skills/aliyun/alibabacloud-aiops-skills/alibabacloud-waf-rule-effectiveness-check/Gen Agent Trust Hub
alibabacloud-waf-rule-effectiveness-check
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads the official Alibabacloud CLI binary and installer script from the vendor's CDN (
aliyuncli.alicdn.com). These are verified vendor resources. - [COMMAND_EXECUTION]: Executes read-only WAF configuration queries via the
aliyunCLI. Includes standard installation commands likesudo mvto place the utility in the system path. - [REMOTE_CODE_EXECUTION]: References the official vendor setup script (
setup.sh) for automated CLI installation. This is a standard vendor-provided convenience method. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes WAF logs and configuration state, which are external data sources.
- Ingestion points: Fetches rule configurations and log metadata via
aliyun-clicalls inSKILL.mdandcheck_rule_effectiveness.py. - Boundary markers: Explicitly instructs the agent to query specific, structured fields (e.g.,
TemplateStatus,DefenseOrigin) to verify platform-side state. - Capability inventory: Restricts actions to read-only API calls; does not permit modifications to WAF settings or arbitrary system commands.
- Sanitization: The Python diagnostic script uses structured
subprocess.runcalls with list arguments and no shell, preventing command injection from untrusted configuration values.
Audit Metadata