Qwen Video (Wan)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:27 PM UTC
• Version: 1.1.0

Overview

This video-generation skill is purpose-aligned, but it uses unsafe shell networking and input handling that could expose the API key or allow command execution through crafted arguments.

Review before installing. Use only with non-sensitive prompts and audio URLs, and do not use current scripts with valuable DashScope credentials until curl -k is removed, inputs are validated, JSON is built safely, and returned media URLs are constrained to expected HTTPS hosts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/submit.sh:60

Finding

TLS Certificate Verification Disabled for Authenticated API Requests and Media Downloads

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/submit.sh:52

Finding

Unescaped User Input Allows JSON Request-Structure Injection

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/poll.sh:71

Finding

Unvalidated Timeout Value Is Evaluated as a Bash Arithmetic Expression

Content

View full analysis

= MAX_WAIT_SEC )); then echo "Timeout after ${MAX_WAIT_SEC}s" >&2 echo "$RESP" >&2 exit 1 fi sleep "$INTERVAL_SEC" ``` The value can also enter this path through `scripts/generate.sh`: ```bash --max-wait-sec) MAX_WAIT_SEC=${2:-1200}; shift 2;; ``` ```bash VIDEO_URL=$(bash "$BASE_DIR/scripts/poll.sh" --task-id "$TASK_ID" --max-wait-sec "$MAX_WAIT_SEC" --interval-sec "$INTERVAL_SEC" | sed -n 's/^VIDEO_URL: //p' | tail -n 1) ``` ### Technical Analysis Bash arithmetic contexts do not merely convert arbitrary strings to integers. Variable values can be interpreted recursively as arithmetic expressions. Arithmetic parsing supports variable and array references, and array subscript processing can trigger shell expansions such as command substitution. Consequently, an attacker-controlled value supplied as `--max-wait-sec` can be interpreted as executable arithmetic syntax when this statement is reached: ```bash (( ELAPSED >= MAX_WAIT_SEC )) ``` For example, an expression shaped like an array reference with a command substitution in its subscript can cause the command substitution to execute during arithmetic evaluation. The exact payload may depend on the Bash version and variable environment, but the unsafe primitive is present because unrestricted text is passed into recursive arithmetic evaluat ...[truncated 1665 chars]

Remediation

View remediation

&2 exit 2 } [[ "$INTERVAL_SEC" =~ ^[0-9]+$ ]] || { echo "Error: --interval-sec must be a non-negative integer" >&2 exit 2 } ``` 2. Apply reasonable upper and lower bounds, for example: ```bash (( 1 <= MAX_WAIT_SEC && MAX_WAIT_SEC <= 3600 )) || exit 2 (( 1 <= INTERVAL_SEC && INTERVAL_SEC <= 300 )) || exit 2 ``` 3. To avoid interpreting a validated value with leading-zero semantics, normalize it as base 10: ```bash MAX_WAIT_SEC=$((10#$MAX_WAIT_SEC)) INTERVAL_SEC=$((10#$INTERVAL_SEC)) ``` Handle zero separately if the supported Bash version rejects `10#` without following digits. 4. Perform the same validation in `generate.sh` before forwarding values to `poll.sh`, while retaining validation in `poll.sh` as the security boundary. 5. Add regression tests using nonnumeric strings, arithmetic expressions, array references, command-substitution patterns, negative values, and excessively large values. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code does match part of the declared purpose: it submits an async DashScope Wan video-generation request using a text prompt. However, the description says the skill should also poll status and download the MP4 locally, which this code does not do. Its behavior ends after submission and task_id extraction. Additionally, the script accepts an optional audio_url parameter, extending functionality beyond a pure text-to-video description. Because key declared lifecycle steps (polling and downloading) are missing, the description does not accurately represent the supplied code chunk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Using curl -L -k silently bypasses certificate verification without warning the user, defeating HTTPS protections and making network interception or content substitution feasible. Because this skill's purpose is to fetch and save generated media from an external service, transport integrity is security-relevant and disabling it is unjustified by the stated functionality.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The curl -L -k invocation combines redirect following with disabled certificate checks, which can be abused to redirect the client to attacker-controlled infrastructure and download untrusted content. In the context of an agent skill that automatically retrieves a URL returned from prior API calls, this increases the blast radius because a compromised network path or manipulated endpoint can control what is written to disk.

Content

Scanner excerpt · scripts/generate.sh (reported line 78)May include surrounding context.

sh

# Download
mkdir -p "$(dirname "$OUT")"
curl -L -k -o "$OUT" "$VIDEO_URL"

FULL=$(python3 -c 'import os,sys; print(os.path.abspath(sys.argv[1]))' "$OUT")
echo "MEDIA: $FULL"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The script invokes curl with the -k flag, which disables TLS certificate validation for the HTTPS request to DashScope. This allows a man-in-the-middle attacker on the network path to intercept or modify the task status response, potentially exposing the Bearer API key and causing the script to trust attacker-controlled status or video URLs.

