Aliyun Dashvector Search
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code and runtime instructions match its stated purpose (DashVector Python SDK quickstart); the only notable inconsistency is that the registry metadata does not declare the DASHVECTOR_* environment variables that the SKILL.md and script require.
This skill appears to implement a straightforward DashVector Python quickstart and is internally coherent, but note the registry metadata omission: the script and SKILL.md require DASHVECTOR_API_KEY and DASHVECTOR_ENDPOINT even though the metadata lists none. Before installing or running: 1) Provide only a scoped API key with least privilege for the target DashVector cluster; avoid using highly privileged credentials. 2) Review the dashvector Python package source or install from a trusted package index to ensure package provenance. 3) Run the recommended read-only connectivity check first (per workflow) to verify credentials and endpoint before performing create/upsert operations, since the quickstart performs mutations. 4) Keep secrets out of logs and CI output and store them in your secret manager. If you want stronger assurance, ask the publisher to correct the registry metadata to declare required env vars.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.