Alibaba Cloud AI Video Wan Video

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:34 AM UTC
• Version: 1.0.0

Overview

This is a disclosed Alibaba DashScope video-generation helper with expected network, credential, upload, and output-file behavior, but users should treat its provider uploads and unpinned dependency carefully.

Install in a dedicated virtual environment, prefer a pinned and reviewed dashscope version, avoid running as root, and pass only prompts and reference images you are comfortable sending to Alibaba DashScope. Treat saved logs, task IDs, generated URLs, images, and videos as potentially sensitive and clean them up when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45
• Finding: Unpinned DashScope Dependency in Skill Installation Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:40-46` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash python3 -m venv .venv . .venv/bin/activate python -m pip install dashscope ``` ### Technical Analysis The installation instructions retrieve the latest available `dashscope` package without specifying a reviewed version or validating package integrity with cryptographic hashes. Consequently, the dependency installed by a user can differ from the version considered during this audit. If the package, a transitive dependency, or its distribution channel is compromised, attacker-controlled code could execute during installation or when the scripts import and use the package. The virtual environment limits modification of system-wide Python packages but does not isolate the package from the invoking user's files, environment variables, credentials, or network access. This is a supply-chain weakness rather than evidence that the current `dashscope` package is malicious. ### Attack Path 1. An attacker compromises a future `dashscope` release, one of its transitive dependencies, or the relevant package-distribution account. 2. The compromised release becomes the version selected by the unpinned `pip install dashscope` command. 3. A user follows the Skill instructions and installs the mutable latest release. 4. Malicious package code executes during installation or when `dashscope` is imported by the video-generation scripts. 5. The code operates with the privileges of the user running the installation or scripts and may access that process's files, environment, credentials, and network resources. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the invoking user's privileges. The accessible scope may include project files, user-readable files, environment variables such as `DASHSCOPE_API_KEY`, Alibaba Cloud credential files readable by that user ...[truncated 165 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `dashscope` to a specifically reviewed version: ```bash python -m pip install "dashscope==REVIEWED_VERSION" ``` 2. Record direct and transitive dependencies in a lock file generated from a trusted environment. 3. Use cryptographic hashes and require hash verification: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Configure pip to use an approved package index and HTTPS certificate validation. 5. Review dependency updates before changing the pinned version, including release notes and dependency diffs. 6. Continue recommending a dedicated virtual environment and explicitly warn users not to install the package with administrator or root privileges. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/api_reference.md:10
• Finding: Unpinned DashScope Dependency in API Reference Installation Instructions<![CDATA[ ## Vulnerability Details **File Location**: `references/api_reference.md:6-11` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash python3 -m venv .venv . .venv/bin/activate python -m pip install dashscope ``` ### Technical Analysis The API reference independently recommends installing `dashscope` without a version constraint or integrity hash. Dependency resolution therefore selects a mutable package release rather than a version that has been reviewed and tested with this Skill. A compromised future release or transitive dependency could run attacker-controlled Python code when installed or imported. Although installation occurs in a virtual environment, Python virtual environments are dependency-isolation mechanisms rather than security sandboxes and do not prevent access to user-readable files, environment variables, or network services. No evidence was found that the currently referenced package is malicious; the issue is the absence of reproducible and integrity-verified dependency resolution. ### Attack Path 1. An attacker publishes or causes distribution of a compromised future dependency release. 2. A user follows the API reference and runs the unpinned installation command. 3. Pip resolves and installs the compromised release because no approved version or hash is required. 4. Malicious code executes during package installation or when the generation scripts import `dashscope`. 5. The malicious dependency accesses resources available to the invoking user or transmits data through available network connections. ### Impact Assessment Exploitation could result in arbitrary code execution under the invoking user's account. Potentially exposed resources include repository content, output files, environment-based API keys, user-readable Alibaba Cloud credentials, and other files available to that account. System-wide compromise would require the installation or scripts to be run with ...[truncated 75 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the mutable installation command with a reviewed, exact version: ```bash python -m pip install "dashscope==REVIEWED_VERSION" ``` 2. Make the API reference point to the same centrally maintained lock file used by the Skill. 3. Pin transitive dependencies and include verified SHA-256 hashes. 4. Install with `--require-hashes` so unexpected artifacts or dependency changes cause installation to fail. 5. Perform dependency vulnerability and provenance checks before approving updates. 6. Avoid privileged installation and retain the dedicated virtual-environment guidance. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (19)

Tainted flow: 'video_url' from os.getenv (line 151, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

def download_video(video_url: str, output_path: Path) -> None:
    output_path.parent.mkdir(parents=True, exist_ok=True)
    with urllib.request.urlopen(video_url) as response:
        output_path.write_bytes(response.read())

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is a generic video-generation integration skill, but the behavior described includes broader actions such as credential discovery, local file handling, media download/storage, and workflow-specific operations not reflected in the declared scope. This mismatch is dangerous because operators may approve or invoke the skill under false assumptions, enabling unexpected side effects and expanding the attack surface for data exfiltration or unauthorized mutations.

