dataworks-open-api
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes scripts that fetch API documentation and metadata from official vendor domains such as help.aliyun.com and next.api.aliyun.com. These downloads are used solely for dynamic API discovery and parameter schema validation, which is a legitimate and standard operation for this type of skill. Findings related to these downloads are considered safe as they target the author's own official infrastructure.
- [COMMAND_EXECUTION]: Python scripts within the scripts/ directory use the subprocess module to execute curl as a fallback for fetching data. These commands are constructed using fixed parameters and target official vendor URLs, presenting no risk of command injection or malicious execution. The use of subprocess for network utility calls in this context is benign.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external help pages and JSON metadata to identify available tools. While this creates an ingestion surface for external instructions, the data sources are restricted to official Alibaba Cloud documentation. The risk is minimized by the use of authoritative vendor sources.
- [CREDENTIALS_UNSAFE]: The skill handles authentication via standard Alibaba Cloud environment variables and local credential providers (Credentials URI). It follows industry-standard best practices for secret management in cloud environments and does not hardcode any sensitive information.
Audit Metadata