Security audit
Security checks across malware telemetry and agentic risk
This Redis inspection skill is not obviously malicious, but it can change Aliyun CLI setup, install plugins, and save sensitive cloud diagnostics, so it belongs in Review before installation.
Install only if you intend to let the skill inspect Alibaba Cloud Redis/Tair resources with an Aliyun profile. Use a least-privilege RAM role or user, avoid root AccessKeys, avoid full-account mode unless needed, review any plugin installation or CLI configuration changes first, and treat generated reports as sensitive because they may contain client IPs, instance details, Redis key names, and workload patterns.
def ensure_cli_plugins():
"""Ensure required aliyun CLI plugins are installed."""
try:
subprocess.run(['aliyun', 'configure', 'set', '--auto-plugin-install', 'true'],
capture_output=True, text=True, timeout=10)
except Exception:
passcapture_output=True, text=True, timeout=15)
if result.returncode == 0 and f'aliyun-cli-{plugin}' not in result.stdout:
print(f' Installing CLI plugin: {plugin}...', end='', flush=True)
install = subprocess.run(
['aliyun', 'plugin', 'install', '--name', f'aliyun-cli-{plugin}'],
capture_output=True, text=True, timeout=60)
if install.returncode == 0:"hookSpecificOutput": {
"hookEventName": "PreToolUse",
"permissionDecision": "allow",
"permissionDecisionReason": "Read operation API ($ACTION), no confirmation needed."
}
}
EOFcmd.extend([f'--{key}', str(value)])
try:
result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
if result.returncode == 0:
return json.loads(result.stdout)
except (subprocess.TimeoutExpired, json.JSONDecodeError):# Check aliyun CLI availability
try:
result = subprocess.run(['aliyun', 'version'], capture_output=True, text=True, timeout=5)
if result.returncode != 0:
raise FileNotFoundError
except (FileNotFoundError, subprocess.TimeoutExpired):def _sync_after_install():
"""Flush filesystem caches after plugin installation."""
try:
subprocess.run(['sync'], capture_output=True, text=True, timeout=10)
except Exception:
pass
time.sleep(1)def ensure_cli_plugins():
"""Ensure required aliyun CLI plugins are installed."""
try:
subprocess.run(['aliyun', 'configure', 'set', '--auto-plugin-install', 'true'],
capture_output=True, text=True, timeout=10)
except Exception:
passrequired_plugins = ['r-kvstore', 'cms', 'das']
for plugin in required_plugins:
try:
result = subprocess.run(['aliyun', 'plugin', 'list'],
capture_output=True, text=True, timeout=15)
if result.returncode == 0 and f'aliyun-cli-{plugin}' not in result.stdout:
print(f' Installing CLI plugin: {plugin}...', end='', flush=True)capture_output=True, text=True, timeout=15)
if result.returncode == 0 and f'aliyun-cli-{plugin}' not in result.stdout:
print(f' Installing CLI plugin: {plugin}...', end='', flush=True)
install = subprocess.run(
['aliyun', 'plugin', 'install', '--name', f'aliyun-cli-{plugin}'],
capture_output=True, text=True, timeout=60)
if install.returncode == 0:max_attempts = 5
for attempt in range(max_attempts):
try:
result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
combined_output = (result.stdout or '') + (result.stderr or '')
if 'text file busy' in combined_output.lower() and attempt < max_attempts - 1:
time.sleep(2)sudo mv aliyun /usr/local/bin/ # Or using package manager (Ubuntu/Debian/CentOS/RHEL) curl -fsSL https://aliyuncli.alicdn.com/setup.sh | sudo bash # Or using Homebrew (macOS) brew upgrade aliyun-cli
> **Pre-check: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > see `references/cli-installation-guide.md` for detailed installation instructions, > or run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update. > Then [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > Then [MUST] run `aliyun plugin update` to ensure plugins are up-to-date.
65/65 vendors flagged this skill as clean.