Alibabacloud Bailian Image Creator

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 0.0.1

Overview

This skill does image tasks through Alibaba Cloud, but first use can change your cloud and CLI setup by creating, storing, recycling, or deleting DashScope API keys and installing a CLI plugin.

Install only if you are comfortable letting this skill use your Alibaba Cloud CLI profile to manage DashScope API keys and potentially install the ModelStudio CLI plugin. Prefer a dedicated least-privilege RAM user or a manually supplied DASHSCOPE_API_KEY, verify plugin installation yourself, and avoid sending confidential images unless Alibaba Cloud processing in the configured region is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""Auto-install ModelStudio plugin if missing."""
    try:
        print("Auto-installing ModelStudio plugin...", file=sys.stderr)
        result = subprocess.run(
            ["aliyun", "plugin", "install",
             "--names", "aliyun-cli-modelstudio", "--enable-pre"],
            capture_output=True,

• Confidence: 91% confidence
• Finding: result = subprocess.run( ["aliyun", "plugin", "install", "--names", "aliyun-cli-modelstudio", "--enable-pre"], capture_output=True, text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

_delete_cloud_api_key(orphan_id)

    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "create-api-key",
             "--region", "cn-beijing",
             "--workspace-id", workspace_id,

• Confidence: 87% confidence
• Finding: result = subprocess.run( ["aliyun", "modelstudio", "create-api-key", "--region", "cn-beijing", "--workspace-id", workspace_id, "--description

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

}

    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "delete-api-key",
             "--region", "cn-beijing",
             "--api-key-id", api_key_id,

• Confidence: 84% confidence
• Finding: result = subprocess.run( ["aliyun", "modelstudio", "delete-api-key", "--region", "cn-beijing", "--api-key-id", api_key_id, "--user-agent", "A

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module header claims to handle local API key storage and retrieval, but the implementation also installs plugins and creates/deletes remote cloud API keys. This mismatch is dangerous because it hides materially more powerful behavior than the description suggests, undermining informed consent and security review.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script sends user-provided images and editing instructions to Alibaba Cloud's remote DashScope API, which can expose sensitive local image contents or prompt data to a third party without any explicit warning, consent flow, or data-handling notice. In this skill context, support for local file paths and base64 image uploads increases the risk because users may unknowingly transmit private files off-host.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The function sends user-supplied local images, converted to Base64, to a third-party remote API but provides no explicit consent flow, warning, or privacy notice before transfer. In a skill that processes local files, this creates a real data exposure risk because users may not realize sensitive images are leaving the local environment and being sent to an external service.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The code hard-codes the DashScope Beijing-region endpoint, removing user choice and obscuring where data will be processed. This is security-relevant because it can cause unintentional cross-border or noncompliant data transfer, especially when the tool uploads local images that may contain sensitive information.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The functions accept user-supplied remote URLs and local file:// paths and pass them to an external model API, which can cause unintended disclosure of sensitive local files or private images to a third party. In an agent/skill context, this is more dangerous because callers may treat local paths as local-only processing, while the implementation silently transfers that content off-host.

VirusTotal

57/57 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.