Alibaba Cloud AI Audio TTS Voice Design

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:35 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Alibaba Qwen TTS voice-design helper, with ordinary setup and credential requirements but no evidence of hidden persistence, exfiltration, or destructive behavior.

Install this only in a clean virtual environment, expose only the Alibaba/DashScope credentials needed for the TTS task, and review generated output before reuse. Pinning the dashscope package would improve supply-chain hygiene, but the inspected skill does not show hidden or destructive behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned DashScope Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-27
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

bash

- Install SDK in a virtual environment:

```bash
python3 -m venv .venv
. .venv/bin/activate
python -m pip install dashscope

text

### Technical Analysis

The installation instructions retrieve the latest available `dashscope` package and its transitive dependencies without pinning reviewed versions or verifying cryptographic hashes. Consequently, the installed code can change after the Skill has been audited.

Although use of a virtual environment limits package installation to that environment, it does not isolate package installation or execution from the current user's files, credentials, network access, or operating-system permissions. A compromised upstream release, package repository, build dependency, or transitive dependency could introduce malicious code. Source distributions may execute build-backend code during installation, while malicious package code may execute when subsequently imported or invoked.

No evidence indicates that the package name is currently malicious. The vulnerability is the mutable and unverified dependency resolution process rather than confirmed malicious behavior in the reviewed project.

### Attack Path

1. An attacker compromises the package publisher, package repository, or one of the package's transitive dependencies and publishes a malicious release.
2. A user or agent follows the documented setup instructions and executes `python -m pip install dashscope`.
3. Pip resolves the mutable package name to the compromised release because no exact version or integrity hash is specified.
4. Malicious build logic may execute during installation, or malicious runtime logic may execute when the SDK is later imported or used.
5. The payload operates with the privileges of the user running pip a
...[truncated 745 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin dashscope and every transitive dependency to versions that have been reviewed and tested.
2. Maintain dependencies in a lock file or hash-locked requirements file generated through a controlled dependency-update process.
3. Require cryptographic hash verification during installation, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Configure pip to use an explicitly approved package index rather than relying on ambient user or system configuration.
5. Review dependency release notes and security advisories before updating locked versions.
6. Prefer prebuilt, verified wheels where practical and restrict unexpected source builds.
7. Run installation and SDK operations in a least-privileged environment that exposes only the credentials and files required for the TTS request.
8. Avoid exposing unrelated secrets in the installation process environment.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill instructs users to read local files and write outputs under specific directories, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may use file system capabilities more broadly than intended, increasing the risk of unintended file access or overwrite in environments that rely on skill-declared boundaries.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md

# Model Studio Qwen TTS Voice Design

Use voice design models to create controllable synthetic voices from natural language descriptions.

## Critical model names

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow includes generic cloud-operation guidance like confirming region, identifiers, mutability, and running read-only verification queries, which does not match a narrow TTS voice-design skill. In an agent setting, this ambiguity can broaden operational behavior beyond audio generation and nudge the agent toward unrelated cloud actions, increasing the chance of misuse or over-privileged execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.