Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Alibaba Cloud security-scanning helper that submits user-provided Skill archive URLs to AISC and has only minor operational caveats.
Before installing, understand that scan URLs and target Skill archives are submitted to Alibaba Cloud AISC using your configured Alibaba credentials. Use a least-privilege RAM identity with only the documented AISC actions, avoid submitting private archives unless that data flow is acceptable, and consider pinning dependencies for stricter reproducibility.
Referenced artifact was not completely inspected
t; the user does not need to name AISC, this Skill, or the Python script. Load `SKILL.md` before deciding which inputs are missing or asking a follow-up. Select
Referenced artifact was not completely inspected
t; the user does not need to name AISC, this Skill, or the Python script. Load `SKILL.md` before deciding which inputs are missing or asking a follow-up. Select
Referenced artifact was not completely inspected
t; the user does not need to name AISC, this Skill, or the Python script. Load `SKILL.md` before deciding which inputs are missing or asking a follow-up. Select
Referenced artifact was not completely inspected
t; the user does not need to name AISC, this Skill, or the Python script. Load `SKILL.md` before deciding which inputs are missing or asking a follow-up. Select
Referenced artifact was not completely inspected
Use [references/result-interpretation-guide.md](references/result-interpretation-guide.md) for risk category meanings.
Referenced artifact was not completely inspected
Use [references/result-interpretation-guide.md](references/result-interpretation-guide.md) for risk category meanings.
The skill instructs the agent to use local file access, environment-based credential checks, and outbound network calls to Alibaba Cloud, but it does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch weakens least-privilege controls and makes it easier for the skill to be loaded with broader capabilities than users or the platform can readily audit.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use this Skill for an explicit or implicit **Skill security** request; the user does not need to name AISC, this Skill, or the Python script. Load `SKILL.md` before deciding which inputs are missing or asking a follow-up. Selecting/loading the Skill is separate from submitting a cloud request.
- A clear safety question such as “这个 Skill 安不安全”, “能放心安装吗”, or “有没有恶意代码/敏感凭据/提示词注入” activates this Skill.
- With a clear target and download URL, run the official wrapper directly; do not ask the user to repeat authorization or supply optional file names.
- With a missing URL, missing task ID, unclear AISC operation, or unselected candidates, load this Skill first, ask for only the missing input, and wait before any cloud call.
- Generic Skill writing, installation, documentation, and “处理一下 Skill” without a security intent are outside this Skill's scope.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use this Skill for an explicit or implicit **Skill security** request; the user does not need to name AISC, this Skill, or the Python script. Load `SKILL.md` before deciding which inputs are missing or asking a follow-up. Selecting/loading the Skill is separate from submitting a cloud request.
- A clear safety question such as “这个 Skill 安不安全”, “能放心安装吗”, or “有没有恶意代码/敏感凭据/提示词注入” activates this Skill.
- With a clear target and download URL, run the official wrapper directly; do not ask the user to repeat authorization or supply optional file names.
- With a missing URL, missing task ID, unclear AISC operation, or unselected candidates, load this Skill first, ask for only the missing input, and wait before any cloud call.
- Generic Skill writing, installation, documentation, and “处理一下 Skill” without a security intent are outside this Skill's scope.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use this Skill for an explicit or implicit **Skill security** request; the user does not need to name AISC, this Skill, or the Python script. Load `SKILL.md` before deciding which inputs are missing or asking a follow-up. Selecting/loading the Skill is separate from submitting a cloud request.
- A clear safety question such as “这个 Skill 安不安全”, “能放心安装吗”, or “有没有恶意代码/敏感凭据/提示词注入” activates this Skill.
- With a clear target and download URL, run the official wrapper directly; do not ask the user to repeat authorization or supply optional file names.
- With a missing URL, missing task ID, unclear AISC operation, or unselected candidates, load this Skill first, ask for only the missing input, and wait before any cloud call.
- Generic Skill writing, installation, documentation, and “处理一下 Skill” without a security intent are outside this Skill's scope.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use this Skill for an explicit or implicit **Skill security** request; the user does not need to name AISC, this Skill, or the Python script. Load `SKILL.md` before deciding which inputs are missing or asking a follow-up. Selecting/loading the Skill is separate from submitting a cloud request.
- A clear safety question such as “这个 Skill 安不安全”, “能放心安装吗”, or “有没有恶意代码/敏感凭据/提示词注入” activates this Skill.
- With a clear target and download URL, run the official wrapper directly; do not ask the user to repeat authorization or supply optional file names.
- With a missing URL, missing task ID, unclear AISC operation, or unselected candidates, load this Skill first, ask for only the missing input, and wait before any cloud call.
- Generic Skill writing, installation, documentation, and “处理一下 Skill” without a security intent are outside this Skill's scope.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Handle common failures as follows:
- Credentials not configured: classify the script output as `error_type: "credential"` and ask the user to configure credentials through the default credential chain outside this conversation.
- Expired temporary security token (`InvalidSecurityToken.Expired`, `SecurityToken is expired`, expired token): classify it as `error_type: "credential"` for the current attempt. Report the `error_code`, non-sensitive `request_id`, `root_task_id: null`, and that no AISC task was created. Stop without retrying and without asking the user to paste, refresh, or reconfigure credentials in-chat.
