alibabacloud-waf-lua-extension-dev
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive instructions for developing WAF extensions within a highly restricted environment. It explicitly documents the disabling of dangerous Lua standard libraries (os, io, package, debug) and functions (load, loadstring, dofile, loadfile, collectgarbage), which aligns with security best practices for sandboxed script execution environments.
- [SAFE]: External resource references, such as the Alibaba Cloud official documentation and the aliwaf.* API namespace, are legitimate vendor-owned resources from the skill author (aliyun).
- [SAFE]: The skill encourages secure development practices by instructing the agent to use KMS-integrated parameters for secrets instead of hardcoded credentials.
- [SAFE]: The coding conventions and review checklists included in the skill promote robust and secure script development, focusing on preventing runtime timeouts (which would lead to fail-open scenarios) and ensuring that logic handles missing parameters safely to avoid site-wide false positives.
Audit Metadata