ClawHub
Back to skill

Security audit

Human Avatar

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it handles cloud credentials and personal media with endpoint overrides and account mutations that deserve review before installation.

Install only if you intend to send the selected prompts and media to Alibaba Cloud services and your own OSS bucket. Use least-privilege Alibaba credentials, do not set endpoint override variables unless you fully control them, prefer an isolated virtual environment with pinned dependencies, and review the automatic LingMou public-template copy behavior before using it on a production account.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/animate_anyone.py:38
Finding
Authentication credentials can be redirected to attacker-controlled endpoints<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/animate_anyone.py:38, 124-130, 138-176` - `scripts/live_portrait.py:41, 48-63, 96-102` - `scripts/image_to_video.py:32, 37-51, 73-79` - `scripts/portrait_animate.py:15, 19-27, 43-50` - `scripts/text_to_image.py:22, 29-44` - `scripts/avatar_video.py:37-40` **Vulnerability Type**: Unvalidated authentication endpoint override **Risk Level**: High ### Vulnerable Code Representative DashScope implementation: ```python BASE_URL = os.getenv( "DASHSCOPE_BASE_URL", "https://dashscope.aliyuncs.com", ) def _headers(async_mode: bool = False) -> dict: key = os.environ.get("DASHSCOPE_API_KEY") if not key: raise RuntimeError("DASHSCOPE_API_KEY not set") h = { "Authorization": f"Bearer {key}", "Content-Type": "application/json", } if async_mode: h["X-DashScope-Async"] = "enable" return h r = requests.post( f"{BASE_URL}/api/v1/services/aigc/image2video/aa-detect", headers=_headers(async_mode=False), json={"model": "animate-anyone-detect-gen2", "input": {"image_url": image_url}}, timeout=60, ) ``` Representative OSS implementation: ```python auth = oss2.Auth( os.environ["ALIBABA_CLOUD_ACCESS_KEY_ID"], os.environ["ALIBABA_CLOUD_ACCESS_KEY_SECRET"], ) bucket_name = os.environ["OSS_BUCKET"] endpoint = os.environ.get( "OSS_ENDPOINT", "oss-cn-beijing.aliyuncs.com", ) endpoint = endpoint.replace("https://", "").replace("http://", "").rstrip("/") bucket = oss2.Bucket(auth, f"https://{endpoint}", bucket_name) bucket.put_object_from_file(key, local_path) url = bucket.sign_url("GET", key, expires) ``` LingMou has an equivalent configurable endpoint: ```python config = open_api_models.Config( access_key_id=os.environ["ALIBABA_CLOUD_ACCESS_KEY_ID"], access_key_secret=os.environ["ALIBABA_CLOUD_ACCESS_KEY_SECRET"], endpoint=os.environ.get( "LINGMOU_ENDPOINT", "lingmou.cn-beijing.aliyuncs.c ...[truncated 2820 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove production endpoint overrides unless they are strictly required. 2. Validate every configured endpoint before constructing an authenticated client: - Require HTTPS. - Reject embedded user information. - Reject fragments and unexpected query strings. - Reject unexpected ports. - Compare the parsed hostname against an explicit allowlist. 3. Use exact hostname or label-aware suffix checks. Do not use a naïve check such as `host.endswith("aliyuncs.com")` without also verifying the domain boundary. 4. Maintain separate allowlists for each service, for example: - DashScope: approved regional DashScope hosts. - OSS: the expected bucket and regional endpoint. - LingMou: approved regional LingMou hosts. 5. Disable redirects for authenticated API calls, or validate every redirect destination before forwarding authentication headers. 6. Use separate, least-privilege credentials for OSS, DashScope, and LingMou. Do not reuse a broadly privileged Alibaba access key. 7. Update `SECURITY.md` to accurately disclose endpoint configurability and its trust assumptions. 8. Add tests confirming rejection of attacker-controlled domains, suffix-confusion domains, HTTP URLs, userinfo URLs, and unexpected ports. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/animate_anyone.py:60
Finding
Race-prone and predictable temporary files permit local symlink overwrite attacks<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/animate_anyone.py:60-62, 101-109` - `scripts/live_portrait.py:113-114, 125-140, 150-159` - `scripts/image_to_video.py:86-92` **Vulnerability Type**: Unsafe temporary-file handling **Risk Level**: Medium ### Vulnerable Code `animate_anyone.py` obtains temporary pathnames without securely creating the files: ```python dst = tempfile.mktemp(suffix=".jpg", prefix="aa_img_") subprocess.run( [ff, "-y", "-i", src, "-q:v", "2", dst], check=True, capture_output=True, ) ``` ```python dst = tempfile.mktemp(suffix=".mp4", prefix="aa_vid_") cmd = [ ff, "-y", "-i", src, "-c:v", "libx264", "-preset", "fast", "-crf", "22", "-c:a", "aac", "-movflags", "+faststart", ] if vf: cmd += ["-vf", "fps=24"] cmd.append(dst) subprocess.run(cmd, check=True, capture_output=True) ``` Other scripts use