Security audit
Security checks across malware telemetry and agentic risk
This is a real cloud deployment skill, but it should go to Review because some automatic purchases and account-wide changes are broader or less clearly disclosed than the user-facing summaries suggest.
Install only if you are comfortable granting a deployment assistant permission to create and manage billable Alibaba Cloud resources. Before running it, ask for an itemized confirmation of every paid or account-wide action, especially ESA PurchaseRatePlan and ActionTrail. Use the dedicated RamRoleArn setup and quota limits, avoid broad admin credentials, and review the files it leaves under state/, ~/.aliyun, ~/.local/bin, ~/.opc, and ~/.ssh.
VER="$(read [cli_meta].min_version)"
SHA="$(read [cli_meta].sha256_darwin_arm64)" # or darwin_amd64
TOFU_FILE="$HOME/.opc/cli-tofu-${VER}-darwin-arm64.sha256"
mkdir -p ~/.local/bin ~/.opc
curl -fLo /tmp/aliyun-cli.tgz --connect-timeout 15 --max-time 300 "https://aliyuncli.alicdn.com/aliyun-cli-darwin-arm64-${VER}.tgz"
# SHA256 three-tier verification
ACTUAL_SHA="$(shasum -a 256 /tmp/aliyun-cli.tgz | awk '{print $1}')"User-facing progress:
metadata has SHA256 → "正在安装部署工具…… ✓ 已安装（版本 ${VER}，完整性校验通过）"
TOFU hit existing record → "正在安装部署工具…… ✓ 已安装（版本 ${VER}，与首次记录一致）"
TOFU first write → "正在安装部署工具…… ✓ 已安装（版本 ${VER}，首次安装哈希已记录）"
⚠️ iron-rule #13: the entire CLI install completes inside the current AI terminal's Bash/PowerShell; do NOT output commands for the user to run manually.
⚠️ iron-rule #28: CLI install and credential config are two independent things — this step only installs the CLI; credential config runs in the user's local terminal in Phase 0.3.2. **Step-by-step execution + step-by-step reporting**: after each resource is created, tell the user the result (IP / connection string / status); do not silently run a long batch. 3. **Never fail silently**: if any step's API errors → immediately tell the user which step failed + the error message + a suggestion (retry / switch zone / check quota). 4. **Be honest that Token Plan / PDS cannot be automated**: on a Token Plan or Alibaba Cloud Drive PDS step → output the console link + operating instructions, and wait for the user to confirm "I've enabled it". **ESA now supports API auto-provisioning** (the PurchaseRatePlan API). 5. **VPC reuse-first**: first query existing VPCs tagged `opc:managed=true`; reuse if present, only create when none exists. 6. **The state file must be written**: after each creation, append the resource ID to `state/<sku>-<timestamp>.json`, used to recognize existing resources during later upgrade/management. 7. **Database passwords never hit disk**: after generation the password is **shown once in the conversation only**; the state file records only `password_set: true` + `set_at`, and it is never written to any state/log/yaml. If the user loses the password → reset via RDS `ResetAccountPassword`, never recover from history. AccessKeys are likewise never displayed, stored, or echoed (see iron-rule #15). 8. **MCP-first, CLI-fallback**: when MCP is detected available, call via MCP; otherwise fall back to executing `aliyun` CLI Bash commands directly.
VirusTotal findings are pending for this skill version.
No suspicious patterns detected.