Alibabacloud Bailian Voice Creator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:34 AM UTC
• Version: 0.0.2

Overview

This voice-processing skill does expected ASR/TTS work, but it can automatically change Alibaba Cloud tooling and create persistent API keys, so it belongs in Review before installation.

Install only if you are comfortable letting the skill use your Alibaba Cloud CLI profile to manage DashScope credentials. Prefer providing an existing DASHSCOPE_API_KEY and manually installing any required Alibaba CLI plugin after review; avoid using signed or private audio URLs unless you accept that they may appear in logs and be sent to DashScope.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: scripts/api_key.py:64

Finding

Automatic Installation of an Unpinned Pre-release CLI Plugin

Content

View full analysis

bool: """Auto-install ModelStudio plugin if missing.""" try: result = subprocess.run( ["aliyun", "plugin", "install", "--names", "aliyun-cli-modelstudio", "--enable-pre"], capture_output=True, text=True, timeout=60 ) if result.returncode == 0: return True return False except (subprocess.TimeoutExpired, FileNotFoundError): return False def check_aliyun_cli() -> bool: """Check if Alibaba Cloud CLI and ModelStudio plugin are available, auto-install plugin if missing.""" if not _check_aliyun_binary(): return False try: result = subprocess.run( ["aliyun", "modelstudio", "version"], capture_output=True, text=True, timeout=5 ) if result.returncode == 0: return True except (subprocess.TimeoutExpired, FileNotFoundError): pass if not _install_modelstudio_plugin(): return False try: result = subprocess.run( ["aliyun", "modelstudio", "version"], capture_output=True, text=True, timeout=5 ) return result.returncode == 0 except (subprocess.TimeoutExpired, FileNotFoundError): return False ``` ### Technical Analysis The Skill automatically installs `aliyun-cli-modelstudio` when the plugin is unavailable. The installation uses `--enable-pre`, allowing pre-release components, and does not pin a specific version, verify a checksum, validate a package signature, or request transaction-specific user approval. This behavior exceeds the minimum privileges necessary for ASR or TTS. A voice-processing request ...[truncated 1482 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/api_key.py:247

Finding

API-key Retrieval Silently Creates and Persists a Cloud Credential

Content

View full analysis

str: """ Retrieve the DashScope API Key. Priority: 1. Alibaba Cloud CLI config ~/.aliyun/config.json current profile's dashscope.api_key 2. Environment variable DASHSCOPE_API_KEY 3. Auto-create via Alibaba Cloud CLI and save to config """ if ALIYUN_CONFIG_FILE.exists(): try: config = _read_aliyun_config() profile = _get_current_profile(config) if profile: dashscope = profile.get("dashscope", {}) api_key = dashscope.get("api_key") if api_key: return _validate_api_key( api_key, f"Alibaba Cloud CLI config ({ALIYUN_CONFIG_FILE})" ) except Exception as e: print( f"Warning: Failed to read Alibaba Cloud CLI config: {e}", file=sys.stderr ) api_key = os.environ.get("DASHSCOPE_API_KEY") if api_key: return _validate_api_key(api_key, "environment variable") if check_aliyun_cli(): print( "No existing API Key found. Auto-creating via Alibaba Cloud CLI...", file=sys.stderr ) try: api_key_value, api_key_id = generate_api_key() save_api_key_to_config(api_key_value, api_key_id=api_key_id) print( "API Key auto-created and saved to Alibaba Cloud CLI config", file=sys.stderr ) return _validate_api_key(api_key_value, "auto-created") except RuntimeError as e: print( f"Warning: Failed to auto-create API Key: {e}", file=sys.stderr ) ``` The c ...[truncated 2605 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/speech_recognition.py:40