deterministic shared `/tmp` names based on user-supplied source names: ```python p = Path(src) dst = f"/tmp/lp_img_{p.stem}.jpg" subprocess.run( [ff, "-y", "-i", src, "-q:v", "2", dst], check=True, capture_output=True, ) ``` ```python dst = f"/tmp/lp_audio_{Path(video_path).stem}.mp3" subprocess.run( [ ff, "-y", "-i", video_path, "-vn", "-ar", "44100", "-ac", "1", "-b:a", "128k", "-t", "180", dst, ], check=True, capture_output=True, ) ``` ```python p = Path(src) dst = f"/tmp/i2v_img_{p.stem}.jpg" subprocess.run( [ff, "-y", "-i", src, "-q:v", "2", dst], check=True, capture_output=True, ) ``` ### Technical Analysis `tempfile.mktemp()` returns an unused pathname but does not atomically create or reserve it. Another local process can create a file or symbolic link at that path between name selection and FFmpeg opening the destination. The deterministic `/tmp` paths are easier to predict because they are based on the source filename. FFmpeg is invoked with `-y`, which enables unconditional output overwrite. If the destinati ...[truncated 1591 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace `tempfile.mktemp()` with an atomic API such as `tempfile.mkstemp()` or `NamedTemporaryFile(delete=False)`. 2. Prefer a private `TemporaryDirectory` created with restrictive permissions for each invocation. 3. Keep all generated paths inside that private directory and use random names rather than names derived from user input. 4. Before invoking FFmpeg, verify that the destination: - Is within the expected temporary directory. - Is not a symbolic link. - Is owned by the current process user. 5. Avoid using `-y` against a path in a shared directory. If overwriting is required, only overwrite a file atomically created and owned by the current process. 6. Ensure cleanup occurs in a `finally` block and remove the entire private temporary directory after use. 7. Run media conversion under an unprivileged service account with access only to required input, output, and temporary directories. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:55
Finding
Unpinned installation instructions expose users to mutable dependency releases<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:55-57` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash pip install requests dashscope oss2 scipy numpy # LingMou extras: pip install alibabacloud-lingmou20250527 alibabacloud-tea-openapi ``` ### Technical Analysis The documented installation procedure retrieves the latest available versions of multiple third-party packages without a lock file, version constraints, or integrity hashes. The effective code installed by these commands can therefore change after the Skill has been reviewed. Python package installation can execute build backends and installation-related code with the privileges of the user running `pip`. Consequently, compromise of a listed upstream package, its publisher account, distribution infrastructure, or an organization-specific package index could convert the documented setup process into an arbitrary code-execution channel. No evidence was found that the named packages are currently malicious. The confirmed weakness is the absence of dependency immutability and integrity verification, not an assertion that a present package is compromised. ### Attack Path 1. An attacker compromises a listed package's publisher account, upstream release pipeline, or package index used by the environment. 2. The attacker publishes a malicious or backdoored release under the expected package name. 3. A user follows the Skill documentation and runs the unpinned `pip install` command. 4. `pip` resolves the attacker's release as the current compatible version. 5. Malicious build or package code executes with the installer's operating-system privileges. 6. The installed package can subsequently run whenever the Skill imports it. A similar path exists where an internal index unintentionally shadows the intended public package with an untrusted distribution. ### Impact Assessment Successful exploitation provides code execution as the ...[truncated 397 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to a reviewed version. 2. Generate a lock file that records transitive dependencies. 3. Require cryptographic hashes for downloaded distributions, for example through a hashed requirements file and `pip install --require-hashes`. 4. Use an authenticated, controlled package repository or mirror with provenance and retention controls. 5. Prefer prebuilt, reviewed wheels and disable unexpected source builds where practical. 6. Install dependencies in an isolated virtual environment under a non-privileged account. 7. Add dependency vulnerability and provenance scanning to release workflows. 8. Review and intentionally update pinned dependencies on a defined schedule rather than resolving new versions during installation. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (49)

