Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Aliyun cloud transcription helper that sends user-provided media URLs to DashScope, with no evidence of hidden persistence, destructive behavior, or unrelated data access.
Install this only if you are comfortable sending the media URLs and their audio/video contents to Aliyun DashScope for processing. Use URLs you intend to disclose for transcription, avoid sensitive internal-only media unless that is acceptable for your workflow, and provide the Aliyun API key through environment variables rather than hardcoding it.
The skill declares access to environment variables and uses networked transcription services, but does not explicitly constrain its tool scope with permissions or allowed-tools. This can lead to broader-than-necessary execution privileges, making it easier for an agent runtime to expose sensitive env data or permit unintended outbound requests beyond the transcription use case.
The script sends user-supplied media URLs to Aliyun DashScope, which is an external third-party service, without any built-in user notice, consent check, or validation that the media is appropriate to disclose. In a transcription skill, this means potentially sensitive audio/video locations and their contents are transmitted off-platform by default, creating privacy and data-handling risk if users assume processing is local or first-party only.
This fetch call transmits data to an external network endpoint, including the API key and user-provided file URLs, which may expose sensitive media references or cause users' content to be processed by a third party. In this skill's context, external transmission is expected for cloud transcription, but it is still a real security/privacy concern if not clearly disclosed and governed.
}
async function submitTask({ apiKey, model, fileUrls, languageHints }) {
const response = await fetch('https://dashscope.aliyuncs.com/api/v1/services/audio/asr/transcription', {
method: 'POST',
headers: {
'Authorization': `Bearer ${apiKey}`,
The documentation states that ALIYUN_SPEECH_LANG_HINTS defaults to zh,en, which imposes a language/locale preference by default. This can conflict with a policy requiring language choice or explicit opt-in unless the constraint is clearly justified.
The example environment variable sets ALIYUN_SPEECH_LANG_HINTS=zh,en, which imposes a default locale preference in natural-language documentation. The file does not explain why Chinese is prioritized or indicate that users may choose their own language ordering, which can conflict with language/locale policy expectations.
Detected: suspicious.env_credential_access