aliyun-vod-manage
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed for interaction with official Alibaba Cloud (Aliyun) infrastructure. All network requests target official
aliyun.comdomains. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill identifies standard locations for Alibaba Cloud credentials, including environment variables (
ALIBABACLOUD_ACCESS_KEY_ID,ALIBABACLOUD_ACCESS_KEY_SECRET) and the local configuration file~/.alibabacloud/credentials. This behavior is consistent with legitimate cloud management tools and does not constitute unauthorized exposure or exfiltration, as these credentials are required for the skill's stated purpose of interacting with Aliyun APIs. - [EXTERNAL_DOWNLOADS]: The script
scripts/list_openapi_meta_apis.pyfetches API metadata fromapi.aliyun.com. As this is a well-known and trusted service provider, the download is considered safe and is used solely to generate API documentation and discovery files for the user/agent. - [INDIRECT_PROMPT_INJECTION]: The skill processes JSON metadata from an external source (
api.aliyun.com) to generate API lists. While this theoretically represents an ingestion surface for untrusted data, the source is an official provider, and the skill performs standard parsing (JSON decoding and key extraction) which minimizes the risk of indirect prompt injection.
Audit Metadata