Alibaba Cloud AI Entry Modelstudio Test

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:02 PM UTC
• Version: 1.0.3

Overview

This skill is a straightforward Alibaba Model Studio test runner, with normal but important precautions around API credentials, third-party SDK installation, and non-sensitive test data.

Install and run this only in a controlled environment with a reviewed or pinned dashscope dependency, a limited-scope Alibaba Cloud API key, and synthetic/minimal test media. Do not use confidential prompts, customer files, regulated data, or real voice samples unless you intend to send them to Alibaba Cloud and retain the resulting local evidence files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party SDK Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–20
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

bash

- Install SDK (virtual environment recommended to avoid PEP 668 restrictions):

```bash
python3 -m venv .venv
. .venv/bin/activate
python -m pip install dashscope

Technical Analysis

The Skill instructs users to install dashscope without pinning an audited version or verifying the downloaded artifact with a cryptographic hash. Consequently, the installed package can change between executions even when the Skill itself remains unchanged.

A Python virtual environment prevents dependency pollution of the system Python installation, but it is not a security sandbox. Package installation or build logic can execute with the permissions of the user running pip, including access to that user's files, environment variables, and permitted network resources.

No evidence establishes that the current dashscope package is malicious. The vulnerability is the mutable and unverified dependency resolution process, which creates exposure if the package, a transitive dependency, the package publishing account, or the configured package index is compromised.

Attack Path

1. An attacker compromises the package publishing process, a relevant dependency, or the package index used by pip.
2. The attacker publishes a malicious version or artifact that satisfies the unbounded dashscope requirement.
3. A user follows the Skill instructions and runs python -m pip install dashscope.
4. pip retrieves the attacker-controlled artifact because no version or hash constraint is specified.
5. Malicious installation or runtime code executes with the invoking user's privileges.
6. That code could access user-readable files, environment variables such as DASHSCOPE_API_KEY, and network resources available to the process.

Impact Assessment

Successful expl ...[truncated 422 chars]

Remediation

View remediation

Remediation Suggestions

• Pin dashscope to a specific version that has been reviewed and tested.
• Place the dependency in a lock or requirements file and require cryptographic hashes, for example by using pip install --require-hashes -r requirements.txt.
• Pin and hash all transitive dependencies where practical.
• Configure an explicitly trusted Python package index rather than relying on uncontrolled index configuration.
• Review release notes and package provenance before updating the pinned version.
• Perform installation and API tests under a dedicated, non-privileged account or isolated container with access only to required files and network destinations.
• Avoid exposing DASHSCOPE_API_KEY during dependency installation; provide the credential only to the subsequent API test process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

1. Open target sub-skill directory and read `SKILL.md`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

1. Open target sub-skill directory and read `SKILL.md`.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs operators to use live credentials and send test inputs to external Model Studio services, but it does not require data minimization or warn against using sensitive prompts, media, or identifiers. In a testing workflow that spans image, audio, video, speech, and multimodal inputs, this omission creates a realistic risk of unintended disclosure of confidential or regulated data to third-party APIs and to local output artifacts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow says to confirm whether an operation is read-only or mutating and then 'run one minimal read-only query first,' but this skill's stated purpose and test matrix include text-to-image, image editing, video generation, video editing, TTS, and voice clone/design operations that are not read-only. That guidance actively contradicts the actual operations the skill is meant to execute, which can mislead users about side effects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.