Alibabacloud Sdk Client Initialization For Golang

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:30 PM UTC
• Version:
  0.0.1-beta

Overview

This is an instruction-only Go SDK setup guide with normal cloud-credential examples, but users should handle keys and debug logs carefully.

Safe to install as documentation. Before using the examples, prefer least-privilege RAM roles or temporary credentials where possible, keep access keys out of code and logs, rotate exposed keys, and avoid enabling DEBUG logging in production or sharing unredacted debug output.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill demonstrates loading long-lived Alibaba Cloud access keys directly from environment variables without any warning about secure handling, rotation, or safer alternatives such as RAM roles/STS. In a credential-initialization skill, this omission is materially risky because users may copy the pattern into production and normalize insecure secret management practices.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill recommends enabling SDK debug logging for all requests but does not warn that request logs may include sensitive metadata, headers, identifiers, or even credential-bearing material depending on SDK behavior. Because this skill is specifically about client initialization, users are likely to enable this in real environments, increasing the chance of accidental secret exposure through logs.

VirusTotal

42/42 vendors flagged this skill as clean.