ClawHub
Back to skill

Security audit

Alibaba Cloud AI Multimodal Qwen VL

Security checks for vulnerabilities and agentic risk

Overview

This image-analysis skill mostly does what it claims, but its helper script can send your Alibaba API key, prompt, and image content to a request-specified server instead of only DashScope.

Install only if you are comfortable sending submitted images and prompts to Alibaba Cloud for processing and storing outputs locally. Use trusted request JSON only, do not accept or pass a base_url override unless you intentionally trust that endpoint with your Alibaba Cloud API key, and avoid sensitive images unless you have handled retention and redaction yourself.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill clearly uses environment variables, local file reads/writes, and network access, but it does not declare these capabilities or warn operators about them. That creates a transparency and policy-enforcement gap: users may invoke a seemingly simple image-understanding skill without realizing it can exfiltrate inputs to a remote API and persist artifacts locally.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs operators to save raw model responses, normalized extraction results, input image references, and prompts for traceability, but gives no privacy, retention, or sensitivity guidance. Those artifacts can contain personal data, secrets, screenshots, document contents, or sensitive URLs, creating avoidable local data exposure and long-term persistence risk.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill states that image inputs and prompts are sent to the DashScope API, but it does not clearly disclose that user-supplied content leaves the local environment and is transmitted to a third-party service. In this context, image-understanding inputs often include screenshots, invoices, IDs, or other sensitive materials, so the missing disclosure materially increases privacy and compliance risk.

Static analysis

No suspicious patterns detected.