ClawHub
Back to skill

Security audit

Alibaba Cloud AI Text Qwen Generation

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Alibaba Qwen text-generation helper, with expected third-party API use and local request-file generation, but users should treat prompts, outputs, API keys, and helper output paths carefully.

Before installing, confirm Alibaba Cloud Model Studio is an approved destination for your prompts and outputs, use a least-privilege DashScope API key, avoid sending secrets or regulated data, and keep generated request/response files in a controlled output directory. Consider pinning the DashScope package version and avoid passing untrusted values to the helper's `--output` option.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:45
Finding

Unpinned DashScope Dependency Creates a Mutable Supply-Chain Risk

Content
View full analysis
Remediation
View remediation
" ``` 2. Maintain a locked requirements file containing cryptographic hashes: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Configure the expected official package index explicitly and avoid untrusted extra indexes. 4. Review transitive dependencies and regenerate the lock file only through a controlled dependency-update process. 5. Run dependency installation and use under a minimally privileged account in an isolated environment. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/prepare_generation_request.py:20
Finding

User-Controlled Output Path Allows Overwriting Arbitrary Writable Files

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents file-writing and outbound network behavior but does not declare any explicit tool scope or permissions boundary. This can cause an agent or operator to invoke the skill with broader capabilities than expected, weakening least-privilege controls and making unintended data egress or filesystem writes harder to govern.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Validation

bash
mkdir -p output/aliyun-qwen-generation
python -m py_compile skills/ai/text/aliyun-qwen-generation/scripts/prepare_generation_request.py && echo "py_compile_ok" > output/aliyun-qwen-generation/validate.txt

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs users to persist prompt templates, normalized requests, and response summaries to disk, but these artifacts may contain secrets, personal data, internal prompts, or proprietary model outputs. Storing them by default without warnings, redaction guidance, or retention limits increases the risk of local data exposure and later unintended reuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The quick-start example sends user-supplied prompt content to a third-party remote endpoint using an API key, but it does not warn that request contents leave the local environment. In practice, operators may paste confidential or regulated data into the example without understanding the privacy, residency, or provider-handling implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This example performs intentional external transmission to the Alibaba Cloud Model Studio endpoint, including prompt content and an authorization bearer token. While expected for a provider integration skill, it still represents a real data egress path and becomes dangerous if users submit sensitive data or run the command in environments without approved outbound access.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

Quick start (OpenAI-compatible endpoint)

bash
curl -sS https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file contains user-facing natural-language content exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this locale. Under the language/locale policy rule, forcing a specific language without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.