aliyun-anytrans-translate
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill provides instructions for the agent to access sensitive Alibaba Cloud credential information from environment variables (
ALIBABACLOUD_ACCESS_KEY_ID,ALIBABACLOUD_ACCESS_KEY_SECRET) and the shared configuration file located at~/.alibabacloud/credentials. This is standard procedure for tools designed to manage cloud resources. - [EXTERNAL_DOWNLOADS]: The
scripts/list_openapi_meta_apis.pyscript fetches OpenAPI metadata and product documentation fromapi.aliyun.com. This is a well-known service provided by Alibaba Cloud for official API discovery. - [INDIRECT_PROMPT_INJECTION]: The skill processes external JSON data fetched from the Alibaba Cloud metadata service, representing a potential surface for indirect prompt injection.
- Ingestion points:
scripts/list_openapi_meta_apis.pyfetches JSON metadata from the internet. - Boundary markers: None explicitly defined for the external metadata content.
- Capability inventory: The skill can execute local Python scripts, perform network GET requests, and write files to the
output/directory. - Sanitization: Content is processed via standard JSON parsing, which is appropriate for its intended use with official metadata.
- [COMMAND_EXECUTION]: The skill executes local Python scripts for API discovery and uses
py_compilefor script validation. These commands are localized to the skill's own directory and defined output path.
Audit Metadata