Alibabacloud Solution Deploy
Security checks across malware telemetry and agentic risk
Overview
The skill is coherent for Alibaba Cloud deployment, but it can use cloud credentials to create paid resources and relies on external CLI/plugins and remote Terraform execution, so users should review commands and permissions carefully.
Install only if you intend to let the agent deploy Alibaba Cloud resources. Use a limited RAM user or temporary credentials, check the active Aliyun CLI profile, review all Terraform plans and CLI commands before approving, and remember that created resources may incur charges.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If approved, the agent may create, change, or delete Alibaba Cloud resources that can cost money.
The skill is designed to automate cloud CLI operations that can create or modify paid resources, but it also tells the agent to confirm Terraform parameters before applying them.
Every cloud operation that has a CLI path should use it ... Show the parameters and ask for confirmation. Never silently apply them — cloud resources cost real money.
Review the proposed region, resource sizes, Terraform plan, and CLI commands before approving any apply or destroy action.
The skill can act through the Alibaba Cloud credentials/profile available to the CLI and may manage real cloud infrastructure.
The documented helper permissions allow remote Terraform plan/apply/destroy through Alibaba Cloud IaCService; this is aligned with deployment but is high-impact account authority.
"Action": ["iacservice:ValidateModule", "iacservice:ExecuteTerraformPlan", "iacservice:ExecuteTerraformApply", "iacservice:ExecuteTerraformDestroy", "iacservice:GetExecuteState"], "Resource": "*"
Use a dedicated least-privilege RAM user or temporary credentials, verify the active Aliyun CLI profile, and avoid using root or overly broad credentials.
Additional Alibaba Cloud CLI plugins may be installed automatically when the skill runs product commands.
The skill enables automatic Aliyun CLI plugin installation, meaning product-specific plugins may be downloaded on first use. This is disclosed and relevant to the skill, but users should be aware of the runtime dependency.
aliyun configure set --auto-plugin-install true --user-agent AlibabaCloud-Agent-Skills
Keep Aliyun CLI updated, use official plugin sources, and review any fetched Terraform examples or modules before applying them.
Deployment configuration and related details may be processed by Alibaba Cloud remote services.
Terraform configuration is sent to Alibaba Cloud's remote IaCService for execution. This is expected for the stated deployment workflow, but deployment files may include resource names or sensitive parameters.
Execute Terraform configurations remotely through Alibaba Cloud's IaCService using a single pre-built script. No local `terraform` CLI required.
Avoid embedding unnecessary secrets in Terraform files, rotate any deployment passwords as needed, and confirm that using the remote IaCService is acceptable for the environment.