The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes security incident data from an external API (Alibaba Cloud Security Center), which could theoretically contain malicious instructions.\n
Ingestion points: Incident lists and details retrieved via list-incidents and get-incident commands in SKILL.md.\n
Boundary markers: The skill includes specific instructions to mask IP addresses and summarize data rather than providing raw JSON in user-facing output.\n
Capability inventory: Shell execution of Aliyun CLI commands as seen in SKILL.md.\n
Sanitization: Explicit policy for masking sensitive data (e.g., 192.168.1.100 to 192.168.*.***) is documented in the Output Handling section of SKILL.md.\n- [REMOTE_CODE_EXECUTION]: Documentation refers to a Python script that is not provided in the skill package, making its behavior unverifiable.\n
Evidence: references/ram-policies.md and references/verification-method.md instruct the user or agent to execute python3 scripts/siem_client.py.\n
Context: While the script appears to be for verification, the absence of the source code prevents a full security audit of its functionality.\n- [COMMAND_EXECUTION]: The skill uses shell commands for environment setup and data processing.\n
Evidence: SKILL.md uses shell expansion for timestamp calculation: START=$(($(date -v-7d +%s) * 1000)). It also uses aliyun plugin install to manage functional extensions.\n- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the Aliyun CLI binary from a remote server.\n
Evidence: references/cli-installation-guide.md contains links to https://aliyuncli.alicdn.com/.\n
Context: The source is the official Alibaba Cloud CDN, representing a trusted vendor resource according to author context.

alibabacloud-sas-incident-manage