alibabacloud-tablestore-agent-storage

Pass

Audited by Gen Agent Trust Hub on Apr 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the tablestore-agent-storage SDK and alibabacloud_credentials package from the official Python Package Index (PyPI). It also retrieves CLI tools and installation packages from Alibaba Cloud's official mirrors on alicdn.com.
  • [REMOTE_CODE_EXECUTION]: Documentation for the Aliyun CLI and ossutil includes instructions for downloading and executing shell scripts via curl | bash. These resources are hosted on official vendor infrastructure, which is a trusted source for this skill.
  • [COMMAND_EXECUTION]: The agent uses shell commands to install dependencies, manage cloud resources via the Tablestore CLI, and set up recurring synchronization tasks using system utilities like cron or openclaw.
  • [CREDENTIALS_UNSAFE]: The skill handles cloud access credentials and recommends saving them to a local JSON configuration file within the skill's dedicated directory. It explicitly instructs the agent to avoid printing secrets and to use the default credential chain for enhanced security.
  • [PROMPT_INJECTION]: The skill ingests and processes various document types (PDF, MD, Docx, etc.) from local and remote sources into a searchable knowledge base. This creates a surface for indirect prompt injection common in retrieval-augmented generation (RAG) workflows.
  • [SAFE]: All identified behaviors are legitimate and align with the skill's primary purpose of providing an integration with Alibaba Cloud services. All external dependencies and scripts originate from official vendor sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 4, 2026, 01:34 PM