Alicloud Security Content Moderation Green

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Incorrect or unintended use could alter moderation workflows or policies in the user's Alibaba Cloud account.

Why it was flagged

The skill explicitly supports mutating Alibaba Cloud Content Moderation resources and policies. This is purpose-aligned, but cloud configuration changes can have operational impact.

Skill content

Change/configure: prefer `Create*` / `Update*` / `Modify*` / `Set*` APIs for mutations.

Recommendation

Confirm the region, resource ID, intended action, and expected outcome before any create, update, modify, or set operation.

Note

ASI03: Identity and Privilege Abuse

What this means

The agent may be able to inspect or change Alibaba Cloud Content Moderation resources according to the permissions on the configured credentials.

Why it was flagged

The skill is designed to use Alibaba Cloud credentials from environment variables or the local shared credentials file. This is expected for Alibaba Cloud API management, but it gives the agent delegated account access.

Skill content

Environment variables: `ALICLOUD_ACCESS_KEY_ID` / `ALICLOUD_ACCESS_KEY_SECRET` / `ALICLOUD_REGION_ID` ... Shared config file: `~/.alibabacloud/credentials`

Recommendation

Use a least-privilege Alibaba Cloud credential limited to the required Content Moderation operations and avoid using broad administrator keys.

Note

ASI06: Memory and Context Poisoning

What this means

Generated output files may retain resource IDs, regions, time ranges, or moderation configuration summaries in the workspace.

Why it was flagged

The skill persists API summaries and operational identifiers to local files. This is useful for evidence and reproducibility, but those files may contain internal cloud resource details.

Skill content

Save artifacts, command outputs, and API response summaries under `output/alicloud-security-content-moderation-green/`. Include key parameters (region/resource id/time range) in evidence files

Recommendation

Review generated files before sharing them and delete the output directory when the retained operational details are no longer needed.