When you develop AI Agent skills or integrate them into CI/CD pipelines, skill files may contain malicious scripts, risky configurations, or prompt injection attacks. Skills Detection scans skill files for security risks before deployment, automatically intercepting supply chain threats before they reach production.
Overview
Skills Detection is a security scanning component for the AI Agent ecosystem. You can integrate it into your development workflow or security operations platform through SDK or API. Unlike traditional code security scanners, Skills Detection focuses on the supply chain security of Agent Skills, covering dangerous commands, data exfiltration, prompt injection, privilege escalation, insecure configurations, and sensitive information leakage. For a list of identifiable risks, see Typical identifiable risks.
Detection capabilities
Malicious file detection: Identifies potentially malicious files, backdoors, persistence logic, and resource abuse behavior in skill files by combining external threat intelligence, malicious signatures, and suspicious script behavior analysis.
Sensitive information detection: Detects hardcoded API keys, AccessKey pairs, database credentials, private keys, Bearer tokens, and cloud provider credentials through rule matching and contextual analysis.
Skill poisoning and prompt attack detection: Detects prompt injection attacks delivered through malicious skill files, preventing attackers from tampering with Agent behavior, stealing sensitive information, or performing unauthorized operations.
LLM deep intent analysis: Uses large language models to analyze the overall behavioral intent of a skill, identifying combined risks, contextual risks, and hidden attack chains that rule-based detection alone cannot cover. For more information, see LLM deep intent analysis coverage.
Context-aware precision detection
The detection engine applies contextual analysis to achieve high-confidence risk identification.
DevOps workflow exemption: Automatically recognizes routine commands in DevOps, build, and test scripts, avoiding false positives for legitimate operations.
Non-sensitive content filtering: Semantically distinguishes environment variable placeholders, example configurations (such as
.env.example), and documentation text to exclude false credential alerts.Legitimate behavior noise reduction: Reduces the risk weight for public API calls, explicitly specified upload targets, and standard tool usage based on context.
Dynamic risk leveling: Privilege escalation and insecure configurations are classified as low-priority items by default. Alerts are escalated only when correlated with high-risk scenarios such as data exfiltration, backdoor installation, or malicious execution.
Precise intent recognition: Strictly differentiates between security education, risk disclosure documents, and actual attack commands in prompt interactions, ensuring that only malicious intent triggers interception.
Use cases
AI Agent application development: Detect malicious commands and prompt injections in skill files during development to ensure trusted sources and safe instructions.
CI/CD pipeline security scanning: Integrate Skills Detection into your continuous integration and delivery pipelines for automated security scanning.
Security operations center (SOC) integration: Connect Skills Detection to your SOC platform for continuous monitoring of the Agent ecosystem. After integrating with your security information and event management (SIEM) platform, all security events can be managed through a unified workflow.
Before you begin
You have activated a paid instance of Agent Security Center. For more information, see Purchase and unsubscribe from Agent Security Center.
Upload skill files
Currently, Agent Security Center supports integration only through SDKs. Call the CreateSkillFileCheck API operation to upload skill files and run risk detection. SDKs are available for Java, Go, and Python.
Install the SDK
Java
Requirements
Java 8 or later.
Installation
Add the following dependency to your Maven project:
<dependency>
<groupId>com.aliyun</groupId>
<artifactId>aisc20260101</artifactId>
<version>1.0.1</version>
</dependency>We recommend using the latest version. For version details, see SDK Reference.
Python
Requirements
Python 3.7 or later.
Installation
pip install alibabacloud_aisc20260101==1.0.1We recommend using the latest version. For version details, see SDK Reference.
Go
Requirements
Go 1.10 or later.
Install the OpenAPI core library.
go get github.com/alibabacloud-go/darabonba-openapi/v2/client
Installation
go get github.com/alibabacloud-go/aisc-20260101We recommend using the latest version. For version details, see SDK Reference.
Configure credentials
For more credential configuration methods, see Manage credentials.
AccessKey
Your Alibaba Cloud account has Administrator permissions on all resources by default and these cannot be modified. To ensure resource security, we recommend that you create a RAM user and create an AccessKey for the RAM user, then grant minimum required permissions based on your needs.
Create an AccessKey
Log on to the RAM console. In the page, click the target RAM user name. If you do not have a RAM user, Create a RAM user first.
On the Authentication tab, click Create AccessKey in the AccessKey section and follow the prompts to complete the creation.
