ClawHub
Back to skill

Security audit

Alibaba Cloud AI Image Qwen Image Edit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrowly scoped Alibaba Qwen image-editing helper with expected SDK, credential, and output-file behavior, though users should handle saved prompts, image URLs, and API keys carefully.

Before installing, use a clean virtual environment, prefer a pinned and reviewed dashscope version if possible, keep Alibaba Cloud credentials out of logs and source control, and avoid saving sensitive prompts or private image URLs longer than needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:44
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44–49
Vulnerability Type: Unpinned package installation and software supply-chain exposure
Risk Level: Medium

Vulnerable Code Snippet:

bash
python3 -m venv .venv
. .venv/bin/activate
python -m pip install dashscope
text
- Set `DASHSCOPE_API_KEY` in your environment, or add `dashscope_api_key` to `~/.alibabacloud/credentials`.

Technical Analysis

The Skill instructs users to install dashscope from the active Python package index without specifying an audited version, lock file, package hash, or trusted index. Although this SDK is relevant to the declared Alibaba Cloud image-editing functionality, an unrestricted installation resolves whichever release the package index currently presents.

Python package installation may execute package-controlled build or installation logic. Therefore, compromise of the legitimate package, its publisher account, the configured package index, or the dependency resolution chain could result in arbitrary local code execution during installation. The absence of version and integrity constraints also makes installation non-reproducible and prevents users from verifying that they are installing the same artifact that was reviewed.

The nearby credential instruction increases the potential consequence because the user environment may contain DASHSCOPE_API_KEY, and the documented alternative credential file is ~/.alibabacloud/credentials. However, the audited project code does not itself read, print, store, or transmit either credential source. The credential configuration is functionally necessary for authenticated provider access and does not independently constitute unauthorized access.

Attack Path

  1. A user follows the Skill prerequisite and activates a local virtual environment.
  2. The user runs python -m pip install dashscope.
  3. Pip queries the user's configured package index and re ...[truncated 1167 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin dashscope to a specific version that has been reviewed and tested:
    bash
    python -m pip install "dashscope==<reviewed-version>"
  2. Generate a lock or requirements file containing cryptographic hashes and install it with hash enforcement:
    bash
    python -m pip install --require-hashes -r requirements.txt
  3. Pin and review all transitive dependencies rather than constraining only the top-level package.
  4. Explicitly document and enforce the expected trusted package index instead of relying on arbitrary user-level pip configuration.
  5. Perform dependency vulnerability and provenance checks during release preparation.
  6. Install dependencies before placing cloud credentials in the process environment where practical, and avoid exposing long-lived credentials to package installation processes.
  7. Use narrowly scoped, short-lived provider credentials and restrictive filesystem permissions for ~/.alibabacloud/credentials.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill describes file read/write behavior through validation commands and output artifact handling, but it does not declare any explicit tool scope such as allowed tools or permissions. That creates an authorization ambiguity where an agent may assume broader filesystem access than intended, increasing the chance of unintended data access or writes during execution.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Validation

bash
mkdir -p output/aliyun-qwen-image-edit
python -m py_compile skills/ai/image/aliyun-qwen-image-edit/scripts/prepare_edit_request.py && echo "py_compile_ok" > output/aliyun-qwen-image-edit/validate.txt

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs persistent storage of request payloads, prompts, result URLs, and model parameters without warning that these artifacts can contain sensitive image contents, personal data, or confidential prompts. In an image-editing context, URLs and request records may directly reveal user assets or editing intent, creating privacy and data-retention risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advises setting an API key in the environment or storing it in a persistent credentials file, but it does not include safety guidance for secret handling. Without warnings, users may place long-lived credentials in insecure locations, commit them accidentally, or expose them through logs and shared environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest describes a narrowly scoped skill for preparing and documenting Qwen image edit requests, but the workflow text instructs the operator to determine whether an operation is 'read-only or mutating' and to run a 'minimal read-only query first.' For an image editing skill, those phrases describe a different operational model and contradict the rest of the file's edit-focused intent.

Content

No source excerpt is available for this finding.