Alibaba Cloud AI Video Wan R2V

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:29 PM UTC
• Version: 1.0.1

Overview

This skill is a coherent Alibaba Cloud video-generation helper with disclosed credential use and output files, though users should be careful about saved prompts/media metadata and the unpinned SDK install.

Install only if you are comfortable using Alibaba Cloud credentials for video generation and saving prompts, media references, task IDs, polling snapshots, and outputs in the workspace. Prefer pinning the dashscope dependency before use and avoid placing highly sensitive prompts or private media URLs in persisted request files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party SDK Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35-40
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Complete Code Snippet:

bash

python3 -m venv .venv
. .venv/bin/activate
python -m pip install dashscope

Technical Analysis

The installation command retrieves the latest available dashscope package and its transitive dependencies without an exact version constraint, lock file, or integrity hashes. Consequently, the code installed when users follow these instructions can change after this Skill has been reviewed.

This creates a supply-chain exposure: a compromised future package release or transitive dependency could introduce malicious code. Python package installation may execute build-related code, and installed package code would execute when imported or invoked later. The use of a virtual environment limits package placement but does not sandbox package behavior from the installing user's files, environment variables, or network access.

Attack Path

1. An attacker compromises the dashscope package or one of its resolved dependencies and publishes a malicious release.
2. A user or agent follows the instructions in SKILL.md.
3. pip resolves and downloads the mutable malicious release because no audited version or hash is specified.
4. Malicious code executes during package installation, build processing, or subsequent SDK use.
5. The code operates with the privileges of the user running the command and may access files, environment variables, and credentials available to that process.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. The affected scope may include the project workspace, user-accessible files, outbound network access, and environment credentials such as DASHSCOPE_API_KEY if present during installation or execution.

No evidence indicates that the curren ...[truncated 100 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin dashscope to an exact version that has been reviewed and tested.
2. Record all transitive dependencies in a lock file.
3. Require cryptographic hashes during installation, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Obtain packages only from the expected official package index or an organization-controlled mirror.
5. Review and deliberately update the lock file rather than automatically consuming new releases.
6. Run installation with minimal user privileges and avoid exposing cloud credentials to the installation process.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares file read/write-capable behavior through its validation and output instructions, but it does not explicitly declare any tool scope, permissions, or allowed-tools boundaries. This can cause an agent runtime to grant broader-than-expected filesystem access or make reviewers unaware of persistence and data-handling behaviors, increasing the risk of unauthorized file access or data leakage.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill explicitly writes validation artifacts, request payloads, metadata, polling snapshots, and outputs to persistent storage under output/alicloud-ai-video-wan-r2v/. In a skill that handles prompts, reference media locations, task IDs, and request/response data, this persistence can retain sensitive user content or identifiers beyond the active session, creating privacy and data-retention risk if the workspace is shared or later exposed.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Validation

bash

mkdir -p output/alicloud-ai-video-wan-r2v
python -m py_compile skills/ai/video/alicloud-ai-video-wan-r2v/scripts/prepare_r2v_request.py && echo "py_compile_ok" > output/alicloud-ai-video-wan-r2v/validate.txt

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest and the rest of the document describe a narrowly scoped provider skill for Wan R2V reference-to-video generation, which is inherently a mutating generation workflow. However, the workflow text tells operators to determine whether the operation is read-only or mutating and to run a minimal read-only query first, implying capabilities and usage patterns not implemented or justified for this generation-only skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.