Alibaba Cloud AI Video Wan Video

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:04 PM UTC
• Version: 1.0.2

Overview

The skill is a mostly coherent Alibaba Cloud video-generation helper, with ordinary integration risks but no artifact-backed deception, persistence, exfiltration, or destructive behavior.

Install this only if you intend to use Alibaba Cloud DashScope for video generation. Use a dedicated DashScope API key, keep .env and ~/.alibabacloud/credentials private, run it in a virtual environment, consider pinning dashscope, and be aware that prompts, reference images, and generated media URLs are sent to or received from the provider. The dancing helper has opinionated default prompt text and should be reviewed before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:41

Finding

Unpinned DashScope Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:41-45
Additional Location: references/api_reference.md:7-11
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

python3 -m venv .venv
. .venv/bin/activate
python -m pip install dashscope

Technical Analysis

The installation instructions resolve the latest available dashscope package from the user's active Python package index. No reviewed version, integrity hash, lock file, or authoritative package source is specified. The project's references/sources.md also contains no external documentation or verified package link.

Python packages may execute package-controlled code during installation and subsequently when imported. Consequently, package-index compromise, a compromised upstream release, or an untrusted index configured through pip settings could introduce code that was not present during this Skill audit. The lack of version pinning also makes builds non-reproducible and may silently introduce incompatible or vulnerable future releases.

Attack Path

1. An attacker compromises a future dashscope release, the configured package index, or the dependency-resolution path.
2. A user follows the documented python -m pip install dashscope instruction.
3. pip retrieves and installs the substituted or compromised package without version or hash verification.
4. Package-controlled code executes during installation or when the scripts import dashscope.
5. The malicious dependency receives the same local privileges, environment access, and network access as the invoking user.

Impact Assessment

Successful exploitation could execute arbitrary Python code with the privileges of the user performing the installation or running the Skill. That code could access the process environment, including DASHSCOPE_API_KEY, read user-accessible files, alter generated output, and m ...[truncated 210 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin dashscope to a specifically reviewed version rather than resolving the latest release.
2. Maintain a lock file or requirements file containing cryptographic hashes, and install with pip install --require-hashes.
3. Document the authoritative Alibaba Cloud package and documentation URLs in references/sources.md.
4. Use a trusted, explicitly configured package index and disable unneeded extra indexes.
5. Run dependency vulnerability and provenance checks as part of release validation.
6. Continue installing into an isolated virtual environment and avoid running pip with elevated privileges.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_video.py:157

Finding

Unvalidated Video URL Is Downloaded Without Resource Limits

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_video.py:157-160
Vulnerability Type: Unrestricted remote URL retrieval and unbounded response buffering
Risk Level: Medium

Vulnerable Code:

python

def download_video(video_url: str, output_path: Path) -> None:
    output_path.parent.mkdir(parents=True, exist_ok=True)
    with urllib.request.urlopen(video_url) as response:
        output_path.write_bytes(response.read())

Technical Analysis

The script automatically opens the media URL returned through the DashScope SDK without validating its scheme, hostname, resolved address, redirect destination, content type, or expected file size. No connection or read timeout is configured. Calling response.read() without a size limit also buffers the entire response in memory before writing it to disk.

Although the URL normally originates from the expected cloud provider, it crosses a remote trust boundary. A compromised provider response, compromised SDK, malicious intermediary where insecure transport is accepted, or malformed service response could cause the script to retrieve an unintended resource.

Because redirects are followed by the underlying URL handler, validating only an initial URL would also be insufficient unless each redirect destination is constrained.

