ClawHub
Back to skill

Security audit

Alibaba Cloud AI Video Wan Video

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Alibaba DashScope video-generation helper with expected network, credential, upload, and output-file behavior, but users should treat its provider uploads and unpinned dependency carefully.

Install in a dedicated virtual environment, prefer a pinned and reviewed dashscope version, avoid running as root, and pass only prompts and reference images you are comfortable sending to Alibaba DashScope. Treat saved logs, task IDs, generated URLs, images, and videos as potentially sensitive and clean them up when no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:45
Finding

Unpinned DashScope Dependency in Skill Installation Instructions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/api_reference.md:10
Finding

Unpinned DashScope Dependency in API Reference Installation Instructions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (19)

Tainted flow: 'video_url' from os.getenv (line 151, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_video.py (reported line 166)May include surrounding context.

python
def download_video(video_url: str, output_path: Path) -> None:
    output_path.parent.mkdir(parents=True, exist_ok=True)
    with urllib.request.urlopen(video_url) as response:
        output_path.write_bytes(response.read())

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented purpose is a generic video-generation integration skill, but the behavior described includes broader actions such as credential discovery, local file handling, media download/storage, and workflow-specific operations not reflected in the declared scope. This mismatch is dangerous because operators may approve or invoke the skill under false assumptions, enabling unexpected side effects and expanding the attack surface for data exfiltration or unauthorized mutations.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_dancing_video.py (reported line 185)May include surrounding context.

python
if not os.environ.get("DASHSCOPE_API_KEY"):
        print("Error: DASHSCOPE_API_KEY is not set.", file=sys.stderr)
        print("Configure via environment variable, .env file, or ~/.alibabacloud/credentials", file=sys.stderr)
        sys.exit(1)
    
    # Default image prompt if not specified

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_video.py (reported line 187)May include surrounding context.

python
if not os.environ.get("DASHSCOPE_API_KEY"):
        print("Error: DASHSCOPE_API_KEY is not set.", file=sys.stderr)
        print("Configure via environment variable, .env file, or ~/.alibabacloud/credentials", file=sys.stderr)
        sys.exit(1)
    
    # Default image prompt if not specified

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_dancing_video.py (reported line 58)May include surrounding context.

python
def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_dancing_video.py (reported line 61)May include surrounding context.

python
def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_video.py (reported line 57)May include surrounding context.

python
def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_video.py (reported line 60)May include surrounding context.

python
def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill describes code paths that access environment variables, read credential files, write outputs to disk, and make network calls, but it does not declare any explicit tool/permission scope. This creates an authorization gap where an agent may execute broader capabilities than reviewers or policy controls expect, increasing the risk of credential exposure, unintended file access, or unbounded external requests.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill instructs persistent storage of validation artifacts, task IDs, polling responses, logs, and final video URLs under a shared output directory. Persisting these artifacts can leak sensitive operational metadata, prompts, URLs, and identifiers across sessions or to other users/processes, especially if outputs are retained without access controls or redaction.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Validation

bash
mkdir -p output/aliyun-wan-video
python -m py_compile skills/ai/video/aliyun-wan-video/scripts/generate_video.py && echo "py_compile_ok" > output/aliyun-wan-video/validate.txt

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The reference explicitly states that a local file path supplied as reference_image will be auto-uploaded by the SDK, but it does not warn users that this causes network transmission of local content to a third-party service. In an agent or pipeline context, this can lead to unintended exfiltration of sensitive local files if user input or upstream logic passes a local path without clear consent or validation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The usage example requires a Chinese prompt, and the script later injects Chinese text into generated prompts. This imposes a specific language/locale behavior without user opt-in, which matches the policy-violation category for forced language use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest describes implementing and documenting DashScope video.generate usage and parameter mapping, but this script also searches ~/.alibabacloud/credentials and imports an API key into the process environment. Credential-file discovery is not an obvious requirement of the narrowly stated skill purpose and adds a capability to access local secrets.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

When --image-prompt is not provided, the script prepends a Chinese phrase to the user's prompt, causing the skill to operate in a specific language without opt-in. This is a natural-language policy issue because the user is not given a choice of language or locale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code sends the request prompt, model parameters, and potentially a local reference image path to an external video-generation service via VideoSynthesis.async_call, but there is no confirmation prompt or user-facing notice at the point of transmission. Because the operation sends user-supplied content to a network service and may include image input, it meets the code-file missing-warning criteria.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The workflow says to confirm whether the operation is read-only or mutating and to run a minimal read-only query first, but the documented skill is specifically for video.generate requests and async polling, which are generation-oriented operations rather than query-style reads. This is an active documentation mismatch because it instructs an intent and execution pattern not reflected by the described code paths or API usage in the rest of the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The markdown file presents all reference titles in Chinese and does not mention any language option, translation availability, or that the skill is intended only for Chinese-speaking users. Under the policy rule for natural-language violations, this can be considered a forced locale/language choice without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The docstring says the function will 'Generate an image of an Asian beauty,' but the implementation simply sends whatever prompt string it is given to the image model. Since callers may supply arbitrary prompts, the documentation actively overstates and misdescribes the function's actual behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The function creates directories and writes bytes to the output path, but there is no print/log/comment at the write site indicating that a file will be created or overwritten. For a code file, file writes should have some visible disclosure unless clearly warned elsewhere; this script's usage text describes output paths but does not explicitly warn about the write action.

Content

No source excerpt is available for this finding.