All Products
Search
Document Center

Agent Security Center:Skills Detection

Last Updated:Jul 10, 2026

When you develop AI Agent skills or integrate them into CI/CD pipelines, skill files may contain malicious scripts, risky configurations, or prompt injection attacks. Skills Detection scans skill files for security risks before deployment, automatically intercepting supply chain threats before they reach production.

Overview

Skills Detection is a security scanning component for the AI Agent ecosystem. You can integrate it into your development workflow or security operations platform through SDK or API. Unlike traditional code security scanners, Skills Detection focuses on the supply chain security of Agent Skills, covering dangerous commands, data exfiltration, prompt injection, privilege escalation, insecure configurations, and sensitive information leakage. For a list of identifiable risks, see Typical identifiable risks.

Detection capabilities

  • Malicious file detection: Identifies potentially malicious files, backdoors, persistence logic, and resource abuse behavior in skill files by combining external threat intelligence, malicious signatures, and suspicious script behavior analysis.

  • Sensitive information detection: Detects hardcoded API keys, AccessKey pairs, database credentials, private keys, Bearer tokens, and cloud provider credentials through rule matching and contextual analysis.

  • Skill poisoning and prompt attack detection: Detects prompt injection attacks delivered through malicious skill files, preventing attackers from tampering with Agent behavior, stealing sensitive information, or performing unauthorized operations.

  • LLM deep intent analysis: Uses large language models to analyze the overall behavioral intent of a skill, identifying combined risks, contextual risks, and hidden attack chains that rule-based detection alone cannot cover. For more information, see LLM deep intent analysis coverage.

Context-aware precision detection

The detection engine applies contextual analysis to achieve high-confidence risk identification.

  • DevOps workflow exemption: Automatically recognizes routine commands in DevOps, build, and test scripts, avoiding false positives for legitimate operations.

  • Non-sensitive content filtering: Semantically distinguishes environment variable placeholders, example configurations (such as .env.example), and documentation text to exclude false credential alerts.

  • Legitimate behavior noise reduction: Reduces the risk weight for public API calls, explicitly specified upload targets, and standard tool usage based on context.

  • Dynamic risk leveling: Privilege escalation and insecure configurations are classified as low-priority items by default. Alerts are escalated only when correlated with high-risk scenarios such as data exfiltration, backdoor installation, or malicious execution.

  • Precise intent recognition: Strictly differentiates between security education, risk disclosure documents, and actual attack commands in prompt interactions, ensuring that only malicious intent triggers interception.

Use cases

  • AI Agent application development: Detect malicious commands and prompt injections in skill files during development to ensure trusted sources and safe instructions.

  • CI/CD pipeline security scanning: Integrate Skills Detection into your continuous integration and delivery pipelines for automated security scanning.

  • Security operations center (SOC) integration: Connect Skills Detection to your SOC platform for continuous monitoring of the Agent ecosystem. After integrating with your security information and event management (SIEM) platform, all security events can be managed through a unified workflow.

Before you begin

You have activated a paid instance of Agent Security Center. For more information, see Purchase and unsubscribe from Agent Security Center.

Upload skill files

Currently, Agent Security Center supports integration only through SDKs. Call the CreateSkillFileCheck API operation to upload skill files and run risk detection. SDKs are available for Java, Go, and Python.

Install the SDK

Java

Requirements

Java 8 or later.

Installation

Add the following dependency to your Maven project:

<dependency>
  <groupId>com.aliyun</groupId>
  <artifactId>aisc20260101</artifactId>
  <version>1.0.1</version>
</dependency>
Important

We recommend using the latest version. For version details, see SDK Reference.

Python

Requirements

Python 3.7 or later.

Installation

pip install alibabacloud_aisc20260101==1.0.1
Important

We recommend using the latest version. For version details, see SDK Reference.

Go

Requirements

  • Go 1.10 or later.

  • Install the OpenAPI core library.

    go get github.com/alibabacloud-go/darabonba-openapi/v2/client

Installation

go get github.com/alibabacloud-go/aisc-20260101
Important

We recommend using the latest version. For version details, see SDK Reference.

