download the Alibaba Cloud CLI binary from the official vendor distribution domain (
aliyuncli.alicdn.com). These references are consistent with the skill's stated purpose and originate from the author's infrastructure. - [COMMAND_EXECUTION]: The skill utilizes the
aliyunCLI andcurlto perform read-only queries against cloud services. These operations are restricted to obtaining instance metadata and monitoring metrics. - [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes data from external cloud APIs.
- Ingestion points: Monitoring metrics from Prometheus HTTP APIs and instance metadata from MSE cluster listing commands.
- Boundary markers: Not explicitly defined in the prompt templates.
- Capability inventory: Executes cloud API commands and HTTP requests via shell.
- Sanitization: Uses Python's
urllib.parsemodule to safely encode PromQL query parameters before interpolation, mitigating command and query injection risks.
Audit Metadata