Tainted flow: 'url' from os.getenv (line 149, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
url = f"{BASE_URL}/api/v1/tasks/{task_id}"
    start = time.time()
    while time.time() - start < max_wait:
        r = requests.get(url, headers=_headers(), timeout=60)
        r.raise_for_status()
        data = r.json()
        out = data.get("output", {})
Confidence
90% confidence
Finding
The polling URL is built from the same environment-controlled BASE_URL and used with Authorization headers, so task polling can also leak API credentials to an attacker-controlled host. Because this runs repeatedly in a loop, exploitation could result in repeated credential disclosure and exposure of task metadata.

Tainted flow: 'BASE_URL' from os.getenv (line 38, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
Returns output dict with check_pass, bodystyle.
    """
    print(f"\n[step1] aa-detect …")
    r = requests.post(
        f"{BASE_URL}/api/v1/services/aigc/image2video/aa-detect",
        headers=_headers(async_mode=False),
        json={"model": "animate-anyone-detect-gen2", "input": {"image_url": image_url}},
Confidence
90% confidence
Finding
BASE_URL is overrideable via the DASHSCOPE_BASE_URL environment variable and is used to send authenticated API requests with the Bearer token in the Authorization header. If an attacker can influence the environment, they can redirect requests to an attacker-controlled endpoint and capture credentials or sensitive media URLs.

Tainted flow: 'BASE_URL' from os.getenv (line 38, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
Returns template_id str.
    """
    print(f"\n[step2] aa-template-generation …")
    r = requests.post(
        f"{BASE_URL}/api/v1/services/aigc/image2video/aa-template-generation/",
        headers=_headers(async_mode=True),
        json={"model": "animate-anyone-template-gen2", "input": {"video_url": video_url}},
Confidence
90% confidence
Finding
The template-generation request uses the same environment-controlled BASE_URL while attaching authorization credentials and user media references. This creates an SSRF/credential-exfiltration class issue if deployment configuration is compromised or attacker-controlled.

Tainted flow: 'BASE_URL' from os.getenv (line 38, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"input": {"image_url": image_url, "template_id": template_id},
        "parameters": {"use_ref_img_bg": use_ref_img_bg, "video_ratio": video_ratio},
    }
    r = requests.post(
        f"{BASE_URL}/api/v1/services/aigc/image2video/video-synthesis/",
        headers=_headers(async_mode=True),
        json=payload,
Confidence
90% confidence
Finding
As with the other API calls, the generation endpoint is derived from an environment variable and receives authenticated requests. In the context of this skill, that also exposes signed OSS URLs and user content metadata to an attacker-controlled endpoint if BASE_URL is overridden.

Tainted flow: 'url' from os.environ.get (line 79, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
url = f"{BASE_URL}/api/v1/tasks/{task_id}"
    start = time.time()
    while time.time() - start < max_wait:
        r = requests.get(url, headers=_headers(async_mode=False), timeout=30)
        r.raise_for_status()
        data = r.json()
        out = data.get("output", {})
Confidence
90% confidence
Finding
This polling request also uses BASE_URL derived from environment input and includes the same bearer token via _headers(). A maliciously overridden base URL would cause authenticated GET requests to an attacker-controlled server, leaking credentials and task metadata.

Tainted flow: 'endpoint' from os.getenv (line 121, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
payload = {"model": model, "input": inp, "parameters": params}

    print(f"\n[i2v] submit  model={model}  resolution={resolution}  duration={duration}s")
    r = requests.post(endpoint, headers=_headers(async_mode=True), json=payload, timeout=60)
    r.raise_for_status()
    data = r.json()
    task_id = (data.get("output") or {}).get("task_id")
Confidence
90% confidence
Finding
The request target is derived from DASHSCOPE_BASE_URL, an environment-controlled value, and the code sends an Authorization bearer token in headers to that endpoint. If an attacker can influence the environment, they can redirect requests to an arbitrary host and exfiltrate the API key, which is especially sensitive in an agent or multi-tenant runtime.

