Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Alibaba Cloud infrastructure assistant with explicit approval gates, though it runs a verified downloaded local runtime that may use cloud credentials.
Install only if you intend to let a local iac-code runtime help with Alibaba Cloud infrastructure. Review permission and deployment prompts carefully, use narrowly scoped Alibaba Cloud RAM permissions, and avoid running it from a shell environment containing unrelated secrets if you are concerned about environment inheritance.
Referenced artifact was not completely inspected
Use the single standard-library entry point at `scripts/iac_code.py`. Never install `iac-code` with pip and never invoke a headless command. Run every command b
Referenced artifact was not completely inspected
Use the single standard-library entry point at `scripts/iac_code.py`. Never install `iac-code` with pip and never invoke a headless command. Run every command b
Referenced artifact was not completely inspected
Use the single standard-library entry point at `scripts/iac_code.py`. Never install `iac-code` with pip and never invoke a headless command. Run every command b
Referenced artifact was not completely inspected
Use the single standard-library entry point at `scripts/iac_code.py`. Never install `iac-code` with pip and never invoke a headless command. Run every command b
Referenced artifact was not completely inspected
Use the single standard-library entry point at `scripts/iac_code.py`. Never install `iac-code` with pip and never invoke a headless command. Run every command b
Referenced artifact was not completely inspected
Use the single standard-library entry point at `scripts/iac_code.py`. Never install `iac-code` with pip and never invoke a headless command. Run every command b
Referenced artifact was not completely inspected
Use the single standard-library entry point at `scripts/iac_code.py`. Never install `iac-code` with pip and never invoke a headless command. Run every command b
Referenced artifact was not completely inspected
Use the single standard-library entry point at `scripts/iac_code.py`. Never install `iac-code` with pip and never invoke a headless command. Run every command b
Referenced artifact was not completely inspected
Use the single standard-library entry point at `scripts/iac_code.py`. Never install `iac-code` with pip and never invoke a headless command. Run every command b
Referenced artifact was not completely inspected
Use the single standard-library entry point at `scripts/iac_code.py`. Never install `iac-code` with pip and never invoke a headless command. Run every command b
Referenced artifact was not completely inspected
Use the single standard-library entry point at `scripts/iac_code.py`. Never install `iac-code` with pip and never invoke a headless command. Run every command b
Referenced artifact was not completely inspected
The installer or Skill distributor may place an optional `config.json` beside this `SKILL.md`:
The bridge clones the full process environment and passes it to the local A2A runtime. In a skill specifically designed to process infrastructure prompts and cloud operations, this can unintentionally expose host secrets, API keys, and credential material to the runtime and any subprocesses it spawns, expanding the blast radius if that runtime is compromised or logs/debugs its environment.
config_path = root / "a2a.json"
_atomic_json(config_path, config)
log_path = root / "runtime.log"
environment = dict(os.environ)
environment["IAC_CODE_MODE"] = mode
environment.pop("IACCODE_A2A_ALLOWED_CWDS", None)
environment["IAC_CODE_A2A_TRUST_REQUEST_CWD"] = "1"
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
raise BridgeError("a2a_transport_failed", "The prompt file could not be read as UTF-8.") from exc
if not prompt.strip() or len(prompt.encode("utf-8")) > 1024 * 1024:
raise BridgeError("a2a_transport_failed", "The prompt file is empty or too large.")
return prompt
def _preferred_language(prompt, requested):
The skill instructs the agent to use shell, file, environment, and network-capable operations but declares no explicit tool scope or permission boundary in the skill metadata. In a high-impact infrastructure deployment skill, this creates unnecessary authority and weakens enforcement, increasing the chance of unintended command execution, file access, or outbound requests beyond what the task strictly needs.
The trigger condition says to activate for Alibaba Cloud infrastructure work even when the user does not mention the skill or related tooling, which is overly broad for a powerful infrastructure automation skill. This can cause over-invocation in ambiguous contexts and route user requests into a privileged deployment workflow unnecessarily.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
The recommended wait is 60 seconds and the bridge enforces a 120-second maximum even if a larger value is supplied.
If a result says state: input-required but does not contain inputRequired, there is no user boundary to answer. Report its latestText or error, keep the same job unchanged, and stop. Never call continue, repeat respond, call cancel, or start a replacement job unless the user explicitly requests that action.
When state is turn_completed, treat finalText and artifacts as the authoritative normal-turn result. When a Pipeline reaches any terminal state, including completed, failed, canceled, or rejected, treat pipelineResult and artifacts as its authoritative result and present its success or failure details directly. If rollback cleanup is pending, the bridge automatically runs a cleanup-only normal task in the same context before returning the Pipeline result; keep following it and handle any returned permission normally. If cleanup is failed or unavailable, report that manual inspection or retry is required and do not claim it succeeded. Never send a synthetic cleanup prompt or a follow-up merely to retrieve or summarize an existing result. Never recover an answer from Session files, spool files, logs, or raw tool-result files.
To send the next natural-language message in the same normal conversation, or after a completed Pipeline has handed the same conversation to normal mode, write it to another workspace prompt file and continue the existing job:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
raise BridgeError("artifact_verification_failed", "The extracted runtime identity is invalid.")
if os.name != "nt":
os.chmod(str(staged_executable), os.stat(str(staged_executable)).st_mode | stat.S_IXUSR)
check = subprocess.run(
[str(staged_executable), "--version"],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
raise BridgeError("artifact_verification_failed", "The extracted runtime identity is invalid.")
if os.name != "nt":
os.chmod(str(staged_executable), os.stat(str(staged_executable)).st_mode | stat.S_IXUSR)
check = subprocess.run(
[str(staged_executable), "--version"],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
"token": token,
"persistence_dir": str(persistence),
"artifact_dir": str(artifacts),
"auto_approve_permissions": False,
"thinking_exposure": ["tool-trace"],
"log_to_stdout": False,
"idle_shutdown_seconds": RUNTIME_IDLE_TIMEOUT_SECONDS,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
ready = False
try:
with log_path.open("ab", buffering=0) as log:
process = subprocess.Popen(
command,
cwd=str(root),
env=environment,
The code copies the entire parent environment into the spawned runtime process with environment = dict(os.environ) and then starts the runtime. Because this skill handles prompts, cloud credentials, and local runtime operations, inherited environment variables may include secrets or dangerous runtime controls such as Python/library injection variables, allowing unintended secret exposure to the child runtime or behavior manipulation if the parent environment is hostile.
ready = False
try:
with log_path.open("ab", buffering=0) as log:
process = subprocess.Popen(
command,
cwd=str(root),
env=environment,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
log_path = root / "worker.log"
creationflags = getattr(subprocess, "CREATE_NEW_PROCESS_GROUP", 0) if os.name == "nt" else 0
with log_path.open("ab", buffering=0) as log:
process = subprocess.Popen(
command,
stdin=subprocess.DEVNULL,
stdout=log,
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
log_path = root / "worker.log"
creationflags = getattr(subprocess, "CREATE_NEW_PROCESS_GROUP", 0) if os.name == "nt" else 0
with log_path.open("ab", buffering=0) as log:
process = subprocess.Popen(
command,
stdin=subprocess.DEVNULL,
stdout=log,
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
input_file = getattr(args, "input_file", None)
inline_decision = getattr(args, "decision", None)
if input_file:
if any(getattr(args, key, None) for key in ("input_id", "tool_use_id", "decision")):
raise BridgeError(
"input_response_mismatch",
"Use either an input file or an inline permission decision, not both.",