Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Alibaba Cloud VVR/PyFlink coding guide that prepares local code and deployment handoff artifacts without hidden execution, credential collection, or automatic cloud actions.
Before installing, be aware that the skill may guide your agent to read Alibaba Cloud documentation, download versioned PyFlink API wheels for inspection, and create local deployment files. Review generated job examples before running them on VVR, especially any sink using overwrite, and keep real credentials in Alibaba Cloud secret variables rather than source files or README text.
The example writes output with mode="overwrite" to an OSS sink path, which can delete or replace existing data if the path is reused. In a deployment-oriented skill, users may copy this example directly, so the lack of an explicit warning about destructive behavior creates a real risk of accidental data loss.
The text explicitly directs users to Alibaba Cloud's Chinese documentation as the source for product knowledge. This is a natural-language locale constraint and the file does not offer an alternative language option or indicate that the user can choose their preferred documentation language.
Line L11 directs users to the live Chinese release notes as the source for version selection. This is a natural-language locale constraint and the file does not offer an alternative language source or indicate user choice, which conflicts with the policy against forcing a specific locale without opt-in.
Line L20 says to use the Chinese release notes for release availability, again enforcing a specific locale as the canonical source. Because the document does not provide opt-in, alternatives, or a clear policy justification for this locale restriction, it fits the language/locale policy violation category.
The skill text links only to Chinese-language documentation (/zh/ URLs) as the primary reference for users. This can amount to a language/locale constraint in the natural-language guidance without any opt-in, alternative locale, or justification that the skill is region-specific.
No suspicious patterns detected.
