alibabacloud-sas-overview
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes instructions to install or update the Alibaba Cloud CLI by downloading a setup script (
setup.sh) from the official vendor CDN (aliyuncli.alicdn.com) and piping it directly to the system shell. While this pattern typically carries risk, the source is a verified vendor domain associated with the skill author. - [EXTERNAL_DOWNLOADS]: The documentation provides multiple links to external binary packages for the Alibaba Cloud CLI for various operating systems (macOS, Linux, Windows) and CPU architectures. All linked resources are hosted on the vendor's official distribution infrastructure.
- [COMMAND_EXECUTION]: The skill utilizes small Python 3 snippets to generate session-unique UUIDs and to calculate relative timestamps (seconds and milliseconds) required for precise API queries against security and billing services.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided parameters such as Region IDs and Billing Cycles to construct its CLI queries. This represents an injection surface where untrusted data could influence command construction, although the skill mitigates this by focusing on read-only operations and explicitly requiring user confirmation for all parameters.
Audit Metadata