Tingwu ASR

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:29 AM UTC
• Version: 0.4.2

Overview

The skill appears intended for Alibaba Tingwu cloud transcription, but it handles account passwords and reusable session cookies in ways users should review carefully before installing.

Install only if you are comfortable giving this skill access to an Alibaba/Tingwu account and uploading selected audio/video to Alibaba Cloud. Use a dedicated account if possible, do not place real cookies in command-line arguments or chats, protect config/.env and config/cookies.json with strict local permissions, rotate credentials if those files are exposed, and avoid sensitive or regulated recordings unless cloud processing is acceptable.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/login_pw.py:234

Finding

Overbroad Collection and Insecure Plaintext Storage of Authentication Cookies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/login.py:20

Finding

Reusable Session Cookies Exposed Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: config/requirements.txt:1

Finding

Unpinned Third-Party Dependencies Permit Unreviewed Future Releases

Content

View full analysis

=2.28.0 oss2>=2.18.0 # yt-dlp is used for automatic media downloads from supplied links. yt-dlp>=2024.0.0 # playwright is used by the built-in login script; Chromium is installed separately. playwright>=1.40.0 ``` ### Technical Analysis All dependencies use open-ended minimum-version constraints. A future installation may therefore retrieve package releases that did not exist and were not reviewed when the Skill was audited. No lock file or package hashes are supplied to verify the exact artifacts installed. The package names match the declared functionality, and no evidence of typosquatting, dependency confusion, or a currently malicious package was found. The risk is that future package compromise, malicious publication, or incompatible transitive dependency resolution could change the effective code executed by the Skill. This concern is especially relevant because: - `playwright` controls a browser containing live authentication credentials. - `oss2` handles temporary cloud access credentials and media uploads. - `yt-dlp` processes attacker-influenced URLs and invokes complex media-processing paths. - `requests` handles authenticated network traffic. ### Attack Path 1. A user follows the installation instructions and runs `pip install -r config/requirements.txt`. 2. The resolver selects the latest versions satisfying the open-ended lower bounds. 3. A selected package or transitive dependency is a compromised, malicious, or otherwise unreviewed future release. 4. Package installation hooks or imported runtime code execute with the user's privileges. 5. Malicious code could access local files, Aliyun credentials, authentication cookies, media selected for transcription, or network connectivity. This is a supply-chain risk r ...[truncated 582 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (54)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The changelog documents an automated Playwright login flow that reads credentials from a .env file and captures authenticated session cookies, including HttpOnly tokens used for account access. In a cloud transcription skill that relies on reverse-engineered web APIs, stored credentials and reusable cookies materially increase the risk of credential theft, session hijacking, and unauthorized use if the host, workspace, logs, or cookie files are exposed.

Content

Scanner excerpt · CHANGELOG.md (reported line 32)May include surrounding context.

md

## [0.4.0] - 2026-08-17

### Added
- 内置 Playwright 登录脚本 `scripts/login_pw.py`:一条命令完成"开浏览器 → 自动填 .env 凭证 → 等待登录 → cookie 落盘"。经 `context.cookies()` 取含 HttpOnly 的 `login_aliyunid_ticket`(此前的 MCP Playwright `document.cookie` 路径拿不到),cookie 值全程不经过 stdout/对话记录;出现滑块时人工在可见窗口完成即可
- SKILL.md 登录章节重写:内置脚本为方式一(推荐),MCP Playwright 手工流程降为方式二兜底;每日签到流程同步改用 `login_pw.py`
- `requirements.txt` 增加 `playwright`

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill includes automated web login, reads local account-password credentials, obtains authentication cookies, and validates a cloud service login state. Automating credential use and session capture is security-sensitive behavior that materially exceeds a simple transcription description and could lead to account compromise if logs, files, or host security are weak.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill includes automated web login, reads local account-password credentials, obtains authentication cookies, and validates a cloud service login state. Automating credential use and session capture is security-sensitive behavior that materially exceeds a simple transcription description and could lead to account compromise if logs, files, or host security are weak.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes automated web login, reads local account-password credentials, obtains authentication cookies, and validates a cloud service login state. Automating credential use and session capture is security-sensitive behavior that materially exceeds a simple transcription description and could lead to account compromise if logs, files, or host security are weak.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill includes automated web login, reads local account-password credentials, obtains authentication cookies, and validates a cloud service login state. Automating credential use and session capture is security-sensitive behavior that materially exceeds a simple transcription description and could lead to account compromise if logs, files, or host security are weak.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes automated web login, reads local account-password credentials, obtains authentication cookies, and validates a cloud service login state. Automating credential use and session capture is security-sensitive behavior that materially exceeds a simple transcription description and could lead to account compromise if logs, files, or host security are weak.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The skill explicitly relies on local storage of account passwords and login cookies in .env and cookies.json. Persisting reusable credentials and session tokens in local files creates a direct credential-access surface: any local compromise, accidental commit, backup leak, or other process with read access can hijack the Alibaba account.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md

daily_checkin.py    ← 额度检查 + 记录
    check_auth.py       ← 认证检查
  config/
    .env                ← 账号密码凭证（gitignore，不提交）
    .env.example        ← 账号密码模板
    cookies.json        ← 登录 Cookie（gitignore，不提交）
    cookie.example.json ← Cookie 文件模板

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This script explicitly instructs users to place account credentials in config/.env and then automates submission to a third-party cloud service. Storing long-lived usernames/passwords in a local plaintext file materially increases credential theft risk from local compromise, accidental commit, backup leakage, or overbroad file permissions; in this skill context, the same script also persists authenticated session cookies, which compounds the impact.