Content

Scanner excerpt · scripts/poll.sh (reported line 44)May include surrounding context.

sh

START=$(date +%s)
while true; do
  RESP=$(curl -sS -k --location "https://dashscope.aliyuncs.com/api/v1/tasks/$TASK_ID" \
    -H "Authorization: Bearer $DASHSCOPE_API_KEY")

  STATUS=$(echo "$RESP" | sed -n 's/.*"task_status"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The curl command uses -k, which disables TLS certificate verification and allows an attacker on the network path to impersonate the DashScope endpoint. Because the request includes the Bearer API key and user content, a successful man-in-the-middle attack could steal credentials, tamper with submitted jobs, or return forged task IDs/results.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The dangerous tool parameter here is curl -k, which weakens the security guarantees of the network client by disabling certificate validation. In this skill, that is especially risky because the same request carries a live API credential and untrusted user-supplied content to a remote endpoint.

Content

Scanner excerpt · scripts/submit.sh (reported line 60)May include surrounding context.

sh

DATA="{\"model\":\"$MODEL\",\"input\":{\"prompt\":\"$PROMPT\"$AUDIO_FIELD},\"parameters\":{\"size\":\"$SIZE\",\"prompt_extend\":$PROMPT_EXTEND,\"duration\":$DURATION,\"shot_type\":\"$SHOT_TYPE\"}}"

RESP=$(curl -sS -k --location "$API_URL" \
  -H 'X-DashScope-Async: enable' \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H 'Content-Type: application/json' \

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises and documents shell-based execution paths but does not declare any tool scope or allowed-tools restrictions. That creates an authorization gap where an agent may invoke shell capabilities more broadly than users or platform policy expect, increasing the chance of unintended command execution or file writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages sending prompts, API credentials, and potentially user-supplied audio URLs to a third-party external service without an explicit warning in the description. This can cause users to disclose sensitive prompts or reference internal/private URLs without informed consent, creating privacy and data-governance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The skill explicitly sends user-controlled content to an external API endpoint using curl with bearer-token authentication. In context, external transmission is expected for a video-generation skill, but it remains security-relevant because prompts, optional audio_url values, and associated metadata leave the local environment and may expose sensitive or internal information if users are not warned.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

仅 wan2.6 系列模型支持此功能。通过设置 prompt_extend: true 和 shot_type: "multi" 启用。

bash

curl --location 'https://dashscope.aliyuncs.com/api/v1/services/aigc/video-generation/video-synthesis' \
  -H 'X-DashScope-Async: enable' \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H 'Content-Type: application/json' \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script downloads a remote file with curl -k, which disables TLS certificate validation and allows a man-in-the-middle attacker to spoof the video host and supply arbitrary content. In this skill, the downloaded artifact is saved locally and presented as the generated media, so the insecure transport directly affects integrity of the output and could also expose the user to malicious files disguised as MP4 content.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This script intentionally sends prompt data, optional audio_url metadata, and an authorization token to an external service. In a video-generation skill this external transmission is expected, but it still represents a real security/privacy boundary crossing, especially if users provide confidential text or internal resource references.

Content

Scanner excerpt · scripts/submit.sh (reported line 60)May include surrounding context.

sh

DATA="{\"model\":\"$MODEL\",\"input\":{\"prompt\":\"$PROMPT\"$AUDIO_FIELD},\"parameters\":{\"size\":\"$SIZE\",\"prompt_extend\":$PROMPT_EXTEND,\"duration\":$DURATION,\"shot_type\":\"$SHOT_TYPE\"}}"

RESP=$(curl -sS -k --location "$API_URL" \
  -H 'X-DashScope-Async: enable' \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H 'Content-Type: application/json' \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script transmits the user-supplied prompt and optional audio URL to Alibaba Cloud's external API, but provides no explicit warning, confirmation, or data-handling notice. In this skill context, users may include sensitive prompts or internal URLs, so silent exfiltration to a third party creates a real privacy and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The skill description and title include Chinese phrases such as "百炼/通义万相/wan 文生视频" and "文生视频" alongside English, which can impose a language expectation in the skill's natural-language interface. Because there is no explicit opt-in or statement that the user may interact in their preferred language, this may conflict with language/locale choice policy.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The comment at L52 says 'Build JSON (avoid jq dependency)', which suggests a simplified, dependency-light implementation. However, the script still depends on curl for network submission and sed/head for parsing the JSON response, so the inline documentation overstates how dependency-free the implementation is.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.