alibabacloud-oss-transfer-error-code-diagnosis

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches an index file (llms.txt) and markdown documentation from help.aliyun.com to provide verified troubleshooting information. The aliyun.com domain is a well-known service and is the official documentation source for the skill's vendor.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input via the --question and --error-code parameters passed to its diagnostic script.
  • Ingestion points: User input enters the system through command-line arguments defined in SKILL.md.
  • Boundary markers: Explicit boundary markers for the user input are absent in the script invocation template.
  • Capability inventory: The skill performs file writes to a local cache directory (~/.cache/oss-skill-docs/) and executes HTTP GET requests to help.aliyun.com via scripts/_doc_lookup.py. It does not utilize shell execution or cloud API tools.
  • Sanitization: The _doc_lookup.py script validates that all remote URLs use the https scheme and target the help.aliyun.com hostname before fetching data.
  • [COMMAND_EXECUTION]: The skill is designed to run a local Python script (scripts/oss_transfer_error_diagnosis.py) for all diagnostic tasks. The script implementation is restricted to the Python standard library and does not use dangerous functions like subprocess.run, os.system, or eval.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 02:20 AM