Qwen Image

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:25 AM UTC
• Version: 1.0.2

Overview

The skill largely does what it claims, but its setup instructions can expose your DashScope API key and alter system Python packages.

Before installing, do not run any command that prints your API key; use a presence-only check instead. Run the tool in an isolated virtual environment, avoid `--break-system-packages`, pin dependencies where possible, and only submit prompts or images you are comfortable sending to Alibaba Cloud DashScope.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:52

Finding

API Key Exposed Through Terminal Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:52
Vulnerability Type: Plaintext credential disclosure
Risk Level: High

Vulnerable Code

bash

echo $DASHSCOPE_API_KEY

Technical Analysis

The documented environment-check procedure prints the complete DashScope API key to standard output. Because agents may execute this instruction during setup, the credential can be retained in terminal history, CI logs, screen recordings, shared consoles, or agent transcripts.

The check only needs to determine whether the variable is set; disclosing its value is unnecessary. Although the project does not hardcode a credential, this instruction can expose a valid user-supplied secret.

Attack Path

1. A user or agent follows the mandatory environment-check instructions in SKILL.md.
2. The shell expands DASHSCOPE_API_KEY and prints the full credential.
3. The output is captured in a transcript, build log, shared terminal, or monitoring system.
4. A party with access to that output extracts the key.
5. The exposed key is used to submit unauthorized DashScope API requests until it is revoked or expires.

Impact Assessment

An attacker could obtain the API access authorized to the exposed DashScope key. The resulting scope depends on the key's account permissions and may include unauthorized model usage, consumption of paid quota, disclosure of account usage information available through the API, and service disruption through quota exhaustion. This does not directly grant operating-system privileges.

Remediation

View remediation

Remediation Suggestions

Replace the value-printing command with a presence-only check:

bash

if [ -n "${DASHSCOPE_API_KEY:-}" ]; then
  echo "DASHSCOPE_API_KEY is set"
else
  echo "DASHSCOPE_API_KEY is not set"
fi

Additional hardening measures:

• Explicitly instruct users never to paste or print API keys in agent conversations.
• Prefer environment variables or a protected secret manager over the --api-key command-line option.
• Redact credentials from application and CI logs.
• Rotate any key that may already have been printed.
• Configure usage limits and monitoring to detect unauthorized API consumption.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:74

Finding

Unpinned Dependency Installation Bypasses System Package Protections

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:74-80
Vulnerability Type: Unsafe third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

pip install uv --break-system-packages

bash

pip install "dashscope>=1.25.8" "requests>=2.31.0"
python $SKILL_SCRIPT text2img --prompt "..."

The corresponding inline dependency declarations in scripts/run.py:3-7 also specify minimum versions without upper bounds, hashes, or a lockfile:

python

# /// script
# requires-python = ">=3.9"
# dependencies = [
#   "dashscope>=1.25.8",
#   "requests>=2.31.0",
# ]
# ///

Technical Analysis

The installation instructions resolve mutable future versions of uv, dashscope, and requests. No reviewed lockfile, exact version constraint, artifact hash, or private package index is provided. Consequently, the code installed at setup time may differ from the code that existed when the skill was audited.

The --break-system-packages option additionally bypasses Python's externally managed environment protection. This can modify a system-managed Python environment and create dependency conflicts affecting unrelated software.

Python packages and their build backends may execute code during installation. A compromised upstream release, package-index compromise, or malicious transitive dependency could therefore execute code with the privileges of the user running the installation command.

Attack Path

1. An attacker compromises an allowed future release or a transitive dependency available through the configured package index.
2. A user follows the skill setup instructions after the compromised version becomes available.
3. The unconstrained pip install or uv run resolution selects the compromised artifact.
4. Package installation or import executes attacker-controlled code.
5. That code acts with the invoking user's privileges and can access files, environment variables, and credentials available to ...[truncated 770 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed exact version rather than using minimum-version constraints.
• Generate and commit a lockfile containing all transitive dependencies.
• Require cryptographic hashes for downloaded artifacts where the installation workflow supports them.
• Review and update pinned dependencies through a controlled process.
• Install dependencies exclusively in an isolated virtual environment.
• Remove the recommendation to use --break-system-packages.
• Pin uv itself instead of installing its latest available release.
• Use a trusted, explicitly configured package index and consider an internally controlled package mirror.
• Add automated dependency vulnerability and integrity scanning to release checks.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run.py:49

