qwencloud-observe

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the aliyun CLI to query cloud resource status and billing information. It includes explicit instructions to avoid handling or printing credentials like AccessKeys or SecretKeys.\n- [REMOTE_CODE_EXECUTION]: The skill executes read-only diagnostic commands (such as checking service status and log tailing) on ECS instances via the Alibaba Cloud Assistant (RunCommand API). These commands are provided in the skill instructions and use Base64 encoding as required by the provider's API.\n- [EXTERNAL_DOWNLOADS]: The installation guide references the official Alibaba Cloud CDN (aliyuncli.alicdn.com) for downloading the aliyun CLI tool.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from application logs and database slow logs. It mitigates injection risks by instructing the agent to summarize errors rather than dumping raw logs, redacting literals from SQL queries, and using a Python script (render_report.py) that performs HTML escaping for report generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 08:22 AM