alibabacloud-odps-project-manage
Pass
Audited by Gen Agent Trust Hub on Apr 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the Alibaba Cloud CLI installation script from https://aliyuncli.alicdn.com/install.sh. This domain is part of the vendor's official content delivery network.\n- [REMOTE_CODE_EXECUTION]: The installation guide instructs users to pipe the downloaded shell script directly into bash. This is the official, vendor-documented method for installing the Aliyun CLI tool.\n- [COMMAND_EXECUTION]: The skill executes various aliyun CLI commands to list, create, and manage projects. It includes explicit 'Forbidden Actions' that prevent the agent from echoing sensitive environment variables (AK/SK) or using hardcoded credentials.\n- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill enforces secure credential handling by requiring the use of standard authentication profiles and forbidding any commands that would display raw secret keys or tokens.\n- [INDIRECT_PROMPT_INJECTION]: While the skill processes user input for project names and region IDs, it includes mandatory validation steps (e.g., non-empty name checks, parameter whitelisting for type systems) and provides clear boundary instructions to ensure user-provided values are used literally without triggering unintended command flags.
Audit Metadata