aliyun-gbi-analytics
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill references standard Alibaba Cloud credential locations such as environment variables (
ALICLOUD_ACCESS_KEY_ID,ALICLOUD_ACCESS_KEY_SECRET) and the shared credentials file (~/.alibabacloud/credentials). This is documented as expected behavior for managing cloud resources and follows best practices for credential discovery. - [EXTERNAL_DOWNLOADS]: The script
scripts/list_openapi_meta_apis.pyfetches JSON metadata fromapi.aliyun.com. This is a well-known service domain belonging to Alibaba Cloud, used for retrieving official API specifications. - [DATA_EXFILTRATION]: While the skill handles sensitive credentials, there is no evidence of network operations sending data to untrusted or unauthorized third-party domains. All network activity is directed to official Alibaba Cloud endpoints.
- [COMMAND_EXECUTION]: The skill includes a validation step in
SKILL.mdthat usespy_compileto verify script syntax. This is a standard development practice and does not involve arbitrary command execution or shell injection.
Audit Metadata