Aliyun Fc Serverless Devs

• Outcome: Pass
• Latest audit: May 29, 2026, 8:34 PM
• Version:
  1.0.0

Overview

This is a straightforward guide for using Alibaba Cloud Function Compute with Serverless Devs, with expected credential and cloud resource operations that require care.

Install this only if you intend to manage Alibaba Cloud Function Compute resources. Use least-privilege or temporary credentials, prefer guided credential entry where possible, keep access keys out of logs and shared files, and verify the account, region, project, and resource names before running deploy or remove commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill includes commands that place AccessKeyID and AccessKeySecret directly on the command line and in exported environment variables without warning about shell history, terminal logging, CI logs, or process-list exposure. In a CLI-focused skill handling cloud credentials, this materially increases the risk of credential leakage and subsequent unauthorized access to Alibaba Cloud resources.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The document instructs users to enter Alibaba Cloud AccountID/AK/SK and perform deployment, invocation, and removal operations without any safety guidance about protecting secrets or understanding that these commands affect live cloud resources. In a CLI setup skill, this can lead users to expose credentials in insecure environments or unintentionally create, invoke, or delete resources, causing account compromise risk or unexpected operational and billing impact.

VirusTotal

63/63 vendors flagged this skill as clean.