Alibaba Cloud AI Multimodal Qwen OCR

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:29 AM UTC
• Version: 1.0.0

Overview

This Alibaba Cloud OCR skill is purpose-aligned, but it needs review because it can route sensitive documents through third-party cloud workflows and encourages public URL conversion without enough privacy safeguards.

Review this skill before installing if you plan to process confidential or regulated documents. Avoid making private files publicly accessible for OCR, prefer controlled or short-lived access methods, redact sensitive content where possible, and clean up `output/aliyun-qwen-ocr/` after runs that include private payloads or data URLs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:44

Finding

Unpinned and Unnecessary Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44–49
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Complete Code Snippet:

bash

python3 -m venv .venv
. .venv/bin/activate
python -m pip install requests

Technical Analysis

The installation instruction retrieves the latest available version of requests and its transitive dependencies without version constraints or package hashes. Consequently, installations are not reproducible, and the package set can change after the Skill has been reviewed.

Compromise of the package registry, a dependency release, or a maintainer account could cause users following this instruction to install attacker-controlled code. Python packages can execute code during installation or when imported.

The dependency also appears unnecessary for the shipped implementation: scripts/prepare_ocr_request.py only imports Python standard-library modules (argparse, json, and pathlib) and does not make network requests. Requiring requests therefore expands the supply-chain attack surface beyond the minimum needed for the Skill's implemented request-preparation functionality.

No evidence indicates that the current requests package is malicious. The risk arises from unconstrained future dependency resolution and the unnecessary installation requirement.

Attack Path

1. An attacker compromises a future requests release, one of its transitive dependencies, or the relevant package-distribution channel.
2. A user follows the documented prerequisite and runs python -m pip install requests.
3. Pip resolves and downloads the compromised version because no approved version or hash is enforced.
4. Attacker-controlled package code executes during installation or later package use with the privileges of the invoking user.
5. The malicious code may access files, environment variables, credentials available to that user, and n ...[truncated 738 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requests installation prerequisite if the Skill remains limited to generating local JSON request payloads.

2. If future functionality genuinely requires requests, declare an audited version and all transitive dependencies in a lock file.

3. Require cryptographic package hashes, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Generate the locked dependency set from a trusted index and review dependency updates before adoption.

5. Keep installation inside an isolated virtual environment and explicitly warn users not to run pip with administrative privileges.

6. Document that credential files and API keys are only required by a separate API client, because the current request-preparation script does not access them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Recommending conversion of local files to public URLs can directly expose sensitive documents to anyone who can access the link, and the guidance provides no warning about access control, expiry, or safer alternatives. In the context of an OCR skill that commonly processes confidential files, this is particularly dangerous because users may publish invoices, identity documents, or internal records just to satisfy API input requirements.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill performs file writes under output/aliyun-qwen-ocr during validation and normal operation, but it does not declare any tool scope such as permissions or allowed-tools. That creates a capability/transparency gap: consumers may invoke the skill without realizing it persists artifacts to disk, which can violate least-privilege expectations and make downstream policy enforcement harder.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill instructs the agent to save request payloads, task names, model identifiers, and normalized outputs under a persistent output directory. Because OCR inputs often contain invoices, IDs, contracts, or other sensitive document data, retaining these artifacts beyond the immediate run creates unnecessary data exposure risk through later access, reuse, or leakage from session storage.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Validation

bash

mkdir -p output/aliyun-qwen-ocr
python -m py_compile skills/ai/multimodal/aliyun-qwen-ocr/scripts/prepare_ocr_request.py && echo "py_compile_ok" > output/aliyun-qwen-ocr/validate.txt

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The interface explicitly accepts HTTPS URLs, local files, and data URLs for OCR, but the skill does not warn that those image/document contents may be sent to Alibaba Cloud for processing. This can lead users to submit sensitive documents under the false assumption that processing is local, causing inadvertent disclosure of confidential or regulated data to a third-party provider.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The reference documents external Alibaba Cloud OCR endpoints and shows sending image content to them, but it does not warn that uploaded images may contain sensitive personal, financial, or business data. In an OCR-focused skill, users are especially likely to submit documents such as invoices, IDs, or forms, so omission of privacy and data-handling guidance materially increases the risk of unintentional data disclosure to third-party services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file contains only Chinese-language reference titles and links, which may imply a fixed language/locale experience without user opt-in. The policy calls for flagging language or locale constraints when they are forced and not documented as optional or justified.

Content

No source excerpt is available for this finding.