ClawHub
Back to skill

Security audit

Alibaba Cloud AI Multimodal Qwen VL

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Alibaba Qwen VL image-analysis helper, but its script can forward the user's DashScope API key and image data to an arbitrary caller-supplied endpoint.

Review before installing. Use only trusted request JSON, remove or restrict the base_url override, and avoid sending sensitive images, screenshots, documents, secrets, or regulated data unless you have approval for Alibaba Cloud processing. Pin dependencies for reproducible installs and rotate the DashScope key if this script has ever been run with untrusted input.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/analyze_image.py:225
Finding

DashScope API Key Disclosure Through a Caller-Controlled Endpoint

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:30
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/analyze_image.py (reported line 62)May include surrounding context.

python
def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/analyze_image.py (reported line 65)May include surrounding context.

python
def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/analyze_image.py (reported line 315)May include surrounding context.

python
_load_dashscope_api_key_from_credentials()
    if not os.environ.get("DASHSCOPE_API_KEY"):
        print(
            "Error: DASHSCOPE_API_KEY is not set. Configure it via env/.env or ~/.alibabacloud/credentials.",
            file=sys.stderr,
        )
        print("Example .env:\n  DASHSCOPE_API_KEY=your_key_here", file=sys.stderr)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill documentation implies capabilities involving environment variables, local file reads/writes, and outbound network access, but it declares no explicit tool scope or permission boundaries. This can cause an agent runtime to invoke the skill without clear least-privilege constraints, increasing the chance of unintended data access or exfiltration.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Validation

bash
mkdir -p output/aliyun-qwen-vl
python -m py_compile skills/ai/multimodal/aliyun-qwen-vl/scripts/analyze_image.py && echo "py_compile_ok" > output/aliyun-qwen-vl/validate.txt

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly sends user prompts and images to Alibaba Cloud's DashScope API, but it does not clearly warn users that potentially sensitive local images and extracted content leave the local environment. For multimodal workflows, this creates a real privacy and compliance risk because screenshots, invoices, IDs, or other confidential data may be transmitted externally without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This skill is designed around outbound API calls to a third-party endpoint, so external transmission is inherent to its function rather than a hidden behavior. However, it is still security-relevant because any supplied image, prompt text, and derived metadata may be transmitted off-system, which can expose sensitive information if not tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

--print-response

text

## cURL (compatible mode)

```bash
curl -sS https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions \

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The workflow text references checking whether an operation is read-only or mutating and executing a target operation, which is inconsistent with a vision-analysis skill that should only submit prompts and images to a remote model. This mismatch can mislead orchestration agents into granting broader authority or composing the skill into workflows with unnecessary side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation instructs users to send image URLs and accompanying text to third-party cloud endpoints but does not mention that image content, extracted text, or linked resources may contain sensitive data and will be transmitted off-system. In an image-understanding/OCR workflow, this omission can lead to unintentional disclosure of screenshots, documents, IDs, or internal URLs, making the skill context more sensitive than generic text-only API usage.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This code performs external network transmission of user-supplied prompts and image data to a remote endpoint, which is inherently sensitive for a multimodal analysis tool. The risk is amplified because the request body may contain raw local image contents embedded as base64 data URLs, and the base_url is request-configurable, enabling accidental or unsafe routing to non-default endpoints.

Content

Scanner excerpt · scripts/analyze_image.py (reported line 212)May include surrounding context.

python
) -> requests.Response:
    last_error: str | None = None
    for attempt in range(max_retries + 1):
        response = requests.post(url, headers=headers, json=payload, timeout=timeout_s)
        if response.status_code < 400:
            return response

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends prompts and image content, including local files converted to data URLs, to a third-party API service without any explicit consent gate, sensitivity warning, or data-classification check. In this skill context, users may analyze screenshots, OCR documents, charts, or other potentially sensitive images, so unintended disclosure of secrets, PII, or internal material to an external provider is a realistic risk.

Content

No source excerpt is available for this finding.

Tainted flow: 'result' from pathlib.Path.read_bytes (line 280, file read) → pathlib.Path.write_text (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/analyze_image.py (reported line 338)May include surrounding context.

python
if args.output:
        output_path = Path(args.output)
        output_path.parent.mkdir(parents=True, exist_ok=True)
        output_path.write_text(json.dumps(result, ensure_ascii=True, indent=2), encoding="utf-8")

    if args.print_response:
        print(json.dumps(result, ensure_ascii=True))

Static analysis

No suspicious patterns detected.