Alibaba Cloud AI Video Aishi Generation

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:30 AM UTC
• Version: 1.0.0

Overview

This skill appears to do what it says: help prepare Alibaba Cloud PixVerse video requests, with ordinary cloud-service privacy and dependency-installation cautions.

Install in a virtual environment, pin or review the dashscope package for controlled deployments, and do not submit confidential prompts, private media URLs, secrets, or regulated data unless your organization allows transfer to Alibaba Cloud Model Studio in the documented region.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48

Finding

Unpinned Third-Party SDK Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 48
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

python -m pip install dashscope

Technical Analysis

The installation instruction retrieves the latest available dashscope package without an exact version constraint, lock file, or cryptographic hash verification. Consequently, the installed code can differ from the version originally reviewed and tested.

Although dashscope is consistent with the declared Alibaba Cloud functionality, an unpinned dependency creates a supply-chain exposure. A compromised, malicious, or unexpectedly changed package release could execute code during installation or later at runtime. The instruction does not itself retrieve and execute an explicitly malicious payload, and no malicious behavior was identified in the project’s local Python script.

The separate credential guidance at SKILL.md:52 is appropriate for authenticated Alibaba Cloud operations. The audited local script does not read, enumerate, log, copy, or transmit DASHSCOPE_API_KEY or ~/.alibabacloud/credentials.

Attack Path

1. A user follows the documented prerequisite and runs python -m pip install dashscope.
2. pip resolves whichever package version is current at installation time.
3. An attacker compromises a future release or its distribution path, or an unsafe release is otherwise published.
4. The affected package is downloaded and installed without hash verification.
5. Package installation hooks or imported runtime code execute with the privileges of the user running pip.

Impact Assessment

A compromised dependency could act with the invoking user’s permissions. Depending on the host environment, this could permit access to user-readable files, environment variables, local credentials, and outbound network resources. It could also alter files writable by that user.

No direct privilege escalation to another ...[truncated 186 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin dashscope to a specifically reviewed version rather than installing the latest release:

   text

   dashscope==REVIEWED_VERSION
   

2. Store dependencies in a committed requirements or lock file with cryptographic hashes, then require hash validation:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Generate hashes from a trusted package source and review dependency updates before changing the pinned version.

4. Use a dedicated virtual environment, as already recommended, and avoid installing the package with elevated operating-system privileges.

5. Where practical, constrain the package index to the intended trusted repository and retain dependency audit evidence for the pinned release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs writing artifacts under output/aliyun-pixverse-generation/ but does not declare any tool scope or allowed-tools boundary. Missing capability scoping can cause an agent runtime to grant broader file-write behavior than users expect, increasing the chance of unintended local persistence or writes outside the intended workflow.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Validation

bash

mkdir -p output/aliyun-pixverse-generation
python -m py_compile skills/ai/video/aliyun-pixverse-generation/scripts/prepare_aishi_request.py && echo "py_compile_ok" > output/aliyun-pixverse-generation/validate.txt

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends prompts, media URLs, and generation parameters to Alibaba Cloud DashScope endpoints, but the user-facing description does not clearly warn about this third-party data transfer. This can lead to inadvertent disclosure of sensitive prompts or media and undermines informed user consent, especially in environments with data-handling restrictions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.