Configure credentials

Note

For more credential configuration methods, see Manage credentials.

AccessKey

Note

Your Alibaba Cloud account has Administrator permissions on all resources by default and these cannot be modified. To ensure resource security, we recommend that you create a RAM user and create an AccessKey for the RAM user, then grant minimum required permissions based on your needs.

  1. Create an AccessKey

    1. Log on to the RAM console. In the Identities > Users page, click the target RAM user name. If you do not have a RAM user, Create a RAM user first.

    2. On the Authentication tab, click Create AccessKey in the AccessKey section and follow the prompts to complete the creation.

  2. Create a policy

    1. Go to the Permissions > Policies page and click Create Policy.

    2. Select Script mode and enter the following policy content, then click OK.

      {
        "Version": "1",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
              "yundun-aisc:CreateSkillFileCheck",
              "yundun-aisc:List*"
            ],
            "Resource": "*"
          }
        ]
      }
    3. In the Create Policy dialog box, enter a Policy Name and click OK.

  3. Attach the policy: Click Grant Permission in the Actions column for the RAM user and attach the policy you created. For detailed steps, see Manage RAM user permissions.

ECS RAM role

An ECS RAM role is a regular RAM role assigned to an ECS instance, with Alibaba Cloud ECS as the trusted service. By using an instance RAM role, you can obtain temporary credentials (STS tokens) from within the ECS instance without configuring an AccessKey, allowing you to call Agent Security Center API operations.

  1. Create an ECS RAM role and attach it to an ECS instance

    1. Log on to the RAM console and create a RAM role trusted by Alibaba Cloud service. For detailed steps, see Instance RAM roles.

      1. Trusted entity type: Select Elastic Compute Service.

      2. Trusted entity name: Select Elastic Compute Service.

    2. Log on to the ECS console and attach the RAM role to an ECS instance. Attach RAM role to ECS instance

  2. Create a policy

    1. Go to the Permissions > Policies page and click Create Policy.

    2. Select Script mode and enter the following policy content, then click OK.

      {
        "Version": "1",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
              "yundun-aisc:CreateSkillFileCheck",
              "yundun-aisc:List*"
            ],
            "Resource": "*"
          }
        ]
      }
    3. In the Create Policy dialog box, enter a Policy Name and click OK.

  3. Attach the policy: Click Grant Permission in the Actions column for the ECS RAM role and attach the policy you created.

AccessKey + RamRoleArn

A RAM user or cloud service can assume a role to obtain temporary permissions (STS tokens) instead of using long-term credentials. This reduces the risk of credential leakage. For example, in a temporary data processing task, a RAM user or cloud service temporarily assumes a role with a specific RamRoleArn. After the task completes, the role permissions are revoked.

  1. Create an AccessKey

    1. Log on to the RAM console. In the Identities > Users page, click the target RAM user name. If you do not have a RAM user, Create a RAM user first.

    2. Click Grant Permission in the Actions column for the RAM user and assign the system policy AliyunSTSAssumeRoleAccess or a custom policy that includes the sts:AssumeRole permission.

    3. On the Authentication tab, click Create AccessKey in the AccessKey section and follow the prompts to complete the creation.

  2. Create a policy

    1. Go to the Permissions > Policies page and click Create Policy.

    2. Select Script mode and enter the following policy content, then click OK.

      {
        "Version": "1",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
              "yundun-aisc:CreateSkillFileCheck",
              "yundun-aisc:List*"
            ],
            "Resource": "*"
          }
        ]
      }
    3. In the Create Policy dialog box, enter a Policy Name and click OK.

  3. Create a RAM role and authorize it

    1. On the Identities > Roles page, click Create Role. For detailed steps, see Create a RAM role.

    2. Click Grant Permission in the Actions column for the RAM role and attach the policy you created.

  4. Obtain the RamRoleArn: Click the RAM role name you created to go to the details page. In the ARN section, you can view the RamRoleArn. For detailed steps, see View a RAM role.

