aliyun-bdrc-backup
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill instructs the agent to use standard Alibaba Cloud credentials via environment variables (ALIBABACLOUD_ACCESS_KEY_ID, ALIBABACLOUD_ACCESS_KEY_SECRET) or the shared configuration file (~/.alibabacloud/credentials). This represents standard, recommended security practices for cloud resource management tools.\n- [EXTERNAL_DOWNLOADS]: The skill fetches OpenAPI metadata from api.aliyun.com to discover available service operations. This is a well-known service domain belonging to Alibaba Cloud and is used for legitimate technical resource discovery.\n- [COMMAND_EXECUTION]: The skill uses Python and Bash for validation and discovery tasks. Specifically, it uses py_compile for script verification and a Python script to fetch and format API metadata. These operations are restricted to internal metadata management and standard syntax checking.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests technical metadata from external Alibaba Cloud endpoints.\n
- Ingestion points: The list_openapi_meta_apis.py script fetches JSON metadata from official Alibaba Cloud API endpoints.\n
- Boundary markers: The ingested data is structured JSON metadata processed by standard Python libraries.\n
- Capability inventory: The skill is limited to fetching metadata and performing resource management tasks via the Alibaba Cloud SDK/OpenAPI.\n
- Sanitization: Data is parsed using the standard Python json module and written to local files using pathlib.
Audit Metadata