alibabacloud-oss-manage-cron-upload
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the official aliyun CLI binary from Alibaba Cloud's content delivery network (alicdn.com). These resources trace back to the vendor's infrastructure and are standard for tool installation.- [COMMAND_EXECUTION]: The skill instructs the agent to execute aliyun CLI commands to verify credentials, check bucket status, and perform object uploads. It also uses local OS tools like crontab or schtasks to register scheduled tasks.- [PERSISTENCE]: The skill's primary purpose is to establish persistence by creating recurring scheduled tasks (cron jobs or Windows Task Scheduler entries) to sync local data to the cloud. This behavior is explicitly described and is the core functionality requested by the user.- [DYNAMIC_EXECUTION]: The workflow involves generating a local shell script (
oss-sync-upload.sh) that wraps the CLI commands for the scheduler to invoke. The skill includes mandatory parameter validation and regex checks to prevent command injection during script generation.- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided inputs like bucket names and local paths. - Ingestion points: User-provided parameters defined in SKILL.md (e.g., LocalSourcePath, BucketName).
- Boundary markers: Explicit instructions to validate parameters against regex patterns before use.
- Capability inventory: Shell command execution via aliyun CLI, file writing, and scheduler modification.
- Sanitization: Strict regex validation for all parameters, specifically rejecting shell metacharacters in path fields.
Audit Metadata