Alibabacloud Pds Intelligent Workspace

Implements file upload, file download, document analysis, and video analysis features. Access cloud drive storage via mount app. The mount app installation p...

Security Scan

The skill mostly matches a PDS/CSP drive management tool but the package metadata omits required Alibaba Cloud credentials while the runtime docs instruct system-level installs and downloading/executing external installers — these mismatches and high-privilege operations warrant caution.

Purpose & Capability

The skill's functionality (upload/download/search/mount/install mount-app/process analysis) legitimately requires an authenticated Alibaba Cloud (Aliyun) CLI and credentials, yet the registry metadata declares no required environment variables/primary credential. That omission is an incoherence: the skill will not function without cloud credentials (AK/SK, STS, or OAuth) and access to the Aliyun CLI, so the metadata should have declared that dependency.

Instruction Scope

SKILL.md instructs the agent to run many system-level operations: install/upgrade Aliyun CLI, enable plugins, download mountapp packages, install drivers (Dokan/macFUSE/FUSE2), create scheduled tasks/system services, and run local Python scripts that will download signed URLs and additional artifacts. That scope goes beyond simple CLI calls and includes file downloads, service installation, and creation of startup tasks — all of which modify the host system and require admin privileges. While these steps align with the stated 'mount app' purpose, they expand the attack surface and require explicit user consent and careful verification.

Install Mechanism

There is no formal install spec (instruction-only), which reduces packaged install risk, but the runtime instructions tell the agent to curl and pipe an installer from aliyuncli.alicdn.com (official CDN) and to fetch a mountapp package from a URL returned by the CLI. The Aliyun CLI install source is an official Alibaba CDN; however the mountapp download URL is returned at runtime and could point to arbitrary hosts. The skill also instructs extracting and executing binaries from those downloads and installing drivers (MSI/RPM/DEB), which is high-impact.

Credentials

The skill requires Alibaba Cloud credentials (it repeatedly instructs verifying configured AK/STS/OAuth and forbids printing or entering AK/SK in chat), and the references discuss environment variables and ~/.aliyun/config.json usage. Yet the registry metadata lists no required env vars or primary credential. This mismatch is important: the skill needs cloud credentials and potentially broad RAM permissions (see ram-policies.md) but does not declare them, so an operator may not realize what secrets will be used or required.

Persistence & Privilege

always:false and model invocation are default (agent may call skill autonomously). The skill's installation instructions explicitly create scheduled tasks/services to run the mountapp at startup and write config/port files in the user's home directory — that is expected for a mount service but is privileged (system startup changes). The skill does not request 'always:true' and doesn't claim to modify other skills' configs.

What to consider before installing

This skill is plausibly a real Alibaba Cloud PDS workspace helper, but there are red flags you should consider before installing or letting it run: 1) Metadata omits required Alibaba Cloud credentials even though the instructions require an authenticated Aliyun CLI — assume the skill will need AK/SK, STS token, or OAuth set up outside the agent. 2) The runtime docs tell the agent to download and execute installers (Aliyun CLI + mountapp packages) and to install drivers and system services (Dokan, macFUSE, FUSE2) — these require administrator privileges and change startup behavior. Only proceed if you trust the mountapp download source and are prepared to review the downloaded packages manually. 3) The skill forbids printing credentials in chat, but some reference docs show examples that set credentials non-interactively; avoid entering secrets in chat and configure credentials yourself in a secure way (ECS RAM role or temporary STS tokens, least privilege RAM user). 4) If you plan to use the mount feature, validate the mountapp download URL returned by the CLI before running installers, inspect the package contents, and prefer manual installation. 5) Consider creating a dedicated RAM user with minimal permissions listed in ram-policies.md instead of using broad credentials. If you want a firmer assessment, provide the full contents of the Python scripts (pds_poll_processor.py, build_query.py, formatters) so they can be audited for hidden network endpoints, credential access, or data exfiltration.

PDS (Cloud Drive)

Please read this entire skill document carefully

Features

• For getting drive/drive_id, querying enterprise space, team space, personal space -> read references/drive.md
• For uploading local files to enterprise space, team space, personal space → read references/upload-file.md
• For downloading files from enterprise space, team space, personal space to local → read references/download-file.md
• For searching or finding files → read references/search-file.md
• For document/audio/video analysis, quick view, summarization on cloud drive → read references/multianalysis-file.md
• For image search, similar image search, image-text hybrid retrieval → read references/visual-similar-search.md
• For mount app, install mount app, uninstall mount app, stop mount app → read references/mountapp.md

Agent Execution Guidelines

• Must execute steps in order: Do not skip any step, do not proceed to the next step before the previous one is completed.
• Must follow documentation: The aliyun pds cli commands and parameters must follow this document's guidance, do not fabricate commands.
• Recommended parameter: All aliyun pds commands should include --user-agent AlibabaCloud-Agent-Skills parameter to help server identify request source, track usage, and troubleshoot issues.

Core Concepts:

• Domain: PDS instance with a unique domain_id, data is completely isolated between domains
• User: End user under a domain, has user_id
• Group: Team organization under a domain, divided into enterprise group and team group
• Drive: Storage space, can belong to a user (personal space) or team (team/enterprise space)
• File: File or folder under a space, has file_id
• Mountapp: PDS mount app plugin, used to mount PDS space to local, allowing users to access and manage files in PDS space conveniently

---

Installation Requirements

Prerequisites: Requires Aliyun CLI >= 3.3.1

Verify CLI version:

aliyun version  # requires >= 3.3.1

Verify PDS plugin version:

aliyun pds version  # requires >= 0.1.4

If version requirements are not met, refer to references/cli-installation-guide.md for installation or upgrade.

After installation, must enable auto plugin installation:

aliyun configure set --auto-plugin-install true

---

Authentication Configuration

Prerequisites: Alibaba Cloud credentials must be configured

Security Rules:

• Forbidden to read, output, or print AK/SK values (e.g., echo $ALIBABA_CLOUD_ACCESS_KEY_ID is forbidden)
• Forbidden to ask users to input AK/SK directly in conversation or command line
• Forbidden to use aliyun configure set to set plaintext credentials
• Only allowed to use aliyun configure list to check credential status

Check credential configuration:

aliyun configure list

Confirm the output shows a valid profile (AK, STS, or OAuth identity).

If no valid configuration exists, stop first.

1. Obtain credentials from Alibaba Cloud Console
2. Configure credentials outside this session (run aliyun configure in terminal or set environment variables)
3. Run aliyun configure list to verify after configuration is complete

# Install Aliyun CLI (if not installed)
curl -fsSL --max-time 10 https://aliyuncli.alicdn.com/install.sh | bash
aliyun version  # confirm >= 3.3.1

# Enable auto plugin installation
aliyun configure set --auto-plugin-install true

# Install Python dependencies (for multipart upload script)
pip3 install requests

PDS-Specific Configuration

Before executing any PDS operations, you must first configure domain_id, user_id, and authentication type -> read references/config.md

Recommended parameter: All aliyun pds commands should include --user-agent AlibabaCloud-Agent-Skills parameter

Examples:

aliyun pds get-user --user-agent AlibabaCloud-Agent-Skills
aliyun pds list-my-drives --user-agent AlibabaCloud-Agent-Skills
aliyun pds upload-file --drive-id <id> --local-path <path> --user-agent AlibabaCloud-Agent-Skills

References

Reference Document	Path
CLI Installation Guide	references/cli-installation-guide.md
RAM Permission Policies	references/ram-policies.md

Error Handling

1. If file search fails, please read references/search-file.md and strictly follow the documented process to re-execute file search.