alibabacloud-opc-deploy

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly auto-installs the Alibaba Cloud CLI at runtime by curling and unpacking remote binaries (e.g. "https://aliyuncli.alicdn.com/aliyun-cli-darwin-arm64-${VER}.tgz" and the Windows equivalent) and also falls back to GitHub Releases ("https://github.com/aliyun/aliyun-cli/releases"), which constitutes fetching and executing remote code as a required runtime dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to create paid cloud resources and to invoke specific billing-impacting APIs. The doc lists concrete money-incurring API calls (e.g., RunInstances / CreateInstance / swas-open CreateInstances / PurchaseRatePlan / CreateDBInstance / CreateLoadBalancer / CreateScalingGroup), enforces a literal payment-confirmation gate before making those calls, and includes CLI invocation details (run-instances, --client-token) and links to purchase APIs. This is a direct financial execution capability (it can initiate charges via Alibaba Cloud APIs), albeit guarded by confirmation gates.