Alibaba Cloud AI Search DashVector

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:03 PM UTC
• Version: 1.0.3

Overview

This skill is a straightforward DashVector integration, but users should treat its API key and endpoint configuration carefully.

Install the SDK in an isolated virtual environment, consider pinning the `dashvector` package version, and only run the quickstart with a least-privileged API key and a verified DashVector cluster endpoint because it can create a collection and upsert sample documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18
• Finding: Unpinned DashVector Dependency Creates Supply-Chain Exposure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:18` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash python3 -m venv .venv . .venv/bin/activate python -m pip install dashvector ``` ### Technical Analysis The installation instructions retrieve `dashvector` without an exact version constraint or cryptographic integrity hash. Consequently, the installed code is determined by the mutable package version available from the configured Python package index at installation time rather than by a dependency version reviewed with this project. Python packages can execute code during installation or when imported. A compromised upstream release, package-index account, registry response, or package source could therefore introduce arbitrary code that was not present during this audit. This finding does not establish that the current `dashvector` package is malicious. It identifies an unsafe dependency-management practice that exposes users to future upstream or registry compromise. ### Attack Path 1. An attacker compromises the upstream package publisher, release process, package-index account, or package distribution channel. 2. The attacker publishes a malicious or backdoored version under the expected `dashvector` package name. 3. A user follows the documented command `python -m pip install dashvector`. 4. Because no version or hash is specified, pip resolves and downloads the attacker-controlled release. 5. Malicious code executes during installation, import, or subsequent script execution under the privileges of the user running the command. ### Impact Assessment Successful exploitation could execute arbitrary Python code with the privileges of the installing user. Depending on those privileges and the local environment, this could expose environment variables such as `DASHVECTOR_API_KEY`, modify user-accessible files, tamper with project output, or make unauthorized network requests. ...[truncated 200 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `dashvector` to an exact version that has been reviewed and tested: ```text dashvector==<reviewed-version> ``` 2. Store dependencies in a lock file or hashed requirements file. 3. Require cryptographic hashes during installation: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Generate and review hashes from a trusted package source before publishing the skill. 5. Document the expected official package index and avoid untrusted extra indexes. 6. Use automated dependency scanning and controlled update procedures so version changes receive review before distribution. 7. Install and execute the package in an isolated, least-privileged virtual environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/quickstart.py:27
• Finding: Environment-Controlled Endpoint May Receive the DashVector API Key<![CDATA[ ## Vulnerability Details **File Location**: `scripts/quickstart.py:27-30` **Vulnerability Type**: Unvalidated credential-bearing service endpoint **Risk Level**: Medium ### Vulnerable Code ```python args = parse_args() api_key = get_env("DASHVECTOR_API_KEY") endpoint = get_env("DASHVECTOR_ENDPOINT") client = dashvector.Client(api_key=api_key, endpoint=endpoint) ``` ### Technical Analysis The script reads `DASHVECTOR_ENDPOINT` directly from the process environment and passes it to `dashvector.Client` together with the API key. It does not parse or validate the endpoint's scheme, hostname, port, embedded credentials, or relationship to an authorized DashVector domain. If an attacker can influence the environment or configuration used to launch the script, they can supply an attacker-controlled endpoint. When the SDK communicates with that endpoint, authentication material may be sent to the unintended service according to the SDK's authentication behavior. Acceptance of a plaintext HTTP endpoint could also expose credentials or request data in transit if the SDK permits it. The script does not print or hardcode the API key. Exploitation requires influence over `DASHVECTOR_ENDPOINT` or deception of the user into configuring a malicious endpoint. ### Attack Path 1. The attacker obtains a network endpoint capable of recording incoming requests. 2. The attacker influences shell configuration, environment injection, deployment configuration, copied setup instructions, or another source that sets `DASHVECTOR_ENDPOINT`. 3. The victim retains a valid `DASHVECTOR_API_KEY` and runs `scripts/quickstart.py`. 4. The script constructs `dashvector.Client` with both the valid API key and the attacker-selected endpoint. 5. The SDK sends requests to that endpoint and may include the API credential or derived authentication data. 6. The attacker captures the credential and attempts to use it against the legitimate DashVector service. ### Impact Assessment A ca ...[truncated 500 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse the endpoint with a standard URL parser before creating the client. 2. Require the `https` scheme and reject plaintext HTTP. 3. Allow only explicitly documented DashVector hostname suffixes and verify hostname boundaries correctly. 4. Reject malformed URLs, embedded usernames or passwords, unexpected ports, IP-literal hosts, fragments, and other unnecessary URL components. 5. Ensure redirects are disabled or restricted so authentication data cannot be redirected to an untrusted host. 6. Provide a trusted endpoint-selection mechanism based on an allowlisted region rather than accepting an arbitrary URL where practical. 7. Use narrowly scoped, least-privileged API keys and rotate any key suspected of exposure. 8. Fail closed with a clear error before initializing the SDK when endpoint validation fails. 9. Add tests covering malicious domains, deceptive suffixes, plaintext URLs, embedded credentials, and redirect behavior. ]]>

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill references sensitive environment variables (`DASHVECTOR_API_KEY`, `DASHVECTOR_ENDPOINT`) and provides executable commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, this can lead to overbroad access to environment secrets or unintended execution pathways because the runtime is not constrained to only the minimum capabilities needed.

Static analysis

No suspicious patterns detected.