appmarket-dev
Pass
Audited by Gen Agent Trust Hub on May 3, 2026
Risk Level: SAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: Documentation files and script templates, such as
references/image-building.mdandassets/setup-image.sh, contain examples of downloading and executing scripts via thecurl | bashpattern. These references are provided as guides for developers to install runtime environments (like Node.js) when building machine images. They target well-known, reputable services or useexample.comas a placeholder. - [COMMAND_EXECUTION]: The skill's primary CLI utilities (
image-cli.py,vm-cli.py) and testing scripts (test-module.sh) execute system tools includingssh,scp,sshpass, andterraform. This execution is necessary to automate the creation of virtual machines, software installation, and infrastructure provisioning on Qiniu Cloud as described in the skill's purpose. - [EXTERNAL_DOWNLOADS]: The skill includes references to external script downloads for dependency installation. These are documented workflows intended for the developer to use when preparing custom application images.
- [DATA_EXFILTRATION]: While the skill manages Qiniu API credentials and performs network operations, all activity is restricted to official Qiniu Cloud domains (e.g.,
qiniuapi.com) and is required for the intended functionality of the application market tools.
Audit Metadata