soia-pkm-alipan-drive-ops
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill interacts with the
aliyunpancommand-line tool using wrapper scripts (run_with_env.pyandscan_drive.py). These scripts utilizesubprocess.runwithshell=Falseand enforce a whitelist of allowed binaries (aliyunpan,aliyunpan.exe), which effectively prevents arbitrary shell command injection. - [CREDENTIALS_UNSAFE]: Security best practices are followed for credential management. The skill uses a dedicated script (
alipan_env.py) to load sensitive environment variables from a private configuration file. Furthermore, the instructions explicitly forbid the agent from printing or leaking tokens, cookies, or session secrets in its output or logs. - [EXTERNAL_DOWNLOADS]: The skill requires the
aliyunpanCLI, a well-known tool for Aliyun Drive. The instructions guide the user to install it via standard package managers like Homebrew, ensuring a trusted source for the dependency. - [SAFE]: The overall architecture of the skill emphasizes safety, including user-in-the-loop verification for destructive actions like delete or move, and a clear "ops-playbook" for handling sensitive operations like remote login recovery without exposing user credentials.
Audit Metadata