Create a policy
Go to the Permissions > Policies page and click Create Policy.
Select Script mode and enter the following policy content, then click OK.
{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "yundun-aisc:CreateSkillFileCheck", "yundun-aisc:List*" ], "Resource": "*" } ] }In the Create Policy dialog box, enter a Policy Name and click OK.
Attach the policy: Click Grant Permission in the Actions column for the RAM user and attach the policy you created. For detailed steps, see Manage RAM user permissions.
ECS RAM role
An ECS RAM role is a regular RAM role assigned to an ECS instance, with Alibaba Cloud ECS as the trusted service. By using an instance RAM role, you can obtain temporary credentials (STS tokens) from within the ECS instance without configuring an AccessKey, allowing you to call Agent Security Center API operations.
Create an ECS RAM role and attach it to an ECS instance
Log on to the RAM console and create a RAM role trusted by Alibaba Cloud service. For detailed steps, see Instance RAM roles.
Trusted entity type: Select Elastic Compute Service.
Trusted entity name: Select Elastic Compute Service.
Log on to the ECS console and attach the RAM role to an ECS instance.

Create a policy
Go to the Permissions > Policies page and click Create Policy.
Select Script mode and enter the following policy content, then click OK.
{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "yundun-aisc:CreateSkillFileCheck", "yundun-aisc:List*" ], "Resource": "*" } ] }In the Create Policy dialog box, enter a Policy Name and click OK.
Attach the policy: Click Grant Permission in the Actions column for the ECS RAM role and attach the policy you created.
AccessKey + RamRoleArn
A RAM user or cloud service can assume a role to obtain temporary permissions (STS tokens) instead of using long-term credentials. This reduces the risk of credential leakage. For example, in a temporary data processing task, a RAM user or cloud service temporarily assumes a role with a specific RamRoleArn. After the task completes, the role permissions are revoked.
Create an AccessKey
Log on to the RAM console. In the page, click the target RAM user name. If you do not have a RAM user, Create a RAM user first.
Click Grant Permission in the Actions column for the RAM user and assign the system policy
AliyunSTSAssumeRoleAccessor a custom policy that includes thests:AssumeRolepermission.On the Authentication tab, click Create AccessKey in the AccessKey section and follow the prompts to complete the creation.
Create a policy
Go to the Permissions > Policies page and click Create Policy.
Select Script mode and enter the following policy content, then click OK.
{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "yundun-aisc:CreateSkillFileCheck", "yundun-aisc:List*" ], "Resource": "*" } ] }In the Create Policy dialog box, enter a Policy Name and click OK.
Create a RAM role and authorize it
On the page, click Create Role. For detailed steps, see Create a RAM role.
Click Grant Permission in the Actions column for the RAM role and attach the policy you created.
Obtain the RamRoleArn: Click the RAM role name you created to go to the details page. In the ARN section, you can view the RamRoleArn. For detailed steps, see View a RAM role.
NoteA RamRoleArn is the ARN of the RAM role to assume, in the format acs:ram::$accountID:role/$roleName, where $accountID is the Alibaba Cloud account ID and $roleName is the RAM role name.
Obtain the endpoint
The endpoint format is aisc.[RegionId].aliyuncs.com. For the full list of endpoints, see Endpoints.
Call the API operation
The following sample code demonstrates how to upload a skill file for detection using an AccessKey as the credential.
Replace #download_url# in the code with a publicly accessible URL for the skill file. We recommend uploading the skill file to Alibaba Cloud OSS and using a signed URL or a public-read URL as the DownloadUrl.
package com.aliyun.sample;
import com.aliyun.tea.*;
public class Sample {
/**
* <b>description</b> :
* <p>Initialize the client using credentials.</p>
* @return Client
*
* @throws Exception
*/
public static com.aliyun.aisc20260101.Client createClient() throws Exception {
// We recommend using credential methods other than AccessKey. For credential configuration, see https://www.alibabacloud.com/help/document_detail/378657.html.
com.aliyun.credentials.models.Config credentialConfig = new com.aliyun.credentials.models.Config();
credentialConfig.setType("access_key");
// Required. Example: obtain AccessKey ID from environment variables.
credentialConfig.setAccessKeyId(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"));
// Required. Example: obtain AccessKey Secret from environment variables.