- Permission errors (`403`, `AccessDenied`, `NoPermission`, `permission`): say that the current credentials need `aisc:CreateSkillFileCheck` and `aisc:ListSubTasks`, reference [references/ram-policies.md](references/ram-policies.md), and stop until permissions are available.
- Parameter errors (`400`, `InvalidParameter`, `parameter`, missing `download_url`, invalid `--files`): explain that `--files` must be a JSON array of objects and every object must include `download_url`; show the expected shape without printing credentials.
- Throttling errors (`429`, `Throttling`, `TooManyRequests`, `rate limit`): explain that AISC is rate limiting the request and suggest retrying later or increasing `--interval`; do not loop or write custom retry code.
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Throttling errors (`429`, `Throttling`, `TooManyRequests`, `rate limit`): explain that AISC is rate limiting the request and suggest retrying later or increasing `--interval`; do not loop or write custom retry code.
- Internal/system errors (`5xx`, `503`, `InternalError`, `ServiceUnavailable`, `internal`): report that AISC returned a service error, include the non-sensitive `RequestId` or error code if present, and suggest retrying later or contacting Alibaba Cloud support. Stop the current attempt.
- Transient network timeout while polling `ListSubTasks`: allow the official wrapper to retry until `--timeout`. If polling eventually times out, report `poll.status: "timeout"`, preserve `root_task_id`, and give the continuation command. If a timeout occurs while creating credentials or submitting the task and the script returns `error_type: "credential"` or another terminal error, report that terminal error instead of retrying.
- URL unreachable or rejected by AISC: report the API message and remind the user to fix the URL; do not pre-check, retry forever, or force correction.
- Unsupported archive (`文件格式错误，仅支持 ZIP、TAR 或 GZIP 压缩的 TAR`): explain that AISC requires a real archive containing the Skill files. A raw `SKILL.md` or renamed file is insufficient. Stop this attempt and report the actual error; do not change the URL, manufacture a ZIP result, or submit an example package as a replacement.
- All uploads failed: report each upload error and stop without polling.
- File count exceeds 10: submit through [scripts/skill_file_check.py](scripts/skill_file_check.py) and let the script split the files into batches of at most 10; never ask the user to confirm batching.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- URL unreachable or rejected by AISC: report the API message and remind the user to fix the URL; do not pre-check, retry forever, or force correction.
- Unsupported archive (`文件格式错误，仅支持 ZIP、TAR 或 GZIP 压缩的 TAR`): explain that AISC requires a real archive containing the Skill files. A raw `SKILL.md` or renamed file is insufficient. Stop this attempt and report the actual error; do not change the URL, manufacture a ZIP result, or submit an example package as a replacement.
- All uploads failed: report each upload error and stop without polling.
- File count exceeds 10: submit through [scripts/skill_file_check.py](scripts/skill_file_check.py) and let the script split the files into batches of at most 10; never ask the user to confirm batching.
- Polling timeout: return the `root_task_id` and tell the user they can continue later with the `poll` subcommand.
## Success Verification
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Field | Description |
|-------|-------------|
| `detail[].item_name` | Check item name, e.g., `Dangerous Tools Without Confirmation` |
| `detail[].description` | Risk description |
| `detail[].content` | Matched configuration content, e.g., `allowed-tools: Bash(agent-browser:*)` |
| `detail[].line` | Line number of the matched content |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Field | Description |
|-------|-------------|
| `detail[].item_name` | Check item name, e.g., `Dangerous Tools Without Confirmation` |
| `detail[].description` | Risk description |
| `detail[].content` | Matched configuration content, e.g., `allowed-tools: Bash(agent-browser:*)` |
| `detail[].line` | Line number of the matched content |
The document says to use the skill "broadly for Skill security detection" and also for an explicit or implicit skill security request, while allowing the user not to name AISC or the skill. Although examples are provided, the activation boundary is still somewhat open-ended and could overlap with general conversational security questions unless the target is clearly identified.
The dependency is specified with a lower bound only, which allows future unreviewed versions to be installed. This can introduce supply-chain risk, unexpected breaking changes, or vulnerable upstream releases without any change to this repository.
alibabacloud_aisc20260101>=1.1.0
alibabacloud_credentials>=1.0.0
alibabacloud_tea_openapi>=0.4.0
This requirement is not strictly pinned and permits resolver-selected newer versions at install time. That makes builds non-reproducible and increases exposure to compromised or vulnerable dependency releases in the Python package supply chain.
alibabacloud_aisc20260101>=1.1.0
alibabacloud_credentials>=1.0.0
alibabacloud_tea_openapi>=0.4.0
Using >= for this package allows silent drift to newer versions that may contain security flaws or malicious code if the upstream package or publishing pipeline is ever compromised. In security-sensitive tooling, such non-deterministic dependency resolution slightly increases operational risk.
alibabacloud_aisc20260101>=1.1.0
alibabacloud_credentials>=1.0.0
alibabacloud_tea_openapi>=0.4.0