Alibaba Cloud AI Audio TTS

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:02 PM UTC
• Version: 1.0.4

Overview

The skill mostly performs Alibaba Cloud text-to-speech, but it lets request data change the API endpoint before using the user's API key, which could expose the key and submitted text.

Review this skill before installing. Run it only in an isolated virtual environment with a tightly scoped DashScope API key, use request files you control, avoid any `base_url` override, keep outputs in a dedicated directory, and delete saved request/audio artifacts if they contain private text or voice content. Pin the DashScope SDK version before operational use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_tts.py:95

Finding

User-Controlled API Endpoint Can Disclose the DashScope API Key

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_tts.py:108

Finding

Unvalidated Audio URL Enables Arbitrary Network Retrieval and Unbounded Downloads

Content

View full analysis

None: output_path.parent.mkdir(parents=True, exist_ok=True) with urllib.request.urlopen(audio_url) as response: output_path.write_bytes(response.read()) ``` ### Technical Analysis The script treats `audio.url` from the remote API response as trusted and passes it directly to `urllib.request.urlopen`. It does not validate the URL scheme, hostname, resolved IP address, redirects, response content type, response size, or request timeout. A malicious or compromised API endpoint can therefore direct the host to retrieve an arbitrary URL. This issue is particularly exploitable in combination with the user-controlled `base_url`, but it can also become relevant if a legitimate API or its response path is compromised. Because `response.read()` loads the complete response into memory before `write_bytes()` writes it to disk, an oversized or non-terminating response can also cause memory exhaustion, disk exhaustion, or an indefinite hang. ### Attack Path 1. The script sends a TTS request to a malicious or compromised endpoint. 2. That endpoint returns an object whose `audio.url` points to: - An internal service reachable only from the victim host; - A loopback, private, or link-local address; - A redirect chain ending at such an address; or - A very large or indefinitely streamed resource. 3. `download_audio` opens the URL without validation. 4. The victim host performs the network request from its own network context. 5. The complete response is read into memory and then written to the ...[truncated 556 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:37

Finding

Unpinned DashScope Dependency Creates Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (12)

Tainted flow: 'audio_url' from os.getenv (line 109, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_tts.py (reported line 119)May include surrounding context.

python

def download_audio(audio_url: str, output_path: Path) -> None:
    output_path.parent.mkdir(parents=True, exist_ok=True)
    with urllib.request.urlopen(audio_url) as response:
        output_path.write_bytes(response.read())

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_tts.py (reported line 54)May include surrounding context.

python

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_tts.py (reported line 57)May include surrounding context.

python

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_tts.py (reported line 140)May include surrounding context.

python

_load_dashscope_api_key_from_credentials()
    if not os.environ.get("DASHSCOPE_API_KEY"):
        print(
            "Error: DASHSCOPE_API_KEY is not set. Configure it via env/.env or ~/.alibabacloud/credentials.",
            file=sys.stderr,
        )
        print("Example .env:\n  DASHSCOPE_API_KEY=your_key_here", file=sys.stderr)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill documents capabilities that involve environment access, filesystem reads/writes, and outbound network use, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, this weakens least-privilege controls and makes it easier for the skill to be executed with broader access than necessary, increasing the blast radius if the skill is misused or later modified.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The validation and output guidance create persistent artifacts under a fixed output directory, including logs and generated files. In this skill's context, persistence is more sensitive because the artifacts can include request payloads and audio derived from user-provided text, which may contain confidential or personal information and remain accessible beyond the session.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Validation

bash

mkdir -p output/alicloud-ai-audio-tts
python -m py_compile skills/ai/audio/alicloud-ai-audio-tts/scripts/generate_tts.py && echo "py_compile_ok" > output/alicloud-ai-audio-tts/validate.txt

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs users to save request payloads, generated audio links, and sample audio artifacts without warning that these may contain sensitive text, personal data, or confidential voice content. Persisting such artifacts by default can create an avoidable data exposure risk through logs, shared workspaces, backups, or later reuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script allows an arbitrary base_url from untrusted request input to override the DashScope API endpoint. This broadens the tool from a DashScope-only TTS client into a generic outbound HTTP client and can redirect requests, including the API key, to attacker-controlled infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The markdown instructs users to set DASHSCOPE_API_KEY in the environment or place dashscope_api_key in ~/.alibabacloud/credentials. Although expected for authentication, there is no caution about protecting the key, avoiding commits/logging, or securing the credentials file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The sample request sets language_type="English" directly in the example. This may encourage implementations that force a language choice rather than deriving it from user preference or asking for confirmation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file title and heading are written only in Chinese ('官方文档来源（用于后续更新）') with no indication that the skill supports other languages or that Chinese is a required locale. This creates a natural-language locale constraint without user opt-in or documented justification, which matches the policy-violation category.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This code performs a filesystem write by creating parent directories and saving remote content to the provided output path. Although the script's purpose is TTS generation, there is no explicit warning that an existing file at that path may be overwritten or that network-fetched data will be written locally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.