T09 · Insecure Skill Coding Practices
Warning
- Location
alibaba_super_resolve.py:288- Finding
Alibaba Cloud Access Key Secret Accepted Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Alibaba Super Resolution
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it claims, but it handles cloud credentials and remote video processing in ways users should review before installing.
Review this skill before installing if your videos are private, regulated, or customer-owned: normal use sends the video to Alibaba Cloud for processing. Use least-privilege Alibaba RAM credentials, prefer environment variables or a managed credential provider instead of --access-key-secret, avoid running it in privileged environments, and consider pinning dependencies before deployment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
alibaba_super_resolve.py:173- Finding
Unrestricted Download of a Remote API-Supplied URL
- Content
View full analysis
0: progress = (downloaded / total_size) * 100 print(f" Download progress: {progress:.1f}%", end='\r') print() ``` ### Technical Analysis The program obtains `OutputUrl`, `OutputFileUrl`, or `VideoUrl` from remote API response data and passes it directly to `requests.get()`. It does not validate: - The URL scheme. - The destination hostname. - The resolved IP address. - Whether the destination is loopback, private, link-local, or a cloud metadata address. - Redirect destinations. - Whether the host belongs to an expected Alibaba Cloud output domain. Consequently, an attacker who can influence the job response may cause the execution environment to issue a request to an unintended network destination. This creates a server-side request forgery primitive in environments where the API response or associated account/job data can be manipulated. The request also has no connection or read timeout and no max ...[truncated 2162 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unbounded Dependency Versions Permit Unreviewed Future Releases
- Content
View full analysis
=2.31.0 alibabacloud_tea_openapi>=0.3.0 alibabacloud_tea_util>=0.3.0 alibabacloud_videoenhan20200320>=1.1.0 ``` ### Technical Analysis All dependencies use lower-bound-only version constraints. A future installation may therefore select any later release, including a version that has not been reviewed or tested with this project. This makes installations non-reproducible and increases exposure to a compromised upstream release, malicious maintainer action, or an incompatible update. The issue is amplified by inconsistent documentation: `README.md` instructs users to install `alibabacloud_videoenhan20200320==4.0.0`, while `requirements.txt` allows any version from `1.1.0` onward. Different installation paths can therefore produce materially different environments. The package names shown are consistent with the imports, and the audit found no evidence that they are intentionally typosquatted or malicious. The risk arises from unsafe version-resolution policy rather than a confirmed malicious dependency. ### Attack Path 1. A user or deployment pipeline runs `pip install -r requirements.txt`. 2. The package index resolves one or more dependencies to a newly published version allowed by the `>=` constraint. 3. If that release is compromised, malicious package installation or import-time code executes with the privileges of the user or build agent. 4. The malicious dependency may access environment variables, including the Alibaba Cloud credentials expected by this application. 5. It may then modify files, execute commands, or transmit available credentials and local data according to the privileges of the installation environment. ### Impact Assessment A compromised dependency executes in the same Python process and security context as ...[truncated 540 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly promotes local file upload and cloud-based video enhancement, but it does not clearly disclose that user video content will be transmitted to and processed by Alibaba Cloud. This is a real privacy/transparency issue because users may upload sensitive or regulated media without informed consent about third-party processing and retention implications.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documents use of environment variables for cloud credentials, performs network access to Alibaba Cloud, and writes output files, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege and transparency problem: an agent or reviewer cannot easily tell in advance that the skill can access secrets, contact external services, and write files, increasing the risk of unintended secret exposure or unsafe execution in broader environments.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The tool sends the full input video to Alibaba Cloud for processing, but it does not provide an explicit privacy/security warning or require affirmative user consent at the point of upload. In an agent skill context, users may assume processing is local; this can cause unintended disclosure of sensitive media, metadata, or regulated content to a third-party cloud service.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language instructions throughout the README are Chinese-only, which can amount to a language/locale policy issue when no user language choice or explicit region-specific limitation is provided. There is no statement that the skill is intended only for Chinese-speaking users or a specific regulated locale.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The dependency specification uses a lower-bound only constraint for requests, which makes builds non-reproducible and can pull in unexpected future versions or vulnerable intermediary versions depending on the resolver state. Because requests has a history of security advisories, leaving it unpinned increases supply-chain risk and makes it difficult to verify whether a deployed version is safe.
- Content
text requests>=2.31.0 alibabacloud_tea_openapi>=0.3.0 alibabacloud_tea_util>=0.3.0 alibabacloud_videoenhan20200320>=1.1.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The manifest includes requests without an exact version, and requests has multiple known advisories across its release history. Without pinning, there is no reliable way to determine whether an installation will pull a patched or vulnerable version, so the dependency remains unverifiable from a security standpoint.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The alibabacloud_tea_openapi package is specified with only a minimum version, so installations may resolve to different versions over time. This weakens build integrity and can introduce vulnerable or incompatible releases without code changes, which is a supply-chain security concern.
- Content
text requests>=2.31.0 alibabacloud_tea_openapi>=0.3.0 alibabacloud_tea_util>=0.3.0 alibabacloud_videoenhan20200320>=1.1.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The alibabacloud_tea_util dependency is unpinned, which permits uncontrolled version drift across environments. Even absent a known active CVE here, this creates preventable supply-chain exposure and undermines reproducibility for a skill that depends on cloud SDK behavior.
- Content
text requests>=2.31.0 alibabacloud_tea_openapi>=0.3.0 alibabacloud_tea_util>=0.3.0 alibabacloud_videoenhan20200320>=1.1.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The alibabacloud_videoenhan20200320 package is also declared with only a minimum version, allowing future unreviewed releases to be installed. For a cloud API integration, unexpected SDK changes can affect authentication, request handling, or security behavior, making this a legitimate though low-severity supply-chain issue.
- Content
text requests>=2.31.0 alibabacloud_tea_openapi>=0.3.0 alibabacloud_tea_util>=0.3.0 alibabacloud_videoenhan20200320>=1.1.0
Static analysis
No suspicious patterns detected.