credentialConfig.setAccessKeySecret(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"));
com.aliyun.credentials.Client credential = new com.aliyun.credentials.Client(credentialConfig);
com.aliyun.teaopenapi.models.Config config = new com.aliyun.teaopenapi.models.Config()
.setCredential(credential);
// For endpoint configuration, see https://api.aliyun.com/product/AISC
config.endpoint = "aisc.[RegionId].aliyuncs.com";
return new com.aliyun.aisc20260101.Client(config);
}
public static void main(String[] args_) throws Exception {
com.aliyun.aisc20260101.Client client = Sample.createClient();
// Replace with the actual DownloadUrl (public URL for file download) and FileName.
com.aliyun.aisc20260101.models.CreateSkillFileCheckRequest.CreateSkillFileCheckRequestFiles files0 = new com.aliyun.aisc20260101.models.CreateSkillFileCheckRequest.CreateSkillFileCheckRequestFiles()
.setDownloadUrl("#DownloadUrl#")
.setFileName("#FileName#");
com.aliyun.aisc20260101.models.CreateSkillFileCheckRequest createSkillFileCheckRequest = new com.aliyun.aisc20260101.models.CreateSkillFileCheckRequest()
.setFiles(java.util.Arrays.asList(
files0
));
com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
try {
com.aliyun.aisc20260101.models.CreateSkillFileCheckResponse resp = client.createSkillFileCheckWithOptions(createSkillFileCheckRequest, runtime);
System.out.println(new com.google.gson.Gson().toJson(resp));
} catch (TeaException error) {
// Display only. Handle exceptions properly in production code.
System.out.println(error.getMessage());
if (error.getData() != null) {
System.out.println(error.getData().get("Recommend"));
}
} catch (Exception _error) {
TeaException error = new TeaException(_error.getMessage(), _error);
// Display only. Handle exceptions properly in production code.
System.out.println(error.getMessage());
if (error.getData() != null) {
System.out.println(error.getData().get("Recommend"));
}
}
}
}# -*- coding: utf-8 -*-
# This file is auto-generated, don't edit it. Thanks.
import os
import sys
import json
from typing import List
from alibabacloud_aisc20260101.client import Client as AISC20260101Client
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
from alibabacloud_aisc20260101 import models as aisc20260101_models
from alibabacloud_tea_util import models as util_models
from alibabacloud_tea_util.client import Client as UtilClient
class Sample:
def __init__(self):
pass
@staticmethod
def create_client() -> AISC20260101Client:
"""
Initialize the client using credentials.
@return: Client
@throws Exception
"""
# We recommend using credential methods other than AccessKey. For credential configuration, see https://www.alibabacloud.com/help/document_detail/378659.html.
credentialsConfig = CredentialConfig(
type='access_key',
# Required. Example: obtain AccessKey ID from environment variables.
access_key_id=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID'),
# Required. Example: obtain AccessKey Secret from environment variables.
access_key_secret=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET')
)
credential = CredentialClient(credentialsConfig)
config = open_api_models.Config(
credential=credential
)
# For endpoint configuration, see https://api.aliyun.com/product/AISC
config.endpoint = f'aisc.[RegionId].aliyuncs.com'
return AISC20260101Client(config)
@staticmethod
def main(
args: List[str],
) -> None:
# Replace with the actual DownloadUrl (public URL for file download) and FileName.
client = Sample.create_client()
files_0 = aisc20260101_models.CreateSkillFileCheckRequestFiles(
download_url='#download_url#',
file_name='#file_name#'
)
create_skill_file_check_request = aisc20260101_models.CreateSkillFileCheckRequest(
files=[
files_0
]
)
runtime = util_models.RuntimeOptions()
try:
resp = client.create_skill_file_check_with_options(create_skill_file_check_request, runtime)
print(json.dumps(resp, default=str, indent=2))
except Exception as error:
# Display only. Handle exceptions properly in production code.
if hasattr(error, 'message'):
print(error.message)
if hasattr(error, 'data') and error.data:
print(error.data.get("Recommend"))
@staticmethod
async def main_async(
args: List[str],
) -> None:
client = Sample.create_client()
files_0 = aisc20260101_models.CreateSkillFileCheckRequestFiles(
download_url='#download_url#',
file_name='#file_name#'
)
create_skill_file_check_request = aisc20260101_models.CreateSkillFileCheckRequest(
files=[
files_0
]
)
runtime = util_models.RuntimeOptions()
try:
resp = await client.create_skill_file_check_with_options_async(create_skill_file_check_request, runtime)
print(json.dumps(resp, default=str, indent=2))
except Exception as error:
