maas
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill facilitates access to official Qiniu MaaS management APIs (api.qiniu.com, api.qnaigc.com) for operational tasks such as log querying and token usage tracking.\n- [SAFE]: Instructions correctly guide the user to handle administrative credentials (AK/SK) securely using environment variables and maintain clear isolation from application-level API keys.\n- [DATA_EXPOSURE]: Detailed logic for signing and utilizing high-privilege administrative credentials (AK/SK) is included. The skill provides explicit warnings and SOP steps to prevent these secrets from being exposed in clear text, logs, or version control.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from platform logs and usage metrics to populate reporting templates. Mandatory evidence chain: 1. Ingestion points: Stat log and usage API responses (documented in references/openapi.json). 2. Boundary markers: The SOP requires user confirmation and environment variable usage, though output templates lack explicit delimiters for external data. 3. Capability inventory: Network operations for data retrieval and administrative API key management. 4. Sanitization: Sanitization or filtering of ingested log content before display is not explicitly documented.
Audit Metadata