Attack Path

1. An attacker causes the SDK response to contain an attacker-controlled or malformed video_url, such as through upstream service compromise, dependency compromise, or response manipulation.
2. call_generate() accepts that value without URL validation.
3. download_video() passes the URL directly to urllib.request.urlopen().
4. The process connects to the supplied destination or follows redirects to another destination.
5. A malicious server returns an indefinitely slow or extremely large response.
6. The script blocks or consumes excessive memory and disk space; alternatively, arbitrary remote bytes a ...[truncated 630 chars]

Remediation

View remediation

Remediation Suggestions

1. Require HTTPS and reject all unsupported URL schemes.
2. Allowlist documented DashScope or Alibaba Cloud media-storage hostnames.
3. Resolve destinations and reject loopback, link-local, private, and otherwise prohibited addresses where internal access is unnecessary.
4. Disable redirects or validate the scheme, hostname, and resolved address at every redirect.
5. Configure explicit connection and read timeouts.
6. Enforce a maximum download size using Content-Length when available and a streaming byte counter in all cases.
7. Stream data in bounded chunks to a temporary file instead of calling unbounded response.read().
8. Validate the response content type and media signature before accepting the file.
9. Atomically rename the validated temporary file to the final output path.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_dancing_video.py:161

Finding

Generated Media URLs Are Downloaded Without Destination or Size Validation

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_dancing_video.py:161-166
Vulnerability Type: Unrestricted remote URL retrieval and unbounded response buffering
Risk Level: Medium

Vulnerable Code:

python

def download_file(url: str, output_path: Path) -> None:
    """Download a file from URL."""
    output_path.parent.mkdir(parents=True, exist_ok=True)
    print(f"Downloading to: {output_path}")
    with urllib.request.urlopen(url) as response:
        output_path.write_bytes(response.read())

Technical Analysis

This generic download function is used for both the generated reference image and the final video. It trusts URLs returned by the remote SDK and opens them without enforcing HTTPS, constraining expected provider hosts, checking resolved addresses, validating redirects, setting a timeout, or imposing a response-size limit.

The entire response is read into memory and then written to disk. This creates two opportunities for resource exhaustion because the function may be invoked once for the image and once for the video. The function also does not verify that the retrieved content is actually an image or video.

Attack Path

1. An attacker influences an image or video URL returned through a compromised upstream response, dependency, or network path.
2. The script forwards the URL directly to download_file().
3. urllib.request.urlopen() connects to the supplied destination and may follow redirects.
4. The attacker redirects the request to an unintended endpoint or serves a very large, indefinitely streaming, or slow response.
5. response.read() consumes process memory without a bound.
6. Returned bytes are written to disk without media validation, potentially exhausting storage or creating misleading output files.

Impact Assessment

Successful exploitation could cause outbound requests from the user's network context, expose access to destinations reachable ...[truncated 389 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the generic downloader with a constrained media-download routine.
2. Permit only HTTPS URLs from documented Alibaba Cloud media hosts.
3. Validate every redirect target and reject local, private, link-local, and otherwise unexpected resolved addresses.
4. Set explicit connection and read timeouts.
5. Stream responses in fixed-size chunks while enforcing separate maximum sizes for images and videos.
6. Validate Content-Type, file signatures, and expected media formats before accepting the download.
7. Write to a securely created temporary file and atomically move it after successful validation.
8. Delete partial files when validation, timeout, or size checks fail.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tainted flow: 'video_url' from os.getenv (line 144, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The script downloads a URL returned from the remote DashScope job result without validating the scheme, host, or destination. If the upstream service, SDK response, or any attacker-controlled intermediary can influence video_url, this creates an SSRF/arbitrary outbound request primitive and could fetch unexpected content or internal resources in permissive network environments.

Content

Scanner excerpt · scripts/generate_video.py (reported line 159)May include surrounding context.

python

def download_video(video_url: str, output_path: Path) -> None:
    output_path.parent.mkdir(parents=True, exist_ok=True)
    with urllib.request.urlopen(video_url) as response:
        output_path.write_bytes(response.read())

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents this as a general Wan i2v video-generation/integration skill focused on video.generate request/response handling and parameter mapping. The code is materially narrower and somewhat different: it is a concrete command-line script for making a dancing video by first creating a reference image with a separate image model, then calling VideoSynthesis with wan2.6-i2v-flash, polling, and downloading outputs to disk. That added image-generation step is an undeclared capability, and the local file download/write behavior is also not represented in the description. Additionally, the code does not implement the broader parameter surface named in the description (e.g. negative_prompt, seed, motion_strength), so the description overstates what this chunk actually supports.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_dancing_video.py (reported line 58)May include surrounding context.

