alibabacloud-data-agent-skill
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The Python CLI implements a background worker architecture for long-running 'pro' and 'ultra' analysis modes by spawning the CLI itself as a background process using
subprocess.Popeninscripts/cli/worker_utils.py.\n- [COMMAND_EXECUTION]: The notification utility inscripts/cli/notify.pyexecutes agent runtime platform tools (openclaw,clawdbot) viasubprocess.runto relay asynchronous status updates back to the user session.\n- [REMOTE_CODE_EXECUTION]: A build-from-source mechanism inalibabacloud-data-agent-mcp-skill/scripts/select-binary.shusesgo buildto compile the Go MCP server from the included source code if a pre-compiled binary is not available for the host platform.\n- [PROMPT_INJECTION]: The skill handles external data from databases and user-uploaded files (CSV, XLSX, JSON, TXT) for analysis, presenting an inherent surface for indirect prompt injection.\n - Ingestion points: Local files uploaded through
data_agent_upload_fileand database tables managed in the Alibaba Cloud Data Center.\n - Boundary markers: None explicitly defined; data is analyzed directly by the AI agent based on natural language queries.\n
- Capability inventory: The skill can execute subprocesses for task management and notifications, and has write access to its local
sessions/directory for logging and persistence.\n - Sanitization: The skill relies on the host AI model's built-in safety guidelines and guardrails during the analysis of external data content.
Audit Metadata