The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes the official vendor CLI tool (aliyun sts get-caller-identity) to verify the account identity. The command is executed via subprocess.run with a statically defined argument list, which prevents command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill performs HTTP GET requests to help.aliyun.com to retrieve official documentation excerpts. The host is whitelisted within the script logic, ensuring that external data is only fetched from the vendor's trusted documentation site.
[INDIRECT_PROMPT_INJECTION]: The skill processes content from the vendor's official documentation site to provide relevant guidance.
Ingestion points: Text is fetched from help.aliyun.com by the scripts/_doc_lookup.py module.
Boundary markers: Delimiters are not explicitly used for the documentation excerpts in the final response context.
Capability inventory: The skill is limited to read-only OSS metadata queries via the oss2 SDK and identity verification via the aliyun CLI.
Sanitization: The _clean_excerpt function in scripts/_doc_lookup.py sanitizes the input by stripping markdown formatting and potential injection markers before processing.
[DATA_EXFILTRATION]: The skill initiates an anonymous, credential-free HTTPS GET request to the OSS bucket's default endpoint (e.g., aliyuncs.com) to observe response headers. This is a diagnostic procedure used to attribute file download versus rendering behavior and does not expose sensitive data.

alibabacloud-oss-static-website-diagnosis