Alibaba Cloud AI Video Wan Video

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:04 PM UTC
• Version: 1.0.2

Overview

The skill is a mostly coherent Alibaba Cloud video-generation helper, with ordinary integration risks but no artifact-backed deception, persistence, exfiltration, or destructive behavior.

Install this only if you intend to use Alibaba Cloud DashScope for video generation. Use a dedicated DashScope API key, keep .env and ~/.alibabacloud/credentials private, run it in a virtual environment, consider pinning dashscope, and be aware that prompts, reference images, and generated media URLs are sent to or received from the provider. The dancing helper has opinionated default prompt text and should be reviewed before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:41
• Finding: Unpinned DashScope Dependency Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:41-45` **Additional Location**: `references/api_reference.md:7-11` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Vulnerable Code**: ```bash python3 -m venv .venv . .venv/bin/activate python -m pip install dashscope ``` ### Technical Analysis The installation instructions resolve the latest available `dashscope` package from the user's active Python package index. No reviewed version, integrity hash, lock file, or authoritative package source is specified. The project's `references/sources.md` also contains no external documentation or verified package link. Python packages may execute package-controlled code during installation and subsequently when imported. Consequently, package-index compromise, a compromised upstream release, or an untrusted index configured through pip settings could introduce code that was not present during this Skill audit. The lack of version pinning also makes builds non-reproducible and may silently introduce incompatible or vulnerable future releases. ### Attack Path 1. An attacker compromises a future `dashscope` release, the configured package index, or the dependency-resolution path. 2. A user follows the documented `python -m pip install dashscope` instruction. 3. pip retrieves and installs the substituted or compromised package without version or hash verification. 4. Package-controlled code executes during installation or when the scripts import `dashscope`. 5. The malicious dependency receives the same local privileges, environment access, and network access as the invoking user. ### Impact Assessment Successful exploitation could execute arbitrary Python code with the privileges of the user performing the installation or running the Skill. That code could access the process environment, including `DASHSCOPE_API_KEY`, read user-accessible files, alter generated output, and m ...[truncated 210 chars]
• Remediation: ## Remediation Suggestions 1. Pin `dashscope` to a specifically reviewed version rather than resolving the latest release. 2. Maintain a lock file or requirements file containing cryptographic hashes, and install with `pip install --require-hashes`. 3. Document the authoritative Alibaba Cloud package and documentation URLs in `references/sources.md`. 4. Use a trusted, explicitly configured package index and disable unneeded extra indexes. 5. Run dependency vulnerability and provenance checks as part of release validation. 6. Continue installing into an isolated virtual environment and avoid running pip with elevated privileges.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_video.py:157
• Finding: Unvalidated Video URL Is Downloaded Without Resource Limits## Vulnerability Details **File Location**: `scripts/generate_video.py:157-160` **Vulnerability Type**: Unrestricted remote URL retrieval and unbounded response buffering **Risk Level**: Medium **Vulnerable Code**: ```python def download_video(video_url: str, output_path: Path) -> None: output_path.parent.mkdir(parents=True, exist_ok=True) with urllib.request.urlopen(video_url) as response: output_path.write_bytes(response.read()) ``` ### Technical Analysis The script automatically opens the media URL returned through the DashScope SDK without validating its scheme, hostname, resolved address, redirect destination, content type, or expected file size. No connection or read timeout is configured. Calling `response.read()` without a size limit also buffers the entire response in memory before writing it to disk. Although the URL normally originates from the expected cloud provider, it crosses a remote trust boundary. A compromised provider response, compromised SDK, malicious intermediary where insecure transport is accepted, or malformed service response could cause the script to retrieve an unintended resource. Because redirects are followed by the underlying URL handler, validating only an initial URL would also be insufficient unless each redirect destination is constrained. ### Attack Path 1. An attacker causes the SDK response to contain an attacker-controlled or malformed `video_url`, such as through upstream service compromise, dependency compromise, or response manipulation. 