Alibaba Cloud AI Audio TTS Voice Clone

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:32 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Alibaba Cloud voice-cloning helper with expected credential and output-file use, but users should install dependencies carefully and only clone voices with consent.

Install the SDK in an isolated environment, prefer pinned dependencies, keep the DashScope API key narrowly scoped, and use the skill only with voice samples you have permission to clone. Review saved output files because request JSON may include text and voice-sample references.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned Third-Party SDK Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-27
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

bash

- Install SDK in a virtual environment:

```bash
python3 -m venv .venv
. .venv/bin/activate
python -m pip install dashscope

text

### Technical Analysis

The installation instructions retrieve the latest available `dashscope` package and its transitive dependencies without specifying reviewed versions or verifying package hashes. Consequently, the code installed by this command may differ between executions and may change after the Skill itself has been audited.

The package name is consistent with the declared Alibaba Cloud integration, and there is no evidence that the Skill intentionally references a malicious or misspelled package. However, an unpinned installation remains exposed to upstream package compromise, compromised transitive dependencies, malicious release replacement, and unexpected security or compatibility regressions.

The use of a virtual environment limits modification of the global Python environment, but it does not sandbox package installation or execution. Package build hooks and subsequently imported SDK code execute with the operating-system permissions of the user running the command.

### Attack Path

1. An attacker compromises the `dashscope` distribution account, one of its transitive dependencies, or the relevant package-distribution infrastructure.
2. The attacker publishes a malicious release that satisfies the unrestricted dependency request.
3. A user follows the documented `python -m pip install dashscope` instruction.
4. Pip resolves and downloads the attacker-controlled release or dependency.
5. Malicious installation hooks or runtime code execute with the invoking user's privileges.
6. Depending on those privileges, the payload could access local files, environment variables such as `DASHSCOPE_API_KEY`, Alibaba Cloud credent
...[truncated 742 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin dashscope to an explicitly reviewed version, for example:

   bash

   python -m pip install "dashscope==<reviewed-version>"
   

2. Pin all transitive dependencies through a reviewed lock file generated with a dependency-management tool such as pip-tools.
3. Record cryptographic hashes and install with hash enforcement:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Configure pip to use an approved package index and avoid untrusted extra indexes.
5. Periodically scan the locked dependency set for known vulnerabilities and review dependency updates before changing pins.
6. Continue using an isolated virtual environment and avoid installing or executing the SDK with root or administrator privileges.
7. Prefer DASHSCOPE_API_KEY through a narrowly scoped process environment, apply least-privilege cloud permissions, and ensure credential files have restrictive filesystem permissions.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents local helper and validation commands that read files from the repository and write artifacts under an output directory, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can cause an agent runtime to grant broader file access than reviewers expect, increasing the risk of unintended file reads/writes or abuse through prompt/tool confusion.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The workflow text instructs users to determine whether the operation is read-only or mutating and to run a minimal read-only query first. For a voice-cloning TTS skill, the documented interface only covers creating cloned voices and synthesizing audio, so this guidance contradicts the actual intent and available operations rather than merely omitting detail.

Content

No source excerpt is available for this finding.