alibabacloud-tair-ai-assistant
Pass
Audited by Gen Agent Trust Hub on Apr 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Aliyun CLI installation script from 'https://aliyuncli.alicdn.com/install.sh', which is the official distribution endpoint for the vendor's command-line tools.
- [REMOTE_CODE_EXECUTION]: The installation guide uses a pattern where a remote script is piped to bash. Since this script is hosted on the official vendor infrastructure, it represents a standard and legitimate installation method for this tool.
- [COMMAND_EXECUTION]: The 'scripts/call_yaochi_agent.sh' script executes shell commands via the 'aliyun' CLI and 'jq'. It follows best practices by using Bash array expansion to prevent shell injection and implements specific length and character set validation for session and profile parameters.
- [PROMPT_INJECTION]: The skill accepts natural language queries which enter the system through the 'QUERY' variable in 'scripts/call_yaochi_agent.sh'. While explicit boundary markers are not used, the skill's capabilities are restricted to the 'aliyun' CLI DAS plugin, and the workflow is protected by length-based input sanitization and a requirement for the agent to confirm all parameters with the user before execution.
Audit Metadata