Finding

Potentially Sensitive Audio URLs Are Logged in Full

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/speech_recognition.py:87

Finding

Remote Result and Audio URLs Are Fetched Without Destination or Size Validation

Content

View full analysis

str: response = requests.get( url, headers={ "User-Agent": "AlibabaCloud-Agent-Skills/alibabacloud-bailian-voice-creator" }, timeout=30 ) if response.status_code != 200: raise Exception(f"Download failed: {response.status_code}") audio_data = response.content ``` ### Technical Analysis The code fetches URLs without validating their scheme, hostname, port, resolved IP address, redirect destinations, response content type, or maximum response size. The ASR result fetch also lacks an explicit timeout and reads the complete response into memory. Under normal operation, the URLs originate from DashScope. Therefore, no malicious exfiltration endpoint was identified in the reviewed project. However, a compromised API response, manipulated test double, malicious caller of `download_audio()`, or unexpected redirect could cause the Agent to access internal network resources. Reading entire responses into memory also permits resource exhaustion. Simple hostname allowlisting alone ...[truncated 1329 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (34)

Tainted flow: 'api_key' from os.environ.get (line 118, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/speech_recognition.py (reported line 123)May include surrounding context.

python

print("Recognizing short audio...")
    print(f"Audio URL: {file_url}")
    
    response = requests.post(
        "https://dashscope.aliyuncs.com/api/v1/services/audio/asr/transcription",
        headers={
            "Authorization": f"Bearer {api_key}",

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

md

brew install ffmpeg

# Ubuntu/Debian
sudo apt update && sudo apt install ffmpeg

# Windows (Chocolatey)
choco install ffmpeg

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The front-matter description says the skill may auto-manage DashScope API keys and auto-install the Alibaba Cloud CLI plugin, but it does not prominently warn that this can create, recycle, or delete cloud credentials and alter the local toolchain. Because this disclosure appears in a short summary, users may invoke the skill without understanding that it can make account-side and environment-side changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file states that the instructions value "must be in Chinese" for qwen-tts and repeats this requirement elsewhere, which imposes a language constraint on users. Because the skill does not offer opt-in, alternatives, or a clearly framed policy exception, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This section again instructs that style-control input must be provided in Chinese, enforcing a specific language rather than allowing user preference. The file does not provide an opt-in choice or explain a narrowly justified locale restriction beyond the model behavior note.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The documentation instructs use of sudo apt update && sudo apt install ffmpeg, which normalizes privileged package installation as part of skill setup. In agent-assisted contexts, privileged commands are risky because they can change system state broadly and, if executed automatically or copied blindly, increase the blast radius of mistakes or compromised package sources.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

md

brew install ffmpeg

# Ubuntu/Debian
sudo apt update && sudo apt install ffmpeg

# Windows (Chocolatey)
choco install ffmpeg

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section documents automatic CLI-based API key creation and deletion, including commands that interact with cloud account resources, without a strong warning banner or consent gate. In context, this is more dangerous because the same skill also encourages automatic retrieval and lifecycle management of credentials, so an invocation could unexpectedly create or destroy usable API keys tied to the user's cloud account.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger guidance uses very broad everyday phrases like 'Generate a voice clip for me' and 'Convert this text to speech' without scope limits, exclusions, or consent boundaries. In an agent ecosystem, this can cause over-triggering and unintended invocation on ambiguous requests, increasing the chance that the skill performs networked actions, dependency installation, or credential management when the user did not explicitly ask for those side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file documents ASR requests that submit user audio references to a remote DashScope endpoint using an authorization token. The description does not include any warning that audio content and related metadata are transmitted to a third-party service, which is a privacy-relevant behavior for markdown under the missing user warnings rule.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-docs.md (reported line 27)May include surrounding context.

Request Example:

bash

curl --location 'https://dashscope.aliyuncs.com/api/v1/services/audio/asr/filetrans' \
    -H 'X-DashScope-Async: enable' \
    -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
    -H 'Content-Type: application/json' \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-docs.md (reported line 69)May include surrounding context.

