Security audit
Security checks across malware telemetry and agentic risk
The skill is a disclosed Alibaba Cloud network-diagnosis tool, but it includes broader-than-needed remote command execution paths that should be reviewed before installation.
Install only if you are comfortable granting Alibaba Cloud ECS remote command execution authority. Use a tightly scoped RAM policy limited to the intended ECS instances, review any command before approval, and avoid using the raw run-command subcommand. Treat ipinfo.io enrichment as third-party network metadata sharing, and prefer a version that removes the TLS-verification fallback and restricts remote commands to fixed diagnostic templates.
shell_cmd = " ".join(shlex.quote(c) for c in cmd)
try:
result = subprocess.run(
shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout,
)
except subprocess.TimeoutExpired:print(f"[WARNING] Transient error for {product} {api}, retrying...",
file=sys.stderr)
try:
retry_result = subprocess.run(
shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout)
if retry_result.returncode == 0:
try:shell_cmd = " ".join(shlex.quote(c) for c in cmd)
try:
result = subprocess.run(
shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout,
)
except subprocess.TimeoutExpired:print(f"[WARNING] Transient error for {product} {api}, retrying...",
file=sys.stderr)
try:
retry_result = subprocess.run(
shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout)
if retry_result.returncode == 0:
try:shell_cmd = " ".join(shlex.quote(c) for c in cmd)
try:
result = subprocess.run(
shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout,
)
except subprocess.TimeoutExpired:print(f"[WARNING] Transient error for {product} {api}, retrying...",
file=sys.stderr)
try:
retry_result = subprocess.run(
shell_cmd, shell=True, capture_output=True, text=True, timeout=timeout)
if retry_result.returncode == 0:
try:64/64 vendors flagged this skill as clean.
Detected: suspicious.insecure_tls_verification