Alibabacloud Dataworks Datastudio Develop
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This skill is coherent for Alibaba Cloud DataWorks automation, but users should understand it can use existing cloud credentials to create, update, deploy, and schedule DataWorks workflows.
Install only if you intend to let the agent help manage Alibaba Cloud DataWorks resources. Use a least-privilege Aliyun profile, verify the selected project and workflow specs, and approve any create/update/publish/move/rename action before it affects production.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may make real changes in a DataWorks project, including publishing workflow changes, if the user asks it to do so.
The skill is explicitly designed to perform mutating Alibaba Cloud DataWorks operations, including deployment and changes to workflows/nodes.
Create, configure, validate, deploy, update, move, and rename nodes and workflows.
Review the target project, object IDs, specs, and publish/update commands before allowing the agent to run them, especially in production.
Commands will run with whatever permissions the selected Aliyun profile has, which may include production DataWorks access.
The skill relies on existing Aliyun CLI credentials and profile selection to access the user's Alibaba Cloud account.
Run `aliyun configure list` first... pre-configured with valid STS token credentials... `aliyun configure switch --profile <name>`... NEVER read/echo/print AK/SK values.
Use a least-privilege profile scoped to the intended DataWorks project and confirm the active profile before running mutating commands.
Running the installer can change the local CLI installation and execute code downloaded from the network.
The setup guidance includes executing a remote installer script, which is common CLI setup plumbing but depends on trusting the remote source at run time.
run `curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash` to update
Prefer official installation instructions, verify the download source, and avoid running the installer in sensitive environments unless necessary.
A scheduled workflow may keep executing in the cloud and consuming resources or modifying data until disabled.
The example templates create scheduled DataWorks nodes that can continue running long-term after deployment.
"trigger": { "type": "Scheduler", "cron": "00 00 00 * * ?", "startTime": "1970-01-01 00:00:00", "endTime": "9999-01-01 00:00:00"Check schedules, start/end times, and deployment status before publishing workflows, and disable or remove test workflows when finished.