ClawHub
Back to skill

Security audit

Alibaba Cloud AI Video Wan Video

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Alibaba DashScope video-generation helper with expected API-key use, network calls, local image input, and output files.

Use a scoped DashScope API key, preferably in a virtual environment. Prompts and reference images may be sent to Alibaba Cloud, and generated URLs or media can remain in the output directory, so clean those files if they contain sensitive content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill exposes and documents capabilities to read environment secrets, access the network, and read/write local files, but it does not declare any permissions boundary. That creates a trust and review gap: operators may authorize or execute the skill without understanding that it can access API keys, upload local files via the SDK, and persist artifacts to disk.

Session Persistence

Medium
Category
Rogue Agent
Content
## Validation

```bash
mkdir -p output/aliyun-wan-video
python -m py_compile skills/ai/video/aliyun-wan-video/scripts/generate_video.py && echo "py_compile_ok" > output/aliyun-wan-video/validate.txt
```
Confidence
88% confidence
Finding
mkdir -p output/aliyun-wan-video python -m py_compile skills/ai/video/aliyun-wan-video/scripts/generate_video.py && echo "py_compile_ok" > output/aliyun-wan-video/validate.txt ``` Pass criteria: comm

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.