aliyun-billing-skills
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill provides instructions to verify cloud credentials by executing a shell command
find . -maxdepth 1 -name ".env" -exec cat {} \;which prints the contents of the.envfile to the console. This file is explicitly expected to contain sensitive credentials such asALIBABA_CLOUD_ACCESS_KEY_IDandALIBABA_CLOUD_ACCESS_KEY_SECRET. Displaying these secrets in the agent's output can lead to accidental exposure in conversation logs or history. - [COMMAND_EXECUTION]: The skill utilizes shell commands to manage environment configurations and install necessary Python dependencies. This includes searching for files and executing local package managers.
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs several Python packages from public registries, including
alibabacloud_bssopenapi20171214,alibabacloud_credentials,alibabacloud_tea_openapi,alibabacloud_tea_util, andpython-dotenv. These packages are official SDKs from Alibaba Cloud or well-known community utilities used for environment management.
Audit Metadata