Alibaba Cloud DataWorks

• Risk level: Low
• Analyzed: Mar 10, 2026, 2:36 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill's code and runtime instructions clearly require Alibaba Cloud credentials and reading local credential files, but the published metadata fails to declare any required credentials or config paths — this mismatch is unexplained and worth caution before installing or running.

Before installing or running this skill: 1) Understand it requires your Alibaba Cloud Access Key ID and Secret (or a shared credentials file). The registry metadata did NOT declare these — the SKILL.md does — so assume the skill will read/require them. 2) Only provide least-privileged or temporary credentials (use an STS token or IAM role with the minimal allowed actions) and avoid using an account-wide admin key. 3) The included scripts contact official Alibaba endpoints and write files under output/dataworks-open-api; review the scripts locally to confirm behavior (they use urllib and fall back to curl via subprocess.run, but do not perform obfuscated or remote code installation). 4) Note the inconsistency in env var names (ALICLOUD_* vs ALIBABA_CLOUD_*); verify which variables your environment or agent will actually supply to avoid accidental credential leakage. 5) If you don't trust the unknown publisher or cannot provide minimal-privilege credentials, run the skill in an isolated environment or decline to install. 6) If you want to proceed, consider running the discovery scripts manually yourself first (inspect outputs) rather than granting the agent autonomous execution with your real credentials.