Task Result Query:

bash

curl --location 'https://dashscope.aliyuncs.com/api/v1/tasks/{task_id}' \
    -H "Authorization: Bearer $DASHSCOPE_API_KEY"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The note and parameter description state that the instruct value must be in Chinese, which is a language-policy constraint in natural language. The file does not offer user choice, opt-in, or a justification for why only Chinese is accepted, so it constitutes a locale/language policy violation under the stated rules.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file applies to SQP-2, and it describes processing meetings, interviews, and customer service calls while recommending emotion recognition and filler-word filtering. Those behaviors can affect user privacy and analysis of sensitive personal data, but the document does not include any warning or disclosure about consent, sensitive audio content, or privacy implications.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/api_key.py (reported line 52)May include surrounding context.

python

def _check_aliyun_binary() -> bool:
    """Check if Alibaba Cloud CLI binary is installed."""
    try:
        result = subprocess.run(
            ["aliyun", "version"],
            capture_output=True,
            text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill automatically installs a CLI plugin and enables pre-release content without prior confirmation. In an agent/skill context, silent modification of the user's development environment is risky because it expands trust to external code and can surprise users with persistent system changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The printed status and error messages in this section are hardcoded in Chinese, which imposes a specific language on users without opt-in or fallback. This is a natural-language policy issue because the skill does not offer locale selection or document a justified region-specific language constraint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 89% confidence

Finding

This code automatically installs and enables an Alibaba Cloud CLI plugin by running a package-management style command without explicit user confirmation. That modifies the user's local toolchain and trusts external package sources at runtime, which can lead to unwanted environment changes or execution of unreviewed code if the plugin source or CLI environment is compromised.

Content

Scanner excerpt · scripts/api_key.py (reported line 67)May include surrounding context.

python

"""Auto-install ModelStudio plugin if missing."""
    try:
        print("正在自动安装 ModelStudio 插件...", file=sys.stderr)
        result = subprocess.run(
            ["aliyun", "plugin", "install",
             "--names", "aliyun-cli-modelstudio", "--enable-pre"],
            capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/api_key.py (reported line 88)May include surrounding context.

python

if not _check_aliyun_binary():
        return False
    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "version"],
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/api_key.py (reported line 101)May include surrounding context.

python

if not _check_aliyun_binary():
        return False
    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "version"],
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/api_key.py (reported line 123)May include surrounding context.

python

RuntimeError: When unable to retrieve the workspace ID
    """
    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "list-workspaces",
             "--region", "cn-beijing",
             "--user-agent", "AlibabaCloud-Agent-Skills/alibabacloud-bailian-voice-creator"],

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/api_key.py (reported line 142)May include surrounding context.

python

workspaces = data.get("workspaces", [])
        if not workspaces:
            raise RuntimeError(
                "No Bailian Workspace found. Please create one in the console first:\n"
                "  https://bailian.console.aliyun.com/"
            )
        return workspaces[0]["workspaceId"]

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 84% confidence

Finding

This command creates a real cloud API key and passes a description value directly as a CLI argument. While using a list avoids shell injection, the more important security issue is that the function performs privileged credential creation as part of normal execution flow, increasing the chance of unintended credential provisioning and persistence if called without explicit user approval.

Content

Scanner excerpt · scripts/api_key.py (reported line 177)May include surrounding context.

python

workspace_id = _get_workspace_id()

    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "create-api-key",
             "--region", "cn-beijing",
             "--workspace-id", workspace_id,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

When no key is found, the code automatically creates a new cloud API key and writes it into ~/.aliyun/config.json without explicit warning or consent. This is a sensitive credential-management action that creates persistent secrets and may incur privilege or billing consequences, making it especially dangerous in an agent skill that may run with minimal user visibility.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/api_key.py (reported line 366)May include surrounding context.

python

}

    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "delete-api-key",
             "--region", "cn-beijing",
             "--api-key-id", api_key_id,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comment and string literal explicitly require the instructions value to be in Chinese, and the script does not offer any user choice or opt-in for language/locale behavior. This creates a natural-language policy issue because the skill forces a specific language in its operational instructions rather than allowing user selection or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.