Tainted flow: 'url' from os.environ.get (line 102, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
start = time.time()
    while time.time() - start < max_wait:
        try:
            r = requests.get(url, headers=_headers(), timeout=30)
            r.raise_for_status()
            data = r.json()
            out = data.get("output", {})
Confidence
90% confidence
Finding
The polling URL is derived from the same environment-controlled base and queried with authenticated headers. An attacker who controls configuration can cause the client to poll an arbitrary server and disclose the API token, while also spoofing task responses to manipulate downstream behavior.

Tainted flow: 'BASE_URL' from os.getenv (line 41, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
Raises ValueError if check fails.
    """
    print(f"\n[step1] liveportrait-detect …")
    r = requests.post(
        f"{BASE_URL}/api/v1/services/aigc/image2video/face-detect",
        headers=_headers(async_mode=False),
        json={"model": "liveportrait-detect", "input": {"image_url": image_url}},
Confidence
90% confidence
Finding
BASE_URL is taken from an environment variable and used directly for authenticated API requests. If an attacker can influence the runtime environment, they can redirect requests carrying the Bearer token to an attacker-controlled host, resulting in credential exfiltration and unauthorized access to the DashScope account.

Tainted flow: 'BASE_URL' from os.getenv (line 41, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"head_move_strength": head_move_strength,
        },
    }
    r = requests.post(
        f"{BASE_URL}/api/v1/services/aigc/image2video/video-synthesis/",
        headers=_headers(async_mode=True),
        json=payload,
Confidence
90% confidence
Finding
This request reuses the environment-controlled BASE_URL while attaching the DashScope API key in the Authorization header. In a hostile deployment context, a modified environment variable can silently redirect both sensitive inputs and credentials to an untrusted endpoint.

Tainted flow: 'url' from os.getenv (line 92, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"input": {"image_url": image_url},
        "parameters": {"ratio": ratio},
    }
    r = requests.post(url, headers=_headers(), json=payload, timeout=120)
    r.raise_for_status()
    data = r.json()
    out = data.get("output", {})
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'url' from os.getenv (line 92, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
},
        "parameters": {"style_level": style_level},
    }
    r = requests.post(url, headers=_headers(async_mode=True), json=payload, timeout=120)
    r.raise_for_status()
    data = r.json()
    task_id = data.get("output", {}).get("task_id")
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'url' from os.getenv (line 92, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
url = f"{BASE_URL}/api/v1/tasks/{task_id}"
    start = time.time()
    while time.time() - start < max_wait:
        r = requests.get(url, headers=_headers(), timeout=60)
        r.raise_for_status()
        data = r.json()
        status = data.get("output", {}).get("task_status")
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'url' from os.getenv (line 40, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
url = f"{BASE_URL}/api/v1/tasks/{task_id}"
    start = time.time()
    while time.time() - start < max_wait:
        r = requests.get(url, headers=_headers(), timeout=30)
        r.raise_for_status()
        data = r.json()
        status = data.get("output", {}).get("task_status", "UNKNOWN")
Confidence
95% confidence
Finding
The request target is derived from DASHSCOPE_BASE_URL, an environment variable, and the code sends the Authorization bearer token on every poll request. If an attacker can influence that environment variable, they can redirect requests to an attacker-controlled host and capture the API key or use the process as an SSRF primitive. In this skill context, the script handles cloud API credentials, which increases the sensitivity of outbound requests.

Tainted flow: 'endpoint' from os.getenv (line 116, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
# Synchronous (wan2.6)
        endpoint = f"{BASE_URL}/api/v1/services/aigc/multimodal-generation/generation"
        print(f"[t2i] sync call  model={model}  size={size}  n={n}")
        r = requests.post(endpoint, headers=_headers(), json=payload, timeout=120)
        r.raise_for_status()
        data = r.json()
        images = []
Confidence
97% confidence
Finding
The synchronous API endpoint is built from DASHSCOPE_BASE_URL and used in a credentialed POST request containing the bearer token. An attacker who controls the environment can redirect this request to a malicious server, exfiltrating the API key and possibly sensitive prompt data. Because this skill is designed to invoke external cloud generation services, misuse of endpoint configuration directly affects credential security.