python

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_dancing_video.py (reported line 61)May include surrounding context.

python

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_video.py (reported line 56)May include surrounding context.

python

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_video.py (reported line 59)May include surrounding context.

python

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_dancing_video.py (reported line 185)May include surrounding context.

python

_load_dashscope_api_key_from_credentials()
    if not os.environ.get("DASHSCOPE_API_KEY"):
        print(
            "Error: DASHSCOPE_API_KEY is not set. Configure it via env/.env or ~/.alibabacloud/credentials.",
            file=sys.stderr,
        )
        print("Example .env:\n  DASHSCOPE_API_KEY=your_key_here", file=sys.stderr)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_video.py (reported line 180)May include surrounding context.

python

_load_dashscope_api_key_from_credentials()
    if not os.environ.get("DASHSCOPE_API_KEY"):
        print(
            "Error: DASHSCOPE_API_KEY is not set. Configure it via env/.env or ~/.alibabacloud/credentials.",
            file=sys.stderr,
        )
        print("Example .env:\n  DASHSCOPE_API_KEY=your_key_here", file=sys.stderr)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says the skill is for generating videos using Wan i2v models specifically, naming only wan2.6-i2v-flash, wan2.6-i2v, and wan2.6-i2v-us. However, the same file's 'Critical model names' section includes additional t2v and other model IDs such as wan2.2-t2v-plus, wan2.2-t2v-flash, wan2.6-t2v-us, and wanx2.1-t2v-turbo, expanding the documented behavior beyond the stated manifest scope.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Validation

bash

mkdir -p output/alicloud-ai-video-wan-video
python -m py_compile skills/ai/video/alicloud-ai-video-wan-video/scripts/generate_video.py && echo "py_compile_ok" > output/alicloud-ai-video-wan-video/validate.txt

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file first instructs users to use one of several exact model strings, including t2v variants and wanx2.1-t2v-turbo. Later, the anti-patterns section says 'use official Wan i2v model IDs only,' which contradicts the earlier accepted model list and creates confusion about intended supported behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest scopes this skill to generating videos with DashScope Wan i2v models and mapping video.generate request fields, but the code first calls the unrelated qwen-image-max image generation API to create a reference image. That expands behavior beyond straightforward Wan video generation and is not mentioned in the manifest description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring instructs the model to generate "an Asian beauty," which imposes a specific ethnicity and gender presentation regardless of user preference. This is a natural-language policy concern because the skill forces a locale/cultural characteristic instead of offering a neutral default or user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

When no separate image prompt is provided, the script rewrites the user's input into Chinese and injects "一位美丽的亚洲女性" before sending it to image generation. This forces both a language choice and demographic framing that the user did not request, which fits the policy category for language/locale constraints without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The workflow says to 'run one minimal read-only query first to verify connectivity and permissions,' but the rest of the skill only documents video generation and polling via VideoSynthesis.call/async_call/wait. No read-only query operation is defined here, so the workflow guidance contradicts the actual documented capabilities of the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file documents placing dashscope_api_key in ~/.alibabacloud/credentials, which involves storing a sensitive credential on disk. The reference does not include any warning about protecting that file, using least-privilege credentials, or avoiding accidental exposure, so users may follow the instruction without understanding the sensitivity.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The docstring says the function will "Generate an image of an Asian beauty," but the implementation simply sends the caller-provided prompt to the image model. This is an active mismatch between documentation and behavior because the code is generic while the docstring claims a specific output type.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest describes implementing/documenting video.generate requests and integrating video generation into a pipeline, but this script additionally downloads remote media and persists image/video files locally. Local artifact writing may be a useful helper, but it is broader than the narrowly described request/response mapping scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.