alicloud-security-center-sas
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/list_openapi_meta_apis.pyfetches OpenAPI metadata fromhttps://api.aliyun.com. This is a well-known official service from Alibaba Cloud and is used only to retrieve API definitions, not executable code. - [CREDENTIALS_UNSAFE]: The skill mentions the use of sensitive environment variables like
ALICLOUD_ACCESS_KEY_IDandALICLOUD_ACCESS_KEY_SECRET, and references the credential file~/.alibabacloud/credentials. These are standard practices for Alibaba Cloud SDKs and are documented as prerequisites for the user to configure, not hardcoded within the skill itself. - [COMMAND_EXECUTION]: The skill includes a validation step that runs
python3 -m py_compileon its own scripts. This is a standard build-time check to ensure script integrity and does not pose a security risk. - [DATA_EXFILTRATION]: No evidence of data exfiltration was found. Network activity is limited to fetching metadata from official Alibaba Cloud domains.
Audit Metadata