The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run and subprocess.Popen to execute the Alibaba Cloud CLI (aliyun). These calls are performed using list-based argument passing rather than shell strings, and all user-supplied inputs (Instance IDs, IP addresses, VPC IDs) are strictly validated against specific regular expressions in scripts/net_common.py to prevent command injection.
[EXTERNAL_DOWNLOADS]: The references/cli-installation-guide.md file provides instructions to download the official Alibaba Cloud CLI from aliyuncli.alicdn.com. As this domain is an official vendor resource for aliyun, the download is considered safe.
[DATA_EXFILTRATION]: The skill implements a strict isolation policy documented in SKILL.md that forbids the agent from inspecting or reporting on the runner's local environment (e.g., listening ports, local files, or processes). It uses a local guard file mechanism (.network_diag_workflow_blocked) to ensure no cloud queries are performed until the user has provided specific cloud endpoints.
[CREDENTIALS_UNSAFE]: The skill checks for environment variables (ALIBABA_CLOUD_ACCESS_KEY_ID, etc.) and the presence of the default CLI configuration file ~/.aliyun/config.json to verify the environment. It does not hardcode, store, or exfiltrate these credentials, relying instead on the official CLI's internal authentication chain.

alibabacloud-network-diagnose