skills/aliyun/alibabacloud-aiops-skills/alibabacloud-mtr-network-diagnosis-customer/Gen Agent Trust Hub
alibabacloud-mtr-network-diagnosis-customer
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs remote command execution on Alibaba Cloud ECS instances using the official Cloud Assistant
run-commandAPI. This is the core functionality of the diagnostic tool and is gated by acheck-write-operation.shhook that requires user confirmation for execution-level operations. - Evidence:
mtr_ecs.pygenerates shell scripts at runtime and transmits them via theecs:RunCommandAPI action. - [EXTERNAL_DOWNLOADS]: The skill references and fetches data from external sources for configuration and diagnostics.
- Evidence:
mtr_common.pyprovides download instructions for thealiyun-clifromaliyuncli.alicdn.com. - Evidence:
mtr_analyze.pymakes HTTPS requests to the well-known serviceipinfo.ioto retrieve ISP and ASN metadata for network hops. - [DATA_EXFILTRATION]: The skill accesses local configuration files to manage cloud credentials.
- Evidence:
mtr_common.pyreads the aliyun CLI configuration file located at~/.aliyun/config.jsonto verify the availability of authentication profiles. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface area by ingesting and parsing untrusted data from external tool outputs.
- Ingestion points:
mtr_common.pyparses free-text user input, andmtr_analyze.pyparses text output from MTR and Ping commands. - Boundary markers: The skill does not use high-level delimiters for prompt interpolation but relies on strict regex-based extraction to filter inputs.
- Capability inventory: The skill possesses powerful capabilities including remote shell execution (
RunCommand) and network access. - Sanitization: Shell commands are constructed using
shlex.quoteto prevent command injection, and data extraction is limited to specific patterns (IPs, Regions, and MTR metrics).
Audit Metadata