Aliyun Vod Manage
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's files and runtime instructions are coherent with a VOD management helper for Alibaba Cloud; it fetches public API metadata and documents how to call VOD OpenAPI, though the SKILL.md mentions credential sources that are not declared in metadata.
This skill is coherent for managing Alibaba Cloud VOD: it includes API discovery templates and a small script that fetches public metadata from api.aliyun.com. Before installing or invoking it, confirm: (1) you will need Alibaba Cloud credentials for any write operations — SKILL.md documents env vars (~/.alibabacloud/credentials) but the registry metadata does not declare them, so expect to provide them at runtime; (2) the skill writes request payloads/responses to output/aliyun-vod-manage/ — do not allow it to persist secret values (AccessKeySecret, STS tokens) in evidence files; (3) network access is only to api.aliyun.com as shown in code, but if you plan to run mutation operations, use least-privilege RAM or STS credentials and confirm the agent's prompts before any write. If you are uncomfortable with the agent having autonomous access to credentials or writing evidence to disk, disable autonomous invocation or run the skill in an isolated environment.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.