    Note

    A RamRoleArn is the ARN of the RAM role to assume, in the format acs:ram::$accountID:role/$roleName, where $accountID is the Alibaba Cloud account ID and $roleName is the RAM role name.

Obtain the endpoint

The endpoint format is aisc.[RegionId].aliyuncs.com. For the full list of endpoints, see Endpoints.

Call the API operation

The following sample code demonstrates how to upload a skill file for detection using an AccessKey as the credential.

Note

Replace #download_url# in the code with a publicly accessible URL for the skill file. We recommend uploading the skill file to Alibaba Cloud OSS and using a signed URL or a public-read URL as the DownloadUrl.

package com.aliyun.sample;

import com.aliyun.tea.*;

public class Sample {

    /**
     * <b>description</b> :
     * <p>Initialize the client using credentials.</p>
     * @return Client
     *
     * @throws Exception
     */
    public static com.aliyun.aisc20260101.Client createClient() throws Exception {
        // We recommend using credential methods other than AccessKey. For credential configuration, see https://www.alibabacloud.com/help/document_detail/378657.html.
        com.aliyun.credentials.models.Config credentialConfig = new com.aliyun.credentials.models.Config();
        credentialConfig.setType("access_key");
        // Required. Example: obtain AccessKey ID from environment variables.
        credentialConfig.setAccessKeyId(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"));
        // Required. Example: obtain AccessKey Secret from environment variables.
        credentialConfig.setAccessKeySecret(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"));

        com.aliyun.credentials.Client credential = new com.aliyun.credentials.Client(credentialConfig);
        com.aliyun.teaopenapi.models.Config config = new com.aliyun.teaopenapi.models.Config()
                .setCredential(credential);
        // For endpoint configuration, see https://api.aliyun.com/product/AISC
        config.endpoint = "aisc.[RegionId].aliyuncs.com";
        return new com.aliyun.aisc20260101.Client(config);
    }

    public static void main(String[] args_) throws Exception {
        com.aliyun.aisc20260101.Client client = Sample.createClient();
        // Replace with the actual DownloadUrl (public URL for file download) and FileName.
        com.aliyun.aisc20260101.models.CreateSkillFileCheckRequest.CreateSkillFileCheckRequestFiles files0 = new com.aliyun.aisc20260101.models.CreateSkillFileCheckRequest.CreateSkillFileCheckRequestFiles()
                .setDownloadUrl("#DownloadUrl#")
                .setFileName("#FileName#");
        com.aliyun.aisc20260101.models.CreateSkillFileCheckRequest createSkillFileCheckRequest = new com.aliyun.aisc20260101.models.CreateSkillFileCheckRequest()
                .setFiles(java.util.Arrays.asList(
                    files0
                ));
        com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
        try {
            com.aliyun.aisc20260101.models.CreateSkillFileCheckResponse resp = client.createSkillFileCheckWithOptions(createSkillFileCheckRequest, runtime);
            System.out.println(new com.google.gson.Gson().toJson(resp));
        } catch (TeaException error) {
            // Display only. Handle exceptions properly in production code.
            System.out.println(error.getMessage());
            if (error.getData() != null) {
                System.out.println(error.getData().get("Recommend"));
            }
        } catch (Exception _error) {
            TeaException error = new TeaException(_error.getMessage(), _error);
            // Display only. Handle exceptions properly in production code.
            System.out.println(error.getMessage());
            if (error.getData() != null) {
                System.out.println(error.getData().get("Recommend"));
            }
        }
    }
}
# -*- coding: utf-8 -*-
# This file is auto-generated, don't edit it. Thanks.
import os
import sys
import json

from typing import List

from alibabacloud_aisc20260101.client import Client as AISC20260101Client
from alibabacloud_credentials.client import Client as CredentialClient
from alibabacloud_credentials.models import Config as CredentialConfig
from alibabacloud_tea_openapi import models as open_api_models
from alibabacloud_aisc20260101 import models as aisc20260101_models
from alibabacloud_tea_util import models as util_models
from alibabacloud_tea_util.client import Client as UtilClient