Tainted flow: 'endpoint' from os.getenv (line 116, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
# Async (wan2.5 and below) — also works for wan2.6
        endpoint = f"{BASE_URL}/api/v1/services/aigc/image-generation/generation"
        print(f"[t2i] async call  model={model}  size={size}  n={n}")
        r = requests.post(endpoint, headers=_headers(async_mode=True), json=payload, timeout=60)
        r.raise_for_status()
        data = r.json()
        task_id = data.get("output", {}).get("task_id")
Confidence
97% confidence
Finding
The asynchronous generation endpoint is also derived from DASHSCOPE_BASE_URL and called with the bearer token in headers. If that environment variable is manipulated, the script can be coerced into posting credentials and user-supplied prompts to an attacker-controlled service, enabling credential theft and SSRF-style abuse. The skill context makes this more dangerous because it is meant to be run with valid cloud credentials.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
该代码块的实际功能范围明显比声明窄。它通过阿里云灵眸 SDK 处理“模板化数字人播报视频”流程，包括模板管理、公共模板复制、文本变量填充、创建视频任务、轮询状态和下载结果。这与声明中的第⑦项基本一致，但完全没有看到 DashScope API 调用，也没有实现前六项所述的图像生成、视频生成、语音合成或人物驱动能力。因此，如果将这段代码视为该技能实现的一部分，其描述对这段代码的实际行为存在显著夸大/不准确之处。虽然代码没有表现出额外未声明的敏感能力，但其主要问题是声明覆盖了七种能力，而本代码仅对应其中一种子能力。

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
该代码块的主功能与声明部分重叠，但范围明显更窄。它是一个 demo_pipeline.py 命令行封装器，只支持 mode=emo、aa、lingmou，并分别转调 portrait_animate.py、animate_anyone.py、avatar_video.py。代码中的参数、校验逻辑和环境变量检查均印证其仅覆盖这三类视频生成流程。声明中提到的 LivePortrait、文生图、图生视频、TTS、以及一条龙 T2I→I2V 等能力，在此代码块中没有任何入口、参数、API 调用或调度痕迹。因此描述对该代码块而言存在显著夸大/不准确，属于描述与实际行为不匹配。

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill documentation does not clearly warn that user-provided text, images, audio, and video may be uploaded to Alibaba Cloud APIs and OSS for processing. This is a meaningful privacy and data-governance issue because users may provide sensitive media or scripts without realizing they are being transmitted to third-party cloud services and potentially stored externally.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises use of environment variables, shell tools, file I/O, and networked APIs, but it does not declare an explicit tool or permission scope. In an agent environment, this weakens least-privilege boundaries and makes it easier for the skill to be granted broader capabilities than are actually necessary, increasing risk from misuse or prompt-injection-driven actions.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger description is very broad and overlaps with common user requests for images, video, avatars, and speech. In an agentic system, overly broad activation criteria can cause accidental invocation of a high-privilege skill, resulting in unintended file handling, network uploads, or external API calls without the user meaning to use this specific workflow.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The conversational examples are phrased as ordinary everyday requests with few limiting conditions, which increases the chance of this skill hijacking generic user intent. Because the skill can process local media and call external cloud services, misrouting a benign request into this workflow can create unwanted data disclosure or unintended charges.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The document instructs users to provide public HTTP/HTTPS URLs for input images and videos, including sensitive human media, but gives no warning that this exposes user content to third-party hosting, network transfer, and potential unintended access. In a skill focused on avatar generation and person imagery, this omission can lead users to disclose personal photos/videos through publicly reachable links without understanding retention, access scope, or privacy consequences.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The example states that local files are automatically converted and uploaded to OSS, but it does not disclose that user images/videos will be transferred to cloud storage before processing. Because this skill handles portraits and body videos, the hidden upload/storage step materially increases privacy risk, especially for users who may assume processing is local or ephemeral.

External Transmission

Medium
Category
Data Exfiltration
Content
- 批量查询播报视频：
  `https://help.aliyun.com/zh/avatar/avatar-application/developer-reference/api-lingmou-2025-05-27-listbroadcastvideosbyid`
- 查询播报模板详情：
  `https://api.aliyun.com/api/LingMou/2025-05-27/GetBroadcastTemplate`
- 列出播报模板：
  `https://api.aliyun.com/api/LingMou/2025-05-27/ListBroadcastTemplates`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
- 批量查询播报视频：
  `https://help.aliyun.com/zh/avatar/avatar-application/developer-reference/api-lingmou-2025-05-27-listbroadcastvideosbyid`
- 查询播报模板详情：
  `https://api.aliyun.com/api/LingMou/2025-05-27/GetBroadcastTemplate`
- 列出播报模板：
  `https://api.aliyun.com/api/LingMou/2025-05-27/ListBroadcastTemplates`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.