alicloud-acs-cluster
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes official and versioned Alibaba Cloud SDK packages (alibabacloud-cs20151215, alibabacloud-tea-openapi) for all API interactions, facilitating secure communication with well-known cloud service endpoints.
- [SAFE]: Includes a robust secret redaction mechanism in scripts/acs_cluster.py that filters Alibaba Cloud credentials and sensitive patterns (such as adminApiKey, passwords, and tokens) from error messages using regex-based scrubbing before they are returned to the user or agent context.
- [SAFE]: Enforces the principle of least privilege for local file access by applying restrictive permissions (0600) to generated KubeConfig files and verifying that addon configuration files are not group- or world-readable before they are read by the script.
- [SAFE]: Implements protective controls for high-risk operations; lifecycle commands for disabling deletion protection and performing cluster teardowns require explicit manual confirmation of the target Cluster ID to prevent accidental or unauthorized resource destruction.
- [SAFE]: The documentation provides clear security guidance, explicitly forbidding the exposure of AccessKeys, KubeConfigs, or unredacted API responses in evidence files or agent logs.
Audit Metadata