alibabacloud-data-agent-skill
Pass
Audited by Gen Agent Trust Hub on Apr 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The CLI tool utilizes background worker processes to perform deep analysis without blocking the main session. This is achieved through
subprocess.Popeninworker_utils.py, which spawns new instances of the script to handle asynchronous tasks. This is an intended architectural design to manage long-running operations.- [EXTERNAL_DOWNLOADS]: The skill automates the retrieval of analysis reports (HTML, Markdown, and charts) from Alibaba Cloud's official storage domains (aliyuncs.com). These downloads are performed using authenticated URLs returned by the service API, ensuring they originate from a trusted source.- [DATA_EXFILTRATION]: A notification utility innotify.pyallows pushing updates to a user-defined URL (ASYNC_TASK_PUSH_URL). While this facilitates integration with external bots or dashboards, it is a configurable feature requiring manual environment setup by the user.- [SAFE]: The skill follows security best practices by utilizing the Alibaba Cloud default credential chain instead of hardcoding secrets. It handles data ingestion from databases and files as part of its core analytical purpose, relying on the backend service's safety guardrails to mitigate indirect prompt injection risks.
Audit Metadata