Content

Scanner excerpt · scripts/login_pw.py (reported line 10)May include surrounding context.

python

且 cookie 值全程不经过 stdout。

用法:
  python3 scripts/login_pw.py            # 从 config/.env 读凭证自动填充
  python3 scripts/login_pw.py --headless # 无头模式(不推荐,滑块验证需人工)

流程:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The hardcoded ENV_PATH points to config/.env, normalizing plaintext secret storage as part of the skill's operation. In this context, the skill is for authenticating to a real cloud account and later saving session cookies; that makes compromise of the .env especially dangerous because an attacker could gain direct account access and mint/refresh session state.

Content

Scanner excerpt · scripts/login_pw.py (reported line 27)May include surrounding context.

python

SKILL_ROOT = Path(__file__).resolve().parent.parent
COOKIE_PATH = SKILL_ROOT / "config" / "cookies.json"
ENV_PATH = SKILL_ROOT / "config" / ".env"

LOGIN_MARKER = "login_aliyunid_ticket"  # HttpOnly,登录态判定的锚点

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The runtime logic loads username and password from config/.env and confirms their presence before proceeding with automated login. This is a true credential-handling risk because the script operationalizes plaintext secret use in an agent skill, and the surrounding behavior writes a broad set of authenticated cookies to disk, increasing the blast radius if either local files or the skill directory are exposed.

Content

Scanner excerpt · scripts/login_pw.py (reported line 63)May include surrounding context.

python

username, password = load_env()
    if not username or not password:
        print("!! config/.env 凭证缺失(TINGWU_USERNAME / TINGWU_PASSWORD)")
        sys.exit(1)
    print(f"[1] 凭证已加载 (用户名 {len(username)} 字符)")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares broad operational behavior including shell execution, filesystem reads/writes, and network access, but does not declare any explicit tool scope or permission boundaries. This increases the chance that an agent or user invokes the skill without understanding its effective privilege level, leading to overbroad access and unsafe execution of local and cloud actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill does not prominently warn that local audio/video files and linked media are uploaded to Alibaba Cloud for processing. Because media files may contain sensitive personal, legal, or confidential content, lack of explicit upload disclosure can cause unintended third-party data exposure and compliance issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions tell users to store account credentials and login cookies locally, but do not strongly warn that these are highly sensitive secrets that can grant account access if stolen. This omission increases the risk of insecure storage, accidental sharing, or exposure through backups, logs, or multi-user systems.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a skill for using Alibaba Tongyi Tingwu to transcribe audio/video, especially when cloud transcription is needed. The requirements explicitly document support for "automatic download from links" via yt-dlp for platforms like YouTube, Bilibili, and podcasts, which is a separate media retrieval capability not stated in the manifest.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest limits the skill's purpose to cloud audio/video transcription and when to use it. The dependency comment states Playwright is used for an internal login script, indicating browser automation and authenticated web interaction capabilities that are not described as part of the skill's declared purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document instructs use of .aliyun.com authentication cookies and temporary STS credentials obtained from reverse-engineered web flows, but provides no warning that these values are highly sensitive session secrets. Mishandling them could allow account/session hijacking, unauthorized uploads, or abuse of the user's cloud resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow uploads local audio/video files to Aliyun OSS and starts cloud transcription, but the documentation does not warn users that potentially sensitive media leaves the local environment and is transmitted to external services. This creates privacy and compliance risk, especially for confidential meetings, personal recordings, or regulated data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script prints authenticated user details and account information directly to stdout, which can expose sensitive data in terminal history, CI logs, agent transcripts, or shared execution environments. In this skill's context, the data comes from a cloud speech service account, so leaking identifiers, quotas, subscription details, or profile metadata could aid account targeting or disclose private operational information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's natural-language docstring and all user-facing status/error messages are written only in Chinese, which imposes a specific language on users without opt-in. Under the stated policy, forcing a language without offering a choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s primary natural-language documentation and console messages are written in Chinese only, which imposes a specific language on users without any opt-in or alternative locale. The policy explicitly flags language or locale constraints unless the skill offers user choice or clearly documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The docstring at L076-L080 says the function merges Tingwu's si round IDs into actual speakers, but parse_result stores page.get("ui", 0) into speaker at L041, and consolidate_speakers then remaps that field at L085-L090. This is an active contradiction about which identifier is being interpreted and transformed, which can mislead developers about diarization semantics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file’s user-facing natural-language instructions are entirely in Chinese, and subsequent CLI prompts are also Chinese-only. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/poll_tasks.py (reported line 28)May include surrounding context.

python

@contextlib.contextmanager
def pending_lock(timeout=0):
    """对 pending_tasks 加排他文件锁。

    - timeout=0（默认）：非阻塞抢锁；抢不到立即退出，由 monitor 下一轮重试

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/poll_tasks.py (reported line 31)May include surrounding context.

python

@contextlib.contextmanager
def pending_lock(timeout=0):
    """对 pending_tasks 加排他文件锁。

    - timeout=0（默认）：非阻塞抢锁；抢不到立即退出，由 monitor 下一轮重试

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/poll_tasks.py (reported line 171)May include surrounding context.

python

@contextlib.contextmanager
def pending_lock(timeout=0):
    """对 pending_tasks 加排他文件锁。

    - timeout=0（默认）：非阻塞抢锁；抢不到立即退出，由 monitor 下一轮重试

Static analysis

No suspicious patterns detected.