skills/aliyun/alibabacloud-aiops-skills/alibabacloud-oss-transfer-error-code-diagnosis/Gen Agent Trust Hub
alibabacloud-oss-transfer-error-code-diagnosis
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches an index file (
llms.txt) and markdown documentation fromhelp.aliyun.comto provide verified troubleshooting information. Thealiyun.comdomain is a well-known service and is the official documentation source for the skill's vendor. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input via the
--questionand--error-codeparameters passed to its diagnostic script. - Ingestion points: User input enters the system through command-line arguments defined in
SKILL.md. - Boundary markers: Explicit boundary markers for the user input are absent in the script invocation template.
- Capability inventory: The skill performs file writes to a local cache directory (
~/.cache/oss-skill-docs/) and executes HTTP GET requests tohelp.aliyun.comviascripts/_doc_lookup.py. It does not utilize shell execution or cloud API tools. - Sanitization: The
_doc_lookup.pyscript validates that all remote URLs use thehttpsscheme and target thehelp.aliyun.comhostname before fetching data. - [COMMAND_EXECUTION]: The skill is designed to run a local Python script (
scripts/oss_transfer_error_diagnosis.py) for all diagnostic tasks. The script implementation is restricted to the Python standard library and does not use dangerous functions likesubprocess.run,os.system, oreval.
Audit Metadata