Alibabacloud Maxframe Video Frame Pipeline

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:31 AM UTC
• Version: 0.0.1

Overview

The skill is purpose-aligned for Alibaba Cloud video/image pipelines, but it has review-worthy risks around reusable cloud credentials, unsafe path handling, and unguarded table overwrites.

Install only after reviewing the scripts against your cloud security requirements. Use dedicated, least-privilege OSS and ODPS identities; prefer short-lived or prefix-scoped read-only credentials for AI FUNC image fetches; do not point VIDEO_INPUT_TABLE, FRAME_OUTPUT_TABLE, or OUTPUT_TABLE at shared production tables; and add canonical path checks plus explicit overwrite/truncate confirmation before running on real datasets.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/image_labeling_minimal.py:47

Finding

Reusable OSS credentials are delegated to the managed inference service

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/frame_extraction_minimal.py:55

Finding

Prefix-only OSS path validation permits traversal outside the mounted root

Content

View full analysis

/../../target-file ``` passes `startswith(f"{OSS_ROOT}/")`. After replacement, it becomes: ```text /../../target-file ``` Filesystem normalization can resolve this outside the intended OSS mount. Although `subprocess.run` uses an argument list and therefore avoids shell metacharacter injection, it still passes the traversed path to `ffprobe` and `ffmpeg`. Using unrestricted `str.replace` is also weaker than removing exactly one validated leading prefix. This implementation contradicts the Skill’s stated requirement that resolved paths remain under the declared input prefix. ### Attack Path 1. An attacker obtains permission to insert or modify rows in `VIDEO_INPUT_TABLE`, or compromises an upstream manifest-producing process. 2. The attacker inserts a `video_path` that begins with `OSS_ROOT/` but contains ...[truncated 1174 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/build_video_meta.py:108

Finding

Unconditional truncation can erase an unrelated ODPS table

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill contains contradictory security guidance: it forbids emitting OSS access keys, then later requires inline access_key_id and access_key_secret for AI FUNC image fetches. This inconsistency can cause generated code to propagate long-lived credentials into job code, logs, notebooks, or tables, creating a direct secret-exposure path and undermining the earlier safety rule.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill describes capabilities that inherently touch environment variables, local/file reads, and shell-driven ffmpeg execution, but it declares no explicit tool scope or permission boundary. In an agent setting, missing scope declarations increase the chance that the runtime grants broader access than necessary, weakening least-privilege controls and making misuse or accidental overreach harder to prevent or audit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The markdown instructs the agent to pass OSS access keys inline to ContentPart.image(..., storage_options=...) without an explicit warning about the sensitivity of those credentials or constraints on where they may appear. In practice, this encourages secret material to be embedded in generated code and possibly exposed through logs, prompts, notebooks, code review, or artifact retention.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The verification section reinforces the same insecure credential pattern by requiring inline OSS credentials for image fetches, normalizing secret embedding as a compliance condition for outputs. Because this appears in a verification checklist, it is especially dangerous: downstream generators may treat secret inlining as mandatory and reproduce the pattern consistently across produced jobs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document repeatedly states that the script 'creates if missing, then truncates' the destination ODPS table and later says it 'truncates before writing,' but it does not present this as a prominent destructive-operation warning at setup time. In an operational skill, that can lead users to point the job at an existing shared table and unintentionally erase production data, especially because this Stage 0 script is meant to be run manually or on schedulers outside stronger pipeline guardrails.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This is a markdown file, so SQP-2 applies to omitted warnings in the skill description. The document instructs users to execute md.to_odps_table(..., overwrite=True) and elsewhere explains that JPEGs are written under <OSS_ROOT>/frames/..., but it does not clearly warn that running this flow modifies storage and may overwrite existing table contents.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented code derives local_video_path by string replacement and then passes it to ffprobe/ffmpeg without first verifying that video_path actually starts with OSS_ROOT/. If an attacker or malformed input supplies a path outside the intended OSS prefix, the job may read unexpected mounted files or process unintended tenant data, which is especially risky in a data pipeline that shells out to local-file tools over a shared mount.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/frame_extraction_minimal.py (reported line 70)May include surrounding context.