class Sample:
    def __init__(self):
        pass

    @staticmethod
    def create_client() -> AISC20260101Client:
        """
        Initialize the client using credentials.
        @return: Client
        @throws Exception
        """
        # We recommend using credential methods other than AccessKey. For credential configuration, see https://www.alibabacloud.com/help/document_detail/378659.html.
        credentialsConfig = CredentialConfig(
            type='access_key',
            # Required. Example: obtain AccessKey ID from environment variables.
            access_key_id=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID'),
            # Required. Example: obtain AccessKey Secret from environment variables.
            access_key_secret=os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET')
        )
        credential = CredentialClient(credentialsConfig)
        config = open_api_models.Config(
            credential=credential
        )
        # For endpoint configuration, see https://api.aliyun.com/product/AISC
        config.endpoint = f'aisc.[RegionId].aliyuncs.com'
        return AISC20260101Client(config)

    @staticmethod
    def main(
        args: List[str],
    ) -> None:
        # Replace with the actual DownloadUrl (public URL for file download) and FileName.
        client = Sample.create_client()
        files_0 = aisc20260101_models.CreateSkillFileCheckRequestFiles(
            download_url='#download_url#',
            file_name='#file_name#'
        )
        create_skill_file_check_request = aisc20260101_models.CreateSkillFileCheckRequest(
            files=[
                files_0
            ]
        )
        runtime = util_models.RuntimeOptions()
        try:
            resp = client.create_skill_file_check_with_options(create_skill_file_check_request, runtime)
            print(json.dumps(resp, default=str, indent=2))
        except Exception as error:
            # Display only. Handle exceptions properly in production code.
            if hasattr(error, 'message'):
                print(error.message)
            if hasattr(error, 'data') and error.data:
                print(error.data.get("Recommend"))

    @staticmethod
    async def main_async(
        args: List[str],
    ) -> None:
        client = Sample.create_client()
        files_0 = aisc20260101_models.CreateSkillFileCheckRequestFiles(
            download_url='#download_url#',
            file_name='#file_name#'
        )
        create_skill_file_check_request = aisc20260101_models.CreateSkillFileCheckRequest(
            files=[
                files_0
            ]
        )
        runtime = util_models.RuntimeOptions()
        try:
            resp = await client.create_skill_file_check_with_options_async(create_skill_file_check_request, runtime)
            print(json.dumps(resp, default=str, indent=2))
        except Exception as error:
            # Display only. Handle exceptions properly in production code.
            if hasattr(error, 'message'):
                print(error.message)
            if hasattr(error, 'data') and error.data:
                print(error.data.get("Recommend"))


if __name__ == '__main__':
    Sample.main(sys.argv[1:])
package main

import (
  "encoding/json"
  "strings"
  "fmt"
  "os"
  aisc20260101  "github.com/alibabacloud-go/aisc-20260101/client"
  openapi  "github.com/alibabacloud-go/darabonba-openapi/v2/client"
  util  "github.com/alibabacloud-go/tea-utils/v2/service"
  credential  "github.com/aliyun/credentials-go/credentials"
  "github.com/alibabacloud-go/tea/tea"
)


// Description:
//
// Initialize the client using credentials.
//
// @return Client
//
// @throws Exception
func CreateClient () (_result *aisc20260101.Client, _err error) {
  // We recommend using credential methods other than AccessKey. For credential configuration, see https://www.alibabacloud.com/help/document_detail/378661.html.
  credentialsConfig := new(credential.Config).
    SetType("access_key").
    SetAccessKeyId(os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_ID")).
    SetAccessKeySecret(os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"))
  credential, _err := credential.NewCredential(credentialsConfig)
  if _err != nil {
    return _result, _err
  }

