alibabacloud-tair-devtoolset

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the aliyun CLI and a local bash script (scripts/create-and-connect-test.sh) to perform legitimate cloud management operations such as instance creation, whitelist configuration, and backup management. This is the primary intended function of the skill.
  • [EXTERNAL_DOWNLOADS]: Documentation within the skill points to official vendor domains (aliyuncli.alicdn.com) for downloading the CLI tool and the official Redis site (download.redis.io) for the Redis client. One reference includes a network call to a well-known service (ifconfig.me) for public IP detection for whitelisting purposes.
  • [PRIVILEGE_ESCALATION]: The CLI installation guides provide standard instructions using sudo to move binaries to system-level directories, which is a common requirement for installing management tools.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where it ingests user-supplied parameters to configure cloud resources.
  • Ingestion points: User parameters like VPC_ID, VSWITCH_ID, and INSTANCE_NAME are ingested and passed to shell scripts and CLI commands (e.g., in scripts/create-and-connect-test.sh).
  • Boundary markers: The SKILL.md file mandates that the agent must confirm all user-customizable parameters before execution.
  • Capability inventory: The skill possesses extensive capabilities to create, modify, and restore Tair instances via the aliyun CLI.
  • Sanitization: The included automation script implements a validate_params function that uses regular expression checks to sanitize and validate the format of all critical inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 11:57 PM