# Display only. Handle exceptions properly in production code.
if hasattr(error, 'message'):
print(error.message)
if hasattr(error, 'data') and error.data:
print(error.data.get("Recommend"))
if __name__ == '__main__':
Sample.main(sys.argv[1:])package main
import (
"encoding/json"
"strings"
"fmt"
"os"
aisc20260101 "github.com/alibabacloud-go/aisc-20260101/client"
openapi "github.com/alibabacloud-go/darabonba-openapi/v2/client"
util "github.com/alibabacloud-go/tea-utils/v2/service"
credential "github.com/aliyun/credentials-go/credentials"
"github.com/alibabacloud-go/tea/tea"
)
// Description:
//
// Initialize the client using credentials.
//
// @return Client
//
// @throws Exception
func CreateClient () (_result *aisc20260101.Client, _err error) {
// We recommend using credential methods other than AccessKey. For credential configuration, see https://www.alibabacloud.com/help/document_detail/378661.html.
credentialsConfig := new(credential.Config).
SetType("access_key").
SetAccessKeyId(os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_ID")).
SetAccessKeySecret(os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"))
credential, _err := credential.NewCredential(credentialsConfig)
if _err != nil {
return _result, _err
}
config := &openapi.Config{
Credential: credential,
}
// For endpoint configuration, see https://api.aliyun.com/product/AISC
config.Endpoint = tea.String("aisc.[RegionId].aliyuncs.com")
_result = &aisc20260101.Client{}
_result, _err = aisc20260101.NewClient(config)
return _result, _err
}
func _main (args []*string) (_err error) {
client, _err := CreateClient()
if _err != nil {
return _err
}
// Replace with the actual DownloadUrl (public URL for file download) and FileName.
files0 := &aisc20260101.CreateSkillFileCheckRequestFiles{
DownloadUrl: tea.String("#download_url#"),
FileName: tea.String("#file_name#"),
}
createSkillFileCheckRequest := &aisc20260101.CreateSkillFileCheckRequest{
Files: []*aisc20260101.CreateSkillFileCheckRequestFiles{files0},
}
runtime := &util.RuntimeOptions{}
tryErr := func()(_e error) {
defer func() {
if r := tea.Recover(recover()); r != nil {
_e = r
}
}()
resp, _err := client.CreateSkillFileCheckWithOptions(createSkillFileCheckRequest, runtime)
if _err != nil {
return _err
}
fmt.Printf("[LOG] %v\n", resp)
return nil
}()
if tryErr != nil {
var error = &tea.SDKError{}
if _t, ok := tryErr.(*tea.SDKError); ok {
error = _t
} else {
error.Message = tea.String(tryErr.Error())
}
// Display only. Handle exceptions properly in production code.
fmt.Println(tea.StringValue(error.Message))
var data interface{}
d := json.NewDecoder(strings.NewReader(tea.StringValue(error.Data)))
d.Decode(&data)
if m, ok := data.(map[string]interface{}); ok {
recommend, _ := m["Recommend"]
fmt.Println(recommend)
}
}
return _err
}
func main() {
err := _main(tea.StringSlice(os.Args[1:]))
if err != nil {
panic(err)
}
}Verify detection results
After submitting skill files for detection, you can verify the results through the following steps:
Upon successful API submission, the response includes a task ID. Use this task ID to track the detection progress.
Detection results appear on the Agent Security Center console within minutes after the scan completes.
Navigate to the Skills Check page to view the task status, risk level, and detailed detection results for each submitted file.
View risks and API usage
After you upload skill files to Agent Security Center through the SDK, the system automatically scans them and analyzes the risks. The analysis results are displayed on the Agent Security Center console.
Access the Security Center console - Agent Security Center - Agent Risks. In the upper-left corner of the page, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.
On the Skills Check tab, you can view the risk data for uploaded files.
Statistics fields
Field
Description
Used Quotas
The total number of skill files submitted for detection under the current account. This is the billing metric (one count per file).
Unprocessed Files
The number of submitted skill files that have risks and have not yet been resolved.
Unhandled Risk Severity
The distribution of unprocessed files by risk level: high, medium, and low.
Detection task list fields
Field
Description
Risk Level
The risk level of the detection result, classified as high (Critical/High), medium (Medium), or low (Low). For classification criteria, see Risk levels.
File Name
The name of the skill file submitted for detection.
SHA256
The SHA256 hash of the file, used to uniquely identify the file content.
Scenario
The detection trigger method. Currently, only SDK is supported.
First Detected At
The time when the file was first detected as risky.
Last Scan Time
The time of the most recent detection for this file.
Status
The risk processing status: Unhandled (pending) or Ignored (manually marked as ignored).
Resolve risks
On the Skills Check tab, click Details in the Actions column for the target file.
On the risk details page, choose a resolution method based on the analysis results in the Threat Description section.
Manual fix: Follow the remediation steps in the Solution section to manually resolve the risk in the AI Agent where the skill file is located.
Click Ignore in the lower-left corner if the risk is within an acceptable range. After the operation, the Status changes to Ignored.
Limits
The Skills Detection API is subject to a rate limit of 10 queries per second (QPS) by default. To request a higher quota, contact your business manager.
Each file submitted for detection can be up to 1 MB in size.
FAQ
How do I troubleshoot AccessKey configuration errors?
If the SDK returns an
InvalidAccessKeyIdorAccessKeyDisablederror, check the following:Ensure the AccessKey ID and AccessKey Secret are correct, with no extra spaces or line breaks.
Ensure the AccessKey is in the enabled state. Check the key status in the RAM console.
We recommend configuring credentials through the environment variables
ALIBABA_CLOUD_ACCESS_KEY_IDandALIBABA_CLOUD_ACCESS_KEY_SECRETto avoid hardcoding them in your code.
How do I handle API throttling?
If the SDK returns a
Throttling.Usererror, your call rate has exceeded the API throttling threshold (10 QPS by default). To resolve this:Add a retry mechanism to your call logic using exponential backoff (start with a 1-second wait, doubling each time, up to 3 retries).
To request a higher quota, contact your business manager.
Appendix
Risk levels
Risk level | Description |
Critical | May cause severe consequences such as system crashes, complete data loss, exposure of production credentials, or remote control. |
High | May cause data corruption, non-production credential exposure, significant security bypasses, or privilege abuse. |
Medium | May cause information leakage, development environment risks, or recoverable data or configuration issues. |
Low | Lower risk, commonly found in normal skill development scenarios. Requires contextual judgment. |
LLM deep intent analysis coverage
LLM deep intent analysis currently covers 6 categories with 46 check items.
Category | Check items | Core detection targets |
Dangerous commands | 12 | Destructive file deletion, disk operations, process termination, system shutdown, destructive database operations, destructive Git operations, package tampering, reverse shells, resource abuse, persistent backdoors, unsafe code injection, SQL injection, and path traversal. |
Data exfiltration | 7 | Outbound data transfer, credential file access, SSH key exposure, environment variable theft, clipboard or screenshot exfiltration, encoded data exfiltration, and Agent context leakage. |
Prompt injection | 8 | Direct command override, obfuscated commands, indirect manipulation, meta-command attacks, role switching, user deception, tool description injection, and system prompt leakage. |
Privilege escalation | 5 | Privilege escalation, sandbox bypass, security feature bypass, system configuration modification, and permission relaxation. |
Unsafe configuration | 6 | Dangerous tools without confirmation, missing confirmation requirements, overly permissive permissions, unsafe tool configurations, unsafe default behaviors, and MCP least privilege violations. |
Sensitive information leakage | 8 | Hardcoded API keys, hardcoded access keys, hardcoded secrets, hardcoded passwords, hardcoded database credentials, hardcoded private keys, hardcoded Bearer tokens, and hardcoded cloud credentials. |
Typical identifiable risks
Risk category | Typical characteristics |
Destructive commands | Destructive operations such as |
Credential theft | Reading |
Obfuscated commands | Encoding techniques such as Base64, Hex, ROT13, zero-width characters, and Unicode homoglyphs. |
Reverse shells | Reverse shell or remote control commands such as |
Persistent backdoors | Persistence mechanisms such as writing to |
Prompt injection | Injection patterns such as |
MCP tool injection | Hidden commands or permission induction in MCP tool descriptions, parameter schemas, or default values. |
Privilege escalation | Permission relaxation operations such as |
Unsafe configurations | Unsafe configurations such as |
Hardcoded credentials | Hardcoded credentials such as |