python

video_dir, video_name = video_path.rsplit("/", 1)
            video_basename = video_name.rsplit(".", 1)[0]

            probe = subprocess.run(
                [
                    "ffprobe", "-v", "error",
                    "-show_entries", "format=duration",

Tainted flow: 'local_video_path' from os.environ (line 61, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/frame_extraction_minimal.py (reported line 70)May include surrounding context.

python

video_dir, video_name = video_path.rsplit("/", 1)
            video_basename = video_name.rsplit(".", 1)[0]

            probe = subprocess.run(
                [
                    "ffprobe", "-v", "error",
                    "-show_entries", "format=duration",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 87% confidence

Finding

The ffmpeg call processes attacker-influenced media paths and writes output files under a shared mount with -y overwrite enabled. While this is not shell injection, ffmpeg is a complex native parser with a long history of parser bugs, and untrusted input combined with file-writing behavior can lead to denial of service, unsafe overwrites, or exploitation if the runtime is not isolated.

Content

Scanner excerpt · scripts/frame_extraction_minimal.py (reported line 88)May include surrounding context.

python

if not math.isfinite(duration) or duration <= 0:
                raise ValueError("invalid_duration")

            ff = subprocess.run(
                [
                    "ffmpeg", "-y",
                    "-i", local_video_path,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script runs ffmpeg via subprocess and uses the -y flag, which forces overwriting generated frame files under the mounted OSS path. While this behavior is part of frame extraction, there is no explicit warning in comments or the docstring that external tools will execute and write or overwrite files in shared storage.

Content

No source excerpt is available for this finding.

Tainted flow: 'local_video_path' from os.environ (line 61, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 83% confidence

Finding

Untrusted video-derived paths are fed into ffmpeg, a native binary that parses complex media formats and writes derived files. Even without shell injection, this expands the attack surface to parser vulnerabilities and resource exhaustion, especially in a driving-video pipeline that may ingest large amounts of externally sourced footage.

Content

Scanner excerpt · scripts/frame_extraction_minimal.py (reported line 88)May include surrounding context.

python

if not math.isfinite(duration) or duration <= 0:
                raise ValueError("invalid_duration")

            ff = subprocess.run(
                [
                    "ffmpeg", "-y",
                    "-i", local_video_path,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script reads long-lived OSS access keys from environment variables and passes them inline via storage_options to a remote inference path so another service can fetch the images. This expands the trust boundary and creates credential exposure risk through service-side logging, debugging, misconfiguration, or unintended reuse; in an ADAS/driving-image pipeline, those credentials may also grant broad access to sensitive image buckets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The labeling and embedding calls send image URLs and associated driving-scene data to a remote model inference service, but the script provides no runtime warning, consent gate, or data-classification check. In this skill context, the images may contain roadway scenes, license plates, faces, location-linked telemetry, or proprietary fleet data, so silent external transmission can violate privacy, contractual, or data-sovereignty requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

md.to_odps_table(result, OUTPUT_TABLE, overwrite=True).execute() performs a destructive write that can replace existing table contents. There is no confirmation prompt or user-facing warning immediately before this irreversible operation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The manifest narrows the skill to video/image pipelines and explicitly says 'Not for audio'. The rest of the file consistently focuses on video/image processing, but references to in-car/cabin/dashcam workflows could encompass media sources containing audio without any explicit exclusion or stripping behavior; this is a mild intent ambiguity rather than a code-backed expansion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents required environment variables including access keys and secrets such as ODPS_ACCESS_KEY and OSS_ACCESS_KEY_SECRET, but it does not warn users that these are sensitive credentials that must be stored securely and not logged or shared. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors affecting user data, privacy, or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The code accesses ODPS credentials directly from environment variables, which is a sensitive operation under the missing-warning criteria for code files. Although the module docstring lists the required variables, it does not warn that credential material will be consumed to authenticate against external services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.