Alibaba Super Resolution

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:13 PM UTC
• Version: 0.1.0

Overview

This skill does what it claims, but it handles cloud credentials and remote video processing in ways users should review before installing.

Review this skill before installing if your videos are private, regulated, or customer-owned: normal use sends the video to Alibaba Cloud for processing. Use least-privilege Alibaba RAM credentials, prefer environment variables or a managed credential provider instead of --access-key-secret, avoid running it in privileged environments, and consider pinning dependencies before deployment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: alibaba_super_resolve.py:288
• Finding: Alibaba Cloud Access Key Secret Accepted Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `alibaba_super_resolve.py:288-289` **Vulnerability Type**: Credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```python parser.add_argument('--access-key-id', help='Alibaba Cloud Access Key ID (overrides env)') parser.add_argument('--access-key-secret', help='Alibaba Cloud Access Key Secret (overrides env)') ``` ### Technical Analysis The CLI accepts an Alibaba Cloud Access Key Secret directly through `--access-key-secret`. Command-line arguments are not an appropriate secret-transport mechanism because they may be exposed through: - Shell history files. - Process listings and process-inspection interfaces. - Endpoint monitoring and process telemetry. - CI/CD build logs. - Wrapper scripts or command-execution logs. - Diagnostic reports that capture process arguments. Although the application also supports environment variables, the command-line option creates a less secure alternative that can expose a long-lived cloud credential outside the intended process. ### Attack Path 1. A user starts the tool with `--access-key-id` and `--access-key-secret`. 2. The operating system, shell, monitoring agent, or automation environment records or exposes the process command line. 3. A local user, log reader, monitoring-system operator, or attacker with access to the captured data obtains the secret. 4. The attacker uses the Access Key ID and Access Key Secret to authenticate to Alibaba Cloud. 5. The attacker performs any operations allowed by the permissions assigned to that credential. ### Impact Assessment Successful exploitation discloses an Alibaba Cloud credential. The resulting privileges are limited by the RAM policies attached to the exposed access key, but could include use of paid video-processing APIs and access to other Alibaba Cloud resources if the credential has broader permissions. Potential consequences include unauthorized API usage, financial cost, acc ...[truncated 110 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `--access-key-secret` command-line option. 2. Prefer Alibaba Cloud's standard credential-provider chain or a dedicated credential configuration file with restrictive filesystem permissions. 3. Continue supporting environment variables only where required, while ensuring they are not logged. 4. If interactive entry is needed, use `getpass.getpass()` so the secret is not echoed or added to shell history. 5. Use short-lived Security Token Service credentials instead of long-lived access keys where possible. 6. Apply least-privilege RAM policies to the credential used by this tool. 7. Ensure logging, exception handling, and diagnostics never serialize credentials. 8. Document credential rotation procedures and rotate any key previously supplied on a command line in a logged or shared environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: alibaba_super_resolve.py:173
• Finding: Unrestricted Download of a Remote API-Supplied URL<![CDATA[ ## Vulnerability Details **File Location**: `alibaba_super_resolve.py:173-180, 213-229` **Vulnerability Type**: Unvalidated remote URL request with missing resource limits **Risk Level**: Medium ### Vulnerable Code ```python output_url = job_data.get('OutputUrl') or job_data.get('OutputFileUrl') # Parse Result field if available if not output_url and 'Result' in job_data: try: result_json = json.loads(job_data['Result']) output_url = result_json.get('VideoUrl') except: pass ``` ```python def _download_file(self, url: str, output_path: str): """Download file from URL to local path""" response = requests.get(url, stream=True) response.raise_for_status() total_size = int(response.headers.get('content-length', 0)) downloaded = 0 with open(output_path, 'wb') as f: for chunk in response.iter_content(chunk_size=8192): if chunk: f.write(chunk) downloaded += len(chunk) if total_size > 0: progress = (downloaded / total_size) * 100 print(f" Download progress: {progress:.1f}%", end='\r') print() ``` ### Technical Analysis The program obtains `OutputUrl`, `OutputFileUrl`, or `VideoUrl` from remote API response data and passes it directly to `requests.get()`. It does not validate: - The URL scheme. - The destination hostname. - The resolved IP address. - Whether the destination is loopback, private, link-local, or a cloud metadata address. - Redirect destinations. - Whether the host belongs to an expected Alibaba Cloud output domain. Consequently, an attacker who can influence the job response may cause the execution environment to issue a request to an unintended network destination. This creates a server-side request forgery primitive in environments where the API response or associated account/job data can be manipulated. The request also has no connection or read timeout and no max ...[truncated 2162 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require `https` and reject all other URL schemes. 2. Allowlist the exact Alibaba Cloud or OSS domains expected to host processed output. 3. Resolve the hostname before connecting and reject loopback, private, link-local, multicast, reserved, and unspecified IP ranges for both IPv4 and IPv6. 4. Disable automatic redirects or validate the scheme, hostname, and resolved address of every redirect target before following it. 5. Configure explicit connection and read timeouts, for example: ```python requests.get( url, stream=True, timeout=(10, 60), allow_redirects=False, ) ``` 6. Enforce a maximum download size using both `Content-Length` and the actual accumulated byte count. Abort and remove any partial output file when the limit is exceeded. 7. Download to a securely created temporary file and atomically rename it only after the transfer and validation complete. 8. Validate the response content type and, where available, verify an expected checksum or signature. 9. Avoid displaying sensitive signed output URLs in logs because their query parameters may grant temporary access to private objects. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Unbounded Dependency Versions Permit Unreviewed Future Releases<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-4` **Vulnerability Type**: Non-reproducible dependency resolution and supply-chain exposure **Risk Level**: Low ### Vulnerable Code ```text requests>=2.31.0 alibabacloud_tea_openapi>=0.3.0 alibabacloud_tea_util>=0.3.0 alibabacloud_videoenhan20200320>=1.1.0 ``` ### Technical Analysis All dependencies use lower-bound-only version constraints. A future installation may therefore select any later release, including a version that has not been reviewed or tested with this project. This makes installations non-reproducible and increases exposure to a compromised upstream release, malicious maintainer action, or an incompatible update. The issue is amplified by inconsistent documentation: `README.md` instructs users to install `alibabacloud_videoenhan20200320==4.0.0`, while `requirements.txt` allows any version from `1.1.0` onward. Different installation paths can therefore produce materially different environments. The package names shown are consistent with the imports, and the audit found no evidence that they are intentionally typosquatted or malicious. The risk arises from unsafe version-resolution policy rather than a confirmed malicious dependency. ### Attack Path 1. A user or deployment pipeline runs `pip install -r requirements.txt`. 2. The package index resolves one or more dependencies to a newly published version allowed by the `>=` constraint. 3. If that release is compromised, malicious package installation or import-time code executes with the privileges of the user or build agent. 4. The malicious dependency may access environment variables, including the Alibaba Cloud credentials expected by this application. 5. It may then modify files, execute commands, or transmit available credentials and local data according to the privileges of the installation environment. ### Impact Assessment A compromised dependency executes in the same Python process and security context as ...[truncated 540 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to an exact, reviewed version. 2. Generate and commit a lock file or fully resolved constraints file that includes transitive dependencies. 3. Record cryptographic hashes and install with `pip --require-hashes`. 4. Make `README.md` and `requirements.txt` specify the same Alibaba Cloud SDK version. 5. Install dependencies only from the official Python Package Index or an authenticated internal package mirror. 6. Run automated vulnerability and dependency-integrity scanning in CI. 7. Review release notes and security advisories before updating pins. 8. Perform installations in an isolated virtual environment under a non-privileged account. 9. Use a controlled update process that tests cloud authentication, upload, polling, and download behavior before releasing new dependency versions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly promotes local file upload and cloud-based video enhancement, but it does not clearly disclose that user video content will be transmitted to and processed by Alibaba Cloud. This is a real privacy/transparency issue because users may upload sensitive or regulated media without informed consent about third-party processing and retention implications.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documents use of environment variables for cloud credentials, performs network access to Alibaba Cloud, and writes output files, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege and transparency problem: an agent or reviewer cannot easily tell in advance that the skill can access secrets, contact external services, and write files, increasing the risk of unintended secret exposure or unsafe execution in broader environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The tool sends the full input video to Alibaba Cloud for processing, but it does not provide an explicit privacy/security warning or require affirmative user consent at the point of upload. In an agent skill context, users may assume processing is local; this can cause unintended disclosure of sensitive media, metadata, or regulated content to a third-party cloud service.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The natural-language instructions throughout the README are Chinese-only, which can amount to a language/locale policy issue when no user language choice or explicit region-specific limitation is provided. There is no statement that the skill is intended only for Chinese-speaking users or a specific regulated locale.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
alibabacloud_tea_openapi>=0.3.0
alibabacloud_tea_util>=0.3.0
alibabacloud_videoenhan20200320>=1.1.0

