ClawHub
Back to skill

Security audit

Alibabacloud Bailian Voice Creator

Security checks for vulnerabilities and agentic risk

Overview

The skill provides Alibaba Cloud voice features, but normal use can automatically install a CLI plugin and create/store cloud API keys without a clear opt-in step.

Review before installing. Prefer setting `DASHSCOPE_API_KEY` manually with least-privilege permissions, avoid granting full Bailian access unless truly needed, and assume audio/text sent through this skill will be processed by Alibaba Cloud. Be aware that first use may modify your Alibaba Cloud CLI setup and create a real API key that can incur charges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"""Auto-install ModelStudio plugin if missing."""
    try:
        print("正在自动安装 ModelStudio 插件...", file=sys.stderr)
        result = subprocess.run(
            ["aliyun", "plugin", "install",
             "--names", "aliyun-cli-modelstudio", "--enable-pre"],
            capture_output=True,
Confidence
85% confidence
Finding
The code automatically installs an external CLI plugin on the user's machine without explicit confirmation. While there is no direct command injection here, silently performing software installation expands the system's trusted code base and creates a supply-chain and unexpected-side-effect risk in the context of an agent skill.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
workspace_id = _get_workspace_id()

    try:
        result = subprocess.run(
            ["aliyun", "modelstudio", "create-api-key",
             "--region", "cn-beijing",
             "--workspace-id", workspace_id,
Confidence
83% confidence
Finding
This command creates a real cloud API key and includes a description parameter that is passed directly to an external CLI. Even though shell injection is avoided by argument-list usage, the more important issue is that the skill can provision credentials and change cloud state automatically, which is risky behavior for an agent helper.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The module description presents the code as local key management and validation, but the implementation also installs plugins and creates/deletes remote cloud API keys. This mismatch can mislead reviewers and users about the true privileges and side effects, increasing the chance of unsafe execution in an agent environment.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
If no key is found, the code automatically creates a new cloud API key and persists it locally without explicit user confirmation. In an agent skill, silent credential provisioning is dangerous because it changes cloud account state, expands access, and may create secrets the user never intended to exist.

Missing User Warnings

Medium
Confidence
77% confidence
Finding
The skill sends user-provided audio URLs and resulting audio content to a third-party ASR service without any explicit privacy notice, consent prompt, or data-handling disclosure. In a voice-processing skill, this increases the risk of unintentionally transmitting sensitive spoken content, especially because long-audio mode requires a publicly accessible file URL.

Static analysis

No suspicious patterns detected.