alicloud-platform-aliyun-cli
Fail
Audited by Snyk on Mar 11, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.80). The prompt includes explicit CLI examples that pass access keys/secrets as command flags (--access-key-id, --access-key-secret), which can encourage the agent to ask for and embed actual AK/SK verbatim (even though env vars are suggested), creating an exfiltration risk.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The ensure_aliyun_cli.py script fetches and installs the official Aliyun CLI archive at runtime from https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz, which downloads and installs/exposes remote executable code that the skill requires to operate.
Audit Metadata