Alibaba Cloud AI Video Wan R2V

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Alibaba Cloud reference-to-video helper with disclosed SDK, credential, API, and local output behavior; the main risks are ordinary dependency and data-handling cautions rather than hidden or malicious behavior.

Install this only in a dedicated virtual environment, use a scoped Alibaba Cloud API key, avoid committing credentials or generated request files, and review saved payloads because they may contain prompts, media URLs, task IDs, or other sensitive project details.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

Unpinned Third-Party SDK Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 40
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

python -m pip install dashscope

Technical Analysis

The Skill instructs users to install the dashscope package without pinning a reviewed version or verifying an integrity hash. Consequently, package resolution depends on whichever release and artifacts the configured package index serves at installation time.

Python package installation can execute package-controlled build or installation logic. If the package distribution, publisher account, package index, or dependency chain is compromised, following this instruction could execute attacker-controlled code. The absence of version and hash constraints also permits unreviewed changes to enter the environment after the Skill itself has been audited.

This finding does not establish that dashscope is currently malicious. It identifies an avoidable supply-chain exposure in the installation procedure.

Attack Path

1. An attacker compromises the package publisher, distribution channel, package-index account, or a transitive dependency used by a future dashscope release.
2. A malicious package artifact is published or supplied through the user's configured Python package index.
3. The user follows the Skill prerequisite and runs python -m pip install dashscope.
4. Pip resolves the uncontrolled package version and downloads the malicious artifact.
5. Package-controlled installation/build logic or subsequently imported runtime code executes with the privileges of the user running pip.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. The reachable scope may include files, environment variables, API credentials, and network resources available to that account. The instruction does not request elevated privileges, so it d ...[truncated 384 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin dashscope to a specifically reviewed version rather than resolving the latest available release:

   bash

   python -m pip install "dashscope==<reviewed-version>"
   

2. Maintain dependencies in a lock or requirements file containing cryptographic hashes, and install with hash enforcement:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Pin and hash transitive dependencies as well as the direct SDK dependency.
4. Document and enforce the expected trusted package index, avoiding untrusted mirrors or additional indexes that could enable dependency confusion.
5. Re-review and update the lock file through a controlled dependency-update process.
6. Continue installing the SDK inside a dedicated virtual environment and avoid running pip with root or administrator privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documents file read/write behavior by instructing validation and evidence collection, but it declares no explicit tool scope such as allowed-tools or permissions. This creates an authorization ambiguity where an agent may use broader filesystem capabilities than reviewers or policy layers expect, increasing the chance of unintended file access or persistence.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Validation

bash

mkdir -p output/aliyun-wan-r2v
python -m py_compile skills/ai/video/aliyun-wan-r2v/scripts/prepare_r2v_request.py && echo "py_compile_ok" > output/aliyun-wan-r2v/validate.txt

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill tells operators to save reference input metadata, request payloads, and task outputs, but it does not warn that these artifacts may contain sensitive prompts, media URLs, personal data, or internal identifiers. In a reference-to-video workflow, logging full payloads and outputs can expose source media locations and user-supplied content well beyond the immediate task execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The credential setup instructs users to place API keys in environment variables or credential files without any security handling guidance. While common, omitting warnings about least privilege, file permissions, secret redaction, and avoiding commits increases the chance of accidental credential exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The SKILL.md workflow instructs the operator to determine whether the operation is read-only or mutating and to run a minimal read-only query first. Elsewhere, the skill is described solely as a video-generation provider and its interface documents generation requests and async task polling, not any read-only capability. This creates a documentation-level contradiction about the intended operation mode.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file lists only zh-language documentation URLs, which suggests the skill may constrain users to a specific language context without stating a choice or opt-in. The policy requires flagging language or locale constraints when they are imposed without user choice or clear justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.