Credential Access

High

• Category: Privilege Escalation

Content

if not os.environ.get("DASHSCOPE_API_KEY"):
        print("Error: DASHSCOPE_API_KEY is not set.", file=sys.stderr)
        print("Configure via environment variable, .env file, or ~/.alibabacloud/credentials", file=sys.stderr)
        sys.exit(1)
    
    # Default image prompt if not specified

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

if not os.environ.get("DASHSCOPE_API_KEY"):
        print("Error: DASHSCOPE_API_KEY is not set.", file=sys.stderr)
        print("Configure via environment variable, .env file, or ~/.alibabacloud/credentials", file=sys.stderr)
        sys.exit(1)
    
    # Default image prompt if not specified

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill describes code paths that access environment variables, read credential files, write outputs to disk, and make network calls, but it does not declare any explicit tool/permission scope. This creates an authorization gap where an agent may execute broader capabilities than reviewers or policy controls expect, increasing the risk of credential exposure, unintended file access, or unbounded external requests.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Validation

```bash
mkdir -p output/aliyun-wan-video
python -m py_compile skills/ai/video/aliyun-wan-video/scripts/generate_video.py && echo "py_compile_ok" > output/aliyun-wan-video/validate.txt
```

• Confidence: 84% confidence
• Finding: The skill instructs persistent storage of validation artifacts, task IDs, polling responses, logs, and final video URLs under a shared output directory. Persisting these artifacts can leak sensitive operational metadata, prompts, URLs, and identifiers across sessions or to other users/processes, especially if outputs are retained without access controls or redaction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The reference explicitly states that a local file path supplied as `reference_image` will be auto-uploaded by the SDK, but it does not warn users that this causes network transmission of local content to a third-party service. In an agent or pipeline context, this can lead to unintended exfiltration of sensitive local files if user input or upstream logic passes a local path without clear consent or validation.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The usage example requires a Chinese prompt, and the script later injects Chinese text into generated prompts. This imposes a specific language/locale behavior without user opt-in, which matches the policy-violation category for forced language use.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The manifest describes implementing and documenting DashScope video.generate usage and parameter mapping, but this script also searches ~/.alibabacloud/credentials and imports an API key into the process environment. Credential-file discovery is not an obvious requirement of the narrowly stated skill purpose and adds a capability to access local secrets.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: When --image-prompt is not provided, the script prepends a Chinese phrase to the user's prompt, causing the skill to operate in a specific language without opt-in. This is a natural-language policy issue because the user is not given a choice of language or locale.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This code sends the request prompt, model parameters, and potentially a local reference image path to an external video-generation service via `VideoSynthesis.async_call`, but there is no confirmation prompt or user-facing notice at the point of transmission. Because the operation sends user-supplied content to a network service and may include image input, it meets the code-file missing-warning criteria.

Intent-Code Divergence

Low

• Confidence: 82% confidence
• Finding: The workflow says to confirm whether the operation is read-only or mutating and to run a minimal read-only query first, but the documented skill is specifically for `video.generate` requests and async polling, which are generation-oriented operations rather than query-style reads. This is an active documentation mismatch because it instructs an intent and execution pattern not reflected by the described code paths or API usage in the rest of the file.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The markdown file presents all reference titles in Chinese and does not mention any language option, translation availability, or that the skill is intended only for Chinese-speaking users. Under the policy rule for natural-language violations, this can be considered a forced locale/language choice without user opt-in.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The docstring says the function will 'Generate an image of an Asian beauty,' but the implementation simply sends whatever prompt string it is given to the image model. Since callers may supply arbitrary prompts, the documentation actively overstates and misdescribes the function's actual behavior.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The function creates directories and writes bytes to the output path, but there is no print/log/comment at the write site indicating that a file will be created or overwritten. For a code file, file writes should have some visible disclosure unless clearly warned elsewhere; this script's usage text describes output paths but does not explicitly warn about the write action.

Static analysis

No suspicious patterns detected.