Alibaba Cloud AI Audio TTS Voice Clone

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:29 PM UTC
• Version: 1.0.2

Overview

This is a coherent Alibaba Cloud voice-cloning helper with expected credential, audio, and output handling, though users should pin the SDK and protect voice-cloning artifacts.

Before installing, use a dedicated virtual environment, pin and review the dashscope SDK version, keep the API key out of logs, and only use voice samples and persisted voice_id values when you have consent and a clear retention plan.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party SDK Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–24
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

python3 -m venv .venv
. .venv/bin/activate
python -m pip install dashscope

Technical Analysis

The installation command retrieves the latest available dashscope package from the user's configured Python package index without specifying a reviewed version or verifying cryptographic hashes.

Although dashscope is consistent with the Skill's declared Alibaba Cloud functionality, the installation is not reproducible and implicitly trusts the package index and every future release. A compromised upstream release, index substitution, or malicious package supplied through a misconfigured index could introduce attacker-controlled installation or runtime code.

The audited project does not itself contain a malicious dependency or payload. This finding concerns the supply-chain exposure created by the documented installation procedure.

Attack Path

1. An attacker compromises the upstream package, the configured package index, or the user's package-index configuration.
2. The user follows the documented python -m pip install dashscope instruction.
3. pip retrieves and installs the attacker-controlled package version.
4. Malicious code executes during installation or when the SDK is subsequently imported and used.
5. The code operates with the invoking user's permissions and may access credentials or voice-cloning data available to that process.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user running pip or the voice-cloning workflow. Depending on the local environment, exposed resources could include:

• DASHSCOPE_API_KEY and other environment variables.
• Credentials readable from the user's home directory.
• Enrollment voice samples and generated audio.
• Request and ...[truncated 282 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin dashscope to an exact version that has been reviewed and tested:

   bash

   python -m pip install "dashscope==<reviewed-version>"
   

2. Prefer a committed dependency lock or requirements file containing cryptographic hashes, and install it with hash enforcement:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Document the expected official package index and prevent untrusted or unintended extra indexes from participating in dependency resolution.

4. Review dependency updates before changing the pinned version, including transitive dependencies and release provenance.

5. Install dependencies before exporting DASHSCOPE_API_KEY or otherwise making service credentials available to the environment.

6. Use a dedicated virtual environment and a least-privileged operating-system account for installation and execution.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documents file read/write behavior through helper scripts and output generation, but it does not declare any corresponding tool scope such as permissions or allowed-tools. This creates a trust-boundary problem: an agent or reviewer cannot reliably tell what filesystem capabilities the skill expects, increasing the risk of unintended file access or writes when the skill is executed in an environment with broader privileges.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill documentation describes a narrowly scoped voice-cloning and synthesis workflow, but the workflow section instructs the operator to determine whether an operation is 'read-only or mutating' and to run a 'minimal read-only query first.' That language contradicts the actual documented interface, which is centered on synthesis/voice-clone requests rather than query-style resource inspection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.