alibabacloud-tablestore-agent-storage
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
tablestore-agent-storageSDK andalibabacloud_credentialspackage from the official Python Package Index (PyPI). It also retrieves CLI tools and installation packages from Alibaba Cloud's official mirrors onalicdn.com. - [REMOTE_CODE_EXECUTION]: Documentation for the Aliyun CLI and
ossutilincludes instructions for downloading and executing shell scripts viacurl | bash. These resources are hosted on official vendor infrastructure, which is a trusted source for this skill. - [COMMAND_EXECUTION]: The agent uses shell commands to install dependencies, manage cloud resources via the Tablestore CLI, and set up recurring synchronization tasks using system utilities like
cronoropenclaw. - [CREDENTIALS_UNSAFE]: The skill handles cloud access credentials and recommends saving them to a local JSON configuration file within the skill's dedicated directory. It explicitly instructs the agent to avoid printing secrets and to use the default credential chain for enhanced security.
- [PROMPT_INJECTION]: The skill ingests and processes various document types (PDF, MD, Docx, etc.) from local and remote sources into a searchable knowledge base. This creates a surface for indirect prompt injection common in retrieval-augmented generation (RAG) workflows.
- [SAFE]: All identified behaviors are legitimate and align with the skill's primary purpose of providing an integration with Alibaba Cloud services. All external dependencies and scripts originate from official vendor sources.
Audit Metadata