skills/aliyun/alibabacloud-aiops-skills/alibabacloud-web-application-attacks-analysis/Gen Agent Trust Hub
alibabacloud-web-application-attacks-analysis
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to execute a local Python script,
scripts/log_analyzer.py, to analyze log files. The script is self-contained and does not use external libraries or network resources. - [INDIRECT_PROMPT_INJECTION]: The skill processes external web access logs, which are untrusted data sources.
- Ingestion points: The
scripts/log_analyzer.pyscript reads and parses log files provided by the user. - Boundary markers: The agent is instructed to report findings only from the 'Executive Summary' and 'Structured Findings' sections of the generated report, creating a clear separation between data processing and the final response.
- Capability inventory: The skill is limited to reading local files and executing the local analyzer script; it has no network access for data exfiltration.
- Sanitization: The analyzer script uses regex for parsing and truncates long strings (e.g., URLs) in the report, reducing the likelihood that a malicious log entry could influence the agent's behavior.
Audit Metadata