Aliyun Ice Manage
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill is coherent with its stated purpose (managing Alibaba Cloud ICE via OpenAPI) and contains only a small metadata-fetch script and instructions; the main issue is an omission in the registry metadata (it doesn't declare the Alibaba credential environment variables the instructions expect).
This skill appears to do what it claims: metadata discovery and management of Alibaba Cloud ICE. Before installing or allowing autonomous invocation: 1) Ensure you provide least-privilege Alibaba credentials (AccessKey/STS) and confirm the skill will only use them for the intended ICE APIs. 2) Note the SKILL.md expects env vars (ALICLOUD_ACCESS_KEY_ID / ALICLOUD_ACCESS_KEY_SECRET / ALICLOUD_REGION_ID) and a shared config path (~/.alibabacloud/credentials) but these are not declared in the registry metadata — the omission should be fixed or you should manually verify credential handling. 3) Review what will be written to output/aliyun-ice-manage/ (request payloads and API responses) so sensitive data isn't unintentionally persisted. 4) If you plan to allow autonomous runs, consider limiting the credential scope (RAM permissions) and testing in a non-production account first.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.