2. `call_generate()` accepts that value without URL validation. 3. `download_video()` passes the URL directly to `urllib.request.urlopen()`. 4. The process connects to the supplied destination or follows redirects to another destination. 5. A malicious server returns an indefinitely slow or extremely large response. 6. The script blocks or consumes excessive memory and disk space; alternatively, arbitrary remote bytes a ...[truncated 630 chars]
• Remediation: ## Remediation Suggestions 1. Require HTTPS and reject all unsupported URL schemes. 2. Allowlist documented DashScope or Alibaba Cloud media-storage hostnames. 3. Resolve destinations and reject loopback, link-local, private, and otherwise prohibited addresses where internal access is unnecessary. 4. Disable redirects or validate the scheme, hostname, and resolved address at every redirect. 5. Configure explicit connection and read timeouts. 6. Enforce a maximum download size using `Content-Length` when available and a streaming byte counter in all cases. 7. Stream data in bounded chunks to a temporary file instead of calling unbounded `response.read()`. 8. Validate the response content type and media signature before accepting the file. 9. Atomically rename the validated temporary file to the final output path.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_dancing_video.py:161
• Finding: Generated Media URLs Are Downloaded Without Destination or Size Validation## Vulnerability Details **File Location**: `scripts/generate_dancing_video.py:161-166` **Vulnerability Type**: Unrestricted remote URL retrieval and unbounded response buffering **Risk Level**: Medium **Vulnerable Code**: ```python def download_file(url: str, output_path: Path) -> None: """Download a file from URL.""" output_path.parent.mkdir(parents=True, exist_ok=True) print(f"Downloading to: {output_path}") with urllib.request.urlopen(url) as response: output_path.write_bytes(response.read()) ``` ### Technical Analysis This generic download function is used for both the generated reference image and the final video. It trusts URLs returned by the remote SDK and opens them without enforcing HTTPS, constraining expected provider hosts, checking resolved addresses, validating redirects, setting a timeout, or imposing a response-size limit. The entire response is read into memory and then written to disk. This creates two opportunities for resource exhaustion because the function may be invoked once for the image and once for the video. The function also does not verify that the retrieved content is actually an image or video. ### Attack Path 1. An attacker influences an image or video URL returned through a compromised upstream response, dependency, or network path. 2. The script forwards the URL directly to `download_file()`. 3. `urllib.request.urlopen()` connects to the supplied destination and may follow redirects. 4. The attacker redirects the request to an unintended endpoint or serves a very large, indefinitely streaming, or slow response. 5. `response.read()` consumes process memory without a bound. 6. Returned bytes are written to disk without media validation, potentially exhausting storage or creating misleading output files. ### Impact Assessment Successful exploitation could cause outbound requests from the user's network context, expose access to destinations reachable ...[truncated 389 chars]
• Remediation: ## Remediation Suggestions 1. Replace the generic downloader with a constrained media-download routine. 2. Permit only HTTPS URLs from documented Alibaba Cloud media hosts. 3. Validate every redirect target and reject local, private, link-local, and otherwise unexpected resolved addresses. 4. Set explicit connection and read timeouts. 5. Stream responses in fixed-size chunks while enforcing separate maximum sizes for images and videos. 6. Validate `Content-Type`, file signatures, and expected media formats before accepting the download. 7. Write to a securely created temporary file and atomically move it after successful validation. 8. Delete partial files when validation, timeout, or size checks fail.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tainted flow: 'video_url' from os.getenv (line 144, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

