alibabacloud-cli-guidance
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill facilitates the installation of the Aliyun CLI through a setup script hosted on the vendor's official CDN (aliyuncli.alicdn.com). This execution is part of the standard setup process for the official tool.\n- [EXTERNAL_DOWNLOADS]: The skill uses the
aliyun plugin installfeature to fetch service-specific components from Alibaba Cloud's remote repositories to enable management of different cloud services.\n- [CREDENTIALS_UNSAFE]: While the skill involves handling cloud credentials, it prioritizes security by recommending OAuth for local environments and STS tokens for temporary access. It also includes an explicit guide on RAM policies to ensure users apply the principle of least privilege.\n- [PROMPT_INJECTION]: The agent is instructed to ingest output from help commands and API responses to determine correct parameter naming. This represents an indirect prompt injection surface where the agent processes data from the local tool's output, which is a standard operational requirement for this CLI guide.
Audit Metadata