• Confidence: 98% confidence
• Finding: The dependency specification uses a lower-bound only constraint for requests, which makes builds non-reproducible and can pull in unexpected future versions or vulnerable intermediary versions depending on the resolver state. Because requests has a history of security advisories, leaving it unpinned increases supply-chain risk and makes it difficult to verify whether a deployed version is safe.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The manifest includes requests without an exact version, and requests has multiple known advisories across its release history. Without pinning, there is no reliable way to determine whether an installation will pull a patched or vulnerable version, so the dependency remains unverifiable from a security standpoint.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
alibabacloud_tea_openapi>=0.3.0
alibabacloud_tea_util>=0.3.0
alibabacloud_videoenhan20200320>=1.1.0

• Confidence: 95% confidence
• Finding: The alibabacloud_tea_openapi package is specified with only a minimum version, so installations may resolve to different versions over time. This weakens build integrity and can introduce vulnerable or incompatible releases without code changes, which is a supply-chain security concern.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
alibabacloud_tea_openapi>=0.3.0
alibabacloud_tea_util>=0.3.0
alibabacloud_videoenhan20200320>=1.1.0

• Confidence: 95% confidence
• Finding: The alibabacloud_tea_util dependency is unpinned, which permits uncontrolled version drift across environments. Even absent a known active CVE here, this creates preventable supply-chain exposure and undermines reproducibility for a skill that depends on cloud SDK behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
alibabacloud_tea_openapi>=0.3.0
alibabacloud_tea_util>=0.3.0
alibabacloud_videoenhan20200320>=1.1.0

• Confidence: 95% confidence
• Finding: The alibabacloud_videoenhan20200320 package is also declared with only a minimum version, allowing future unreviewed releases to be installed. For a cloud API integration, unexpected SDK changes can affect authentication, request handling, or security behavior, making this a legitimate though low-severity supply-chain issue.

Static analysis

No suspicious patterns detected.