def download_video(video_url: str, output_path: Path) -> None:
    output_path.parent.mkdir(parents=True, exist_ok=True)
    with urllib.request.urlopen(video_url) as response:
        output_path.write_bytes(response.read())

• Confidence: 95% confidence
• Finding: The script downloads a URL returned from the remote DashScope job result without validating the scheme, host, or destination. If the upstream service, SDK response, or any attacker-controlled intermediary can influence video_url, this creates an SSRF/arbitrary outbound request primitive and could fetch unexpected content or internal resources in permissive network environments.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents this as a general Wan i2v video-generation/integration skill focused on video.generate request/response handling and parameter mapping. The code is materially narrower and somewhat different: it is a concrete command-line script for making a dancing video by first creating a reference image with a separate image model, then calling VideoSynthesis with wan2.6-i2v-flash, polling, and downloading outputs to disk. That added image-generation step is an undeclared capability, and the local file download/write behavior is also not represented in the description. Additionally, the code does not implement the broader parameter surface named in the description (e.g. negative_prompt, seed, motion_strength), so the description overstates what this chunk actually supports.

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

_load_dashscope_api_key_from_credentials()
    if not os.environ.get("DASHSCOPE_API_KEY"):
        print(
            "Error: DASHSCOPE_API_KEY is not set. Configure it via env/.env or ~/.alibabacloud/credentials.",
            file=sys.stderr,
        )
        print("Example .env:\n  DASHSCOPE_API_KEY=your_key_here", file=sys.stderr)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

_load_dashscope_api_key_from_credentials()
    if not os.environ.get("DASHSCOPE_API_KEY"):
        print(
            "Error: DASHSCOPE_API_KEY is not set. Configure it via env/.env or ~/.alibabacloud/credentials.",
            file=sys.stderr,
        )
        print("Example .env:\n  DASHSCOPE_API_KEY=your_key_here", file=sys.stderr)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest description says the skill is for generating videos using Wan i2v models specifically, naming only wan2.6-i2v-flash, wan2.6-i2v, and wan2.6-i2v-us. However, the same file's 'Critical model names' section includes additional t2v and other model IDs such as wan2.2-t2v-plus, wan2.2-t2v-flash, wan2.6-t2v-us, and wanx2.1-t2v-turbo, expanding the documented behavior beyond the stated manifest scope.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Validation

```bash
mkdir -p output/alicloud-ai-video-wan-video
python -m py_compile skills/ai/video/alicloud-ai-video-wan-video/scripts/generate_video.py && echo "py_compile_ok" > output/alicloud-ai-video-wan-video/validate.txt
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The file first instructs users to use one of several exact model strings, including t2v variants and wanx2.1-t2v-turbo. Later, the anti-patterns section says 'use official Wan i2v model IDs only,' which contradicts the earlier accepted model list and creates confusion about intended supported behavior.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest scopes this skill to generating videos with DashScope Wan i2v models and mapping video.generate request fields, but the code first calls the unrelated qwen-image-max image generation API to create a reference image. That expands behavior beyond straightforward Wan video generation and is not mentioned in the manifest description.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The docstring instructs the model to generate "an Asian beauty," which imposes a specific ethnicity and gender presentation regardless of user preference. This is a natural-language policy concern because the skill forces a locale/cultural characteristic instead of offering a neutral default or user choice.

Natural-Language Policy Violations

Medium

• Confidence: 99% confidence
• Finding: When no separate image prompt is provided, the script rewrites the user's input into Chinese and injects "一位美丽的亚洲女性" before sending it to image generation. This forces both a language choice and demographic framing that the user did not request, which fits the policy category for language/locale constraints without opt-in.

Intent-Code Divergence

Low

• Confidence: 76% confidence
• Finding: The workflow says to 'run one minimal read-only query first to verify connectivity and permissions,' but the rest of the skill only documents video generation and polling via VideoSynthesis.call/async_call/wait. No read-only query operation is defined here, so the workflow guidance contradicts the actual documented capabilities of the skill.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: This markdown file documents placing `dashscope_api_key` in `~/.alibabacloud/credentials`, which involves storing a sensitive credential on disk. The reference does not include any warning about protecting that file, using least-privilege credentials, or avoiding accidental exposure, so users may follow the instruction without understanding the sensitivity.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The docstring says the function will "Generate an image of an Asian beauty," but the implementation simply sends the caller-provided prompt to the image model. This is an active mismatch between documentation and behavior because the code is generic while the docstring claims a specific output type.

Description-Behavior Mismatch

Low

• Confidence: 79% confidence
• Finding: The manifest describes implementing/documenting video.generate requests and integrating video generation into a pipeline, but this script additionally downloads remote media and persists image/video files locally. Local artifact writing may be a useful helper, but it is broader than the narrowly described request/response mapping scope.

Static analysis

No suspicious patterns detected.