  config := &openapi.Config{
    Credential: credential,
  }
  // For endpoint configuration, see https://api.aliyun.com/product/AISC
  config.Endpoint = tea.String("aisc.[RegionId].aliyuncs.com")
  _result = &aisc20260101.Client{}
  _result, _err = aisc20260101.NewClient(config)
  return _result, _err
}

func _main (args []*string) (_err error) {
  client, _err := CreateClient()
  if _err != nil {
    return _err
  }
  // Replace with the actual DownloadUrl (public URL for file download) and FileName.
  files0 := &aisc20260101.CreateSkillFileCheckRequestFiles{
    DownloadUrl: tea.String("#download_url#"),
    FileName: tea.String("#file_name#"),
  }
  createSkillFileCheckRequest := &aisc20260101.CreateSkillFileCheckRequest{
    Files: []*aisc20260101.CreateSkillFileCheckRequestFiles{files0},
  }
  runtime := &util.RuntimeOptions{}
  tryErr := func()(_e error) {
    defer func() {
      if r := tea.Recover(recover()); r != nil {
        _e = r
      }
    }()
    resp, _err := client.CreateSkillFileCheckWithOptions(createSkillFileCheckRequest, runtime)
    if _err != nil {
      return _err
    }

    fmt.Printf("[LOG] %v\n", resp)

    return nil
  }()

  if tryErr != nil {
    var error = &tea.SDKError{}
    if _t, ok := tryErr.(*tea.SDKError); ok {
      error = _t
    } else {
      error.Message = tea.String(tryErr.Error())
    }
    // Display only. Handle exceptions properly in production code.
    fmt.Println(tea.StringValue(error.Message))
    var data interface{}
    d := json.NewDecoder(strings.NewReader(tea.StringValue(error.Data)))
    d.Decode(&data)
    if m, ok := data.(map[string]interface{}); ok {
      recommend, _ := m["Recommend"]
      fmt.Println(recommend)
    }
  }
  return _err
}


func main() {
  err := _main(tea.StringSlice(os.Args[1:]))
  if err != nil {
    panic(err)
  }
}

Verify detection results

After submitting skill files for detection, you can verify the results through the following steps:

  • Upon successful API submission, the response includes a task ID. Use this task ID to track the detection progress.

  • Detection results appear on the Agent Security Center console within minutes after the scan completes.

  • Navigate to the Skills Check page to view the task status, risk level, and detailed detection results for each submitted file.

View risks and API usage

After you upload skill files to Agent Security Center through the SDK, the system automatically scans them and analyzes the risks. The analysis results are displayed on the Agent Security Center console.

  1. Access the Security Center console - Agent Security Center - Agent Risks. In the upper-left corner of the page, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.

  2. On the Skills Check tab, you can view the risk data for uploaded files.

    • Statistics fields

      Field

      Description

      Used Quotas

      The total number of skill files submitted for detection under the current account. This is the billing metric (one count per file).

      Unprocessed Files

      The number of submitted skill files that have risks and have not yet been resolved.

      Unhandled Risk Severity

      The distribution of unprocessed files by risk level: high, medium, and low.

    • Detection task list fields

      Field

      Description

      Risk Level

      The risk level of the detection result, classified as high (Critical/High), medium (Medium), or low (Low). For classification criteria, see Risk levels.

      File Name

      The name of the skill file submitted for detection.

      SHA256

      The SHA256 hash of the file, used to uniquely identify the file content.

      Scenario

      The detection trigger method. Currently, only SDK is supported.

      First Detected At

      The time when the file was first detected as risky.

      Last Scan Time

      The time of the most recent detection for this file.

      Status

      The risk processing status: Unhandled (pending) or Ignored (manually marked as ignored).

Resolve risks

  1. On the Skills Check tab, click Details in the Actions column for the target file.

  2. On the risk details page, choose a resolution method based on the analysis results in the Threat Description section.

    • Manual fix: Follow the remediation steps in the Solution section to manually resolve the risk in the AI Agent where the skill file is located.

    • Click Ignore in the lower-left corner if the risk is within an acceptable range. After the operation, the Status changes to Ignored.

