alibabacloud-parse-x

• Outcome: Review
• Latest audit: Oct 9, 2026 · 8:50 AM UTC
• Version: 0.0.1

Overview

This skill is a disclosed Alibaba Cloud document parsing tool that uploads user-provided local files for processing, so users should treat it as a cloud-processing integration rather than a local-only parser.

Install only if you are comfortable sending selected documents, images, spreadsheets, or media to Alibaba Cloud Parse-X under your DashScope account. Avoid using it on secrets, source code, regulated data, or private documents unless your policies allow that transfer, and avoid the unsafe `export $(cat .env | xargs)` setup pattern for API keys.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 381)May include surrounding context.

md

1. Uploads the file via DashScope file service (`POST /compatible-mode/v1/files`, purpose=`data`, with `X-DashScope-Inner-Include-Url: true`)
2. Constructs `oss://bailian/{file-id}` as the file URL — Parse-X resolves this internally via `X-DashScope-OssResourceResolve: enable`
3. Submits the parse/extract task
4. Deletes the uploaded file after processing (`DELETE /compatible-mode/v1/files/{file-id}`)

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 445)May include surrounding context.

Copy the example file and fill in real values:

bash

cp .env.example .env

Edit .env with your DashScope API Key:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 462)May