aliyun-anytrans-translate

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DATA_EXFILTRATION]: The skill provides instructions for the agent to access sensitive Alibaba Cloud credential information from environment variables (ALIBABACLOUD_ACCESS_KEY_ID, ALIBABACLOUD_ACCESS_KEY_SECRET) and the shared configuration file located at ~/.alibabacloud/credentials. This is standard procedure for tools designed to manage cloud resources.
  • [EXTERNAL_DOWNLOADS]: The scripts/list_openapi_meta_apis.py script fetches OpenAPI metadata and product documentation from api.aliyun.com. This is a well-known service provided by Alibaba Cloud for official API discovery.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external JSON data fetched from the Alibaba Cloud metadata service, representing a potential surface for indirect prompt injection.
  • Ingestion points: scripts/list_openapi_meta_apis.py fetches JSON metadata from the internet.
  • Boundary markers: None explicitly defined for the external metadata content.
  • Capability inventory: The skill can execute local Python scripts, perform network GET requests, and write files to the output/ directory.
  • Sanitization: Content is processed via standard JSON parsing, which is appropriate for its intended use with official metadata.
  • [COMMAND_EXECUTION]: The skill executes local Python scripts for API discovery and uses py_compile for script validation. These commands are localized to the skill's own directory and defined output path.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 08:16 AM