Alibaba Cloud AI Research Qwen Deep Research

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:37 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Alibaba Cloud research helper that discloses its local output behavior, with ordinary privacy and dependency-installation cautions.

Install only if you are comfortable sending research prompts and attachments to Alibaba Cloud Model Studio and retaining request/report files under `output/aliyun-qwen-deep-research/`. Avoid putting sensitive secrets or confidential business data in prompts unless that matches your data-handling policy, and pin or review the `dashscope` dependency before installing it in production environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:43
Vulnerability Type: Unpinned dependency and mutable supply-chain input
Risk Level: Medium

Complete Code Snippet:

bash

python -m pip install dashscope

Technical Analysis

The prerequisite installs dashscope without a version constraint, lockfile, or integrity hash. The installed artifact therefore depends on the package index state at installation time and may differ from the release assessed during this audit.

This is an insecure dependency practice rather than evidence that the current package is malicious. Nevertheless, a compromised package release, malicious maintainer update, or unsafe source distribution could execute code during installation or subsequently when imported. Creating a virtual environment limits package contamination but does not sandbox installation scripts or runtime code from the user's account.

Attack Path

1. An attacker compromises the upstream package, maintainer account, release process, or package distribution channel.
2. The attacker publishes a malicious or modified dashscope release.
3. A user follows the documented prerequisite and runs python -m pip install dashscope.
4. Pip resolves the attacker-controlled release because no reviewed version or hash is required.
5. Malicious build or package code executes with the privileges of the user running pip, or malicious runtime code executes when the dependency is later imported.

Impact Assessment

Successful exploitation could execute arbitrary code with the installing user's privileges. Depending on that user's permissions, this may allow access to project data, environment variables, local credentials—including a configured DASHSCOPE_API_KEY—and other files accessible to the account. It could also enable outbound network communication or modification of files in the virtual environment and writable workspace.

The bundled project script itself ...[truncated 143 chars]

Remediation

View remediation

Remediation Suggestions

• Pin dashscope to a specifically reviewed version rather than resolving the latest release.

• Record dependencies in a lockfile or requirements file with cryptographic hashes.

• Install with hash enforcement, for example:

  bash

  python -m pip install --require-hashes -r requirements.txt
  

• Prefer prebuilt wheels from the official package index and review unexpected source builds.

• Use automated dependency vulnerability scanning and a controlled process for updating the pinned version and hashes.

• Continue installing dependencies inside a dedicated virtual environment, but do not treat that environment as a security sandbox.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents file-writing and network-backed research behavior but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: an agent may invoke broader capabilities than reviewers or users expect, especially for a research skill that sends prompts externally and writes artifacts locally.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Validation

bash

mkdir -p output/aliyun-qwen-deep-research
python -m py_compile skills/ai/research/aliyun-qwen-deep-research/scripts/prepare_deep_research_request.py && echo "py_compile_ok" > output/aliyun-qwen-deep-research/validate.txt

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill states that research goals, answers, payloads, and report snapshots are saved under output/aliyun-qwen-deep-research/, but the top-level description does not warn users that their inputs and model outputs will be persisted to disk. For a deep-research workflow, prompts may contain sensitive business data, and silent persistence increases privacy and data-retention risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.