Finding

Generated Image Downloads Lack Size and Content Validation

Content

View full analysis

Vulnerability Details

File Location: scripts/run.py:49-51
Vulnerability Type: Unbounded and insufficiently validated remote download
Risk Level: Medium

Vulnerable Code

python

img = requests.get(url, timeout=60).content
with open(path, "wb") as f:
    f.write(img)

Technical Analysis

The downloader trusts image URLs returned by the remote API and loads each complete response body into memory through .content. It does not:

• call raise_for_status() or otherwise reject unsuccessful HTTP responses;
• enforce a maximum response size;
• stream the response to bound memory consumption;
• verify that the body is a valid image;
• validate the response Content-Type;
• restrict redirect destinations or validate the final host; or
• limit cumulative disk consumption across generated files.

The filename extension is inferred from the URL rather than from validated content. A compromised service response, storage endpoint, or redirect target could therefore cause the script to save oversized or non-image data under an image-like filename.

A 60-second timeout limits waiting time but does not impose a response-size limit.

Attack Path

1. The script submits an image-generation or editing request.
2. The API response, or a redirect followed from its returned URL, points to an attacker-controlled or compromised resource.
3. The resource returns an oversized body or non-image content.
4. requests.get(...).content buffers the complete response in process memory.
5. The script writes the body to the selected output directory.
6. Memory or disk resources may be exhausted, or deceptive non-image content may be stored with an image-derived extension.

Impact Assessment

The primary impact is availability loss within the privileges and resource limits of the invoking user. A malicious response may consume process memory, fill writable storage, terminate the agent process, or interfere with other applications on the same host. Non-i ...[truncated 176 chars]

Remediation

View remediation

Remediation Suggestions

Use a bounded streaming download and validate the response before committing it to the output directory:

• Allow only HTTPS URLs.
• Restrict response and redirect hosts to expected DashScope or Alibaba Cloud storage domains where operationally feasible.
• Use stream=True and call raise_for_status().
• Reject missing or unexpected image media types.
• Check Content-Length when present and enforce the same limit while streaming because that header is not trustworthy.
• Abort when the cumulative byte count exceeds a configured maximum.
• Validate the downloaded bytes using a maintained image parser before selecting the extension.
• Write to a temporary file in the destination directory and atomically rename it only after validation succeeds.
• Apply cumulative output limits when downloading multiple images.
• Delete partial files when any request or validation step fails.

Example pattern:

python

max_bytes = 25 * 1024 * 1024

with requests.get(url, stream=True, timeout=(10, 60)) as response:
    response.raise_for_status()
    content_type = response.headers.get("Content-Type", "").split(";", 1)[0]
    if content_type not in {"image/png", "image/jpeg", "image/webp"}:
        raise ValueError("Unexpected response content type")

    total = 0
    with open(path, "wb") as output:
        for chunk in response.iter_content(chunk_size=64 * 1024):
            if not chunk:
                continue
            total += len(chunk)
            if total > max_bytes:
                raise ValueError("Downloaded image exceeds the size limit")
            output.write(chunk)

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill requires environment access, network access, and writes files, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap: a host agent may invoke sensitive capabilities without clear least-privilege boundaries, increasing the chance of unintended secret exposure, remote requests, or local file writes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions require the agent to ask the region-confirmation question using Chinese and the entire operational guidance is presented only in Chinese, with no opt-in or alternative language path. This can violate language/locale policy when users have not chosen Chinese as their preferred interaction language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Natural-language instructions, errors, and help text throughout the file are presented only in Chinese. This imposes a language choice on users without offering an alternative or opt-in, matching the policy's language/locale violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code file sends the user's prompt and image inputs to DashScope via a remote API call. While the CLI prints progress messages, there is no user-facing warning in this file that local images and prompts are uploaded to an external service, which is a privacy-relevant operation for a code file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Both wan2.6 modes send user content to a remote image-generation service, and the image-edit/interleave paths may include user-provided images as well. The file lacks an explicit warning or comment disclosing this external transmission, which matters for user privacy and data handling transparency.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The code sends user-entered prompt text to DashScope using a network API call. Although network use is implicit in the tool's purpose, this file itself does not clearly disclose that entered prompts leave the local system and are processed by a remote service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.