Limits

  • The Skills Detection API is subject to a rate limit of 10 queries per second (QPS) by default. To request a higher quota, contact your business manager.

  • Each file submitted for detection can be up to 1 MB in size.

FAQ

  • How do I troubleshoot AccessKey configuration errors?

    If the SDK returns an InvalidAccessKeyId or AccessKeyDisabled error, check the following:

    • Ensure the AccessKey ID and AccessKey Secret are correct, with no extra spaces or line breaks.

    • Ensure the AccessKey is in the enabled state. Check the key status in the RAM console.

    • We recommend configuring credentials through the environment variables ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET to avoid hardcoding them in your code.

  • How do I handle API throttling?

    If the SDK returns a Throttling.User error, your call rate has exceeded the API throttling threshold (10 QPS by default). To resolve this:

    • Add a retry mechanism to your call logic using exponential backoff (start with a 1-second wait, doubling each time, up to 3 retries).

    • To request a higher quota, contact your business manager.

Appendix

Risk levels

Risk level

Description

Critical

May cause severe consequences such as system crashes, complete data loss, exposure of production credentials, or remote control.

High

May cause data corruption, non-production credential exposure, significant security bypasses, or privilege abuse.

Medium

May cause information leakage, development environment risks, or recoverable data or configuration issues.

Low

Lower risk, commonly found in normal skill development scenarios. Requires contextual judgment.

LLM deep intent analysis coverage

LLM deep intent analysis currently covers 6 categories with 46 check items.

Category

Check items

Core detection targets

Dangerous commands

12

Destructive file deletion, disk operations, process termination, system shutdown, destructive database operations, destructive Git operations, package tampering, reverse shells, resource abuse, persistent backdoors, unsafe code injection, SQL injection, and path traversal.

Data exfiltration

7

Outbound data transfer, credential file access, SSH key exposure, environment variable theft, clipboard or screenshot exfiltration, encoded data exfiltration, and Agent context leakage.

Prompt injection

8

Direct command override, obfuscated commands, indirect manipulation, meta-command attacks, role switching, user deception, tool description injection, and system prompt leakage.

Privilege escalation

5

Privilege escalation, sandbox bypass, security feature bypass, system configuration modification, and permission relaxation.

Unsafe configuration

6

Dangerous tools without confirmation, missing confirmation requirements, overly permissive permissions, unsafe tool configurations, unsafe default behaviors, and MCP least privilege violations.

Sensitive information leakage

8

Hardcoded API keys, hardcoded access keys, hardcoded secrets, hardcoded passwords, hardcoded database credentials, hardcoded private keys, hardcoded Bearer tokens, and hardcoded cloud credentials.

Typical identifiable risks

Risk category

Typical characteristics

Destructive commands

Destructive operations such as rm -rf, mkfs, dd, DROP DATABASE, and git reset --hard.

Credential theft

Reading .env, credentials.json, ~/.aws/credentials, or ~/.ssh/id_rsa and exfiltrating the content.

Obfuscated commands

Encoding techniques such as Base64, Hex, ROT13, zero-width characters, and Unicode homoglyphs.

Reverse shells

Reverse shell or remote control commands such as bash -i, nc -e, and PowerShell EncodedCommand.

Persistent backdoors

Persistence mechanisms such as writing to crontab, systemctl, shell profiles, or authorized_keys.

Prompt injection

Injection patterns such as ignore previous instructions, do not tell the user, and you are now.

MCP tool injection

Hidden commands or permission induction in MCP tool descriptions, parameter schemas, or default values.

Privilege escalation

Permission relaxation operations such as sudo, --no-sandbox, chmod 777, and Set-ExecutionPolicy.

Unsafe configurations

Unsafe configurations such as alwaysAllow, require_confirmation: false, tools: ["*"], and permissions: ["all"].

Hardcoded credentials

Hardcoded credentials such as sk-, AKIA, LTAI, ghp_, xoxb-, JWTs, RSA private keys, and database connection strings.