Alibaba Cloud AI Code Qwen Coder

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:40 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Alibaba Cloud Qwen Coder provider helper, with disclosed local request-file persistence and ordinary setup steps but no hidden execution, exfiltration, or destructive behavior in the inspected artifacts.

Before installing, use this only for code you are allowed to send to Alibaba Cloud Model Studio, avoid including secrets in prompts or repository summaries, clean output/aliyun-qwen-coder/ if it may contain sensitive data, and consider pinning the dashscope SDK version in your own environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37

Finding

Unpinned Third-Party SDK Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37–43
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

bash

- Install SDK in a virtual environment:

```bash
python3 -m venv .venv
. .venv/bin/activate
python -m pip install dashscope

text

### Technical Analysis

The installation instructions retrieve the latest available `dashscope` package without pinning an audited version or validating package hashes. Although using a virtual environment limits modification of system-wide Python packages, it does not protect the invoking user's files, credentials, environment variables, or network access from malicious package installation or runtime behavior.

This creates a supply-chain exposure because the effective dependency content can change after the Skill has been reviewed. A compromised upstream release, package repository account, or package distribution channel could cause users to install attacker-controlled code.

The separate credential instruction at `SKILL.md:45` is appropriate for authenticating with Alibaba Cloud Model Studio and does not itself exceed minimum privilege. The reviewed script does not read, log, or transmit `DASHSCOPE_API_KEY` or `~/.alibabacloud/credentials`.

### Attack Path

1. An attacker compromises the upstream `dashscope` package, a maintainer account, or a newly published package release.
2. A user follows the Skill prerequisite and runs `python -m pip install dashscope`.
3. Because no version or integrity hash is specified, pip retrieves the currently selected distribution.
4. Malicious package installation or runtime code executes with the privileges of the invoking user.
5. The malicious code could access user-readable files, inherited environment variables, locally configured credentials, and network resources.

### Impact Assessment

Successful exploitation could execute code with the current user's privileges inside the e
...[truncated 272 chars]

Remediation

View remediation

Remediation Suggestions

• Pin dashscope to a reviewed exact version rather than installing an unconstrained latest release.
• Maintain dependencies in a lockfile generated from a trusted environment.
• Record and verify cryptographic hashes for all distributions, using pip's --require-hashes mode where practical.
• Retrieve packages only from an explicitly trusted package index over TLS.
• Add a documented dependency-review and update process before changing the pinned version.
• Continue installing the dependency in an isolated virtual environment and avoid running installation commands with elevated privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill describes capabilities that involve writing files and interacting with an external provider, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates ambiguity about what the skill is authorized to do and can lead to overbroad execution in agents that infer or grant capabilities implicitly.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The validation and output guidance create persistent artifacts under output/aliyun-qwen-coder/, including validation markers and later request-related data. While not inherently malicious, session persistence can retain sensitive workflow information longer than necessary and may expose it to subsequent processes or users if the workspace is shared.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Validation

bash

mkdir -p output/aliyun-qwen-coder
python -m py_compile skills/ai/code/aliyun-qwen-coder/scripts/prepare_code_request.py && echo "py_compile_ok" > output/aliyun-qwen-coder/validate.txt

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs saving prompts, repository context summaries, and normalized request payloads to disk, but provides no warning that these artifacts may contain sensitive source code, secrets, or proprietary context. Persisting such data increases the chance of unintended retention, later disclosure, or collection by other tools and users on the system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs users to install an SDK, configure Alibaba Cloud credentials, and use external model endpoints, but does not warn that repository content, prompts, and code context may be transmitted to a third-party service. In a coding-agent context, this omission is significant because proprietary code, internal architecture details, or embedded secrets could be sent off-premises without informed user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The default prompt triggers the skill for a very broad class of 'ai/code' tasks without meaningful constraints, which can cause over-selection of this skill in contexts where a narrower or more trusted tool should be used. While the file does not contain direct prompt injection or code execution logic, broad activation increases the chance of unintended routing, data exposure to the external model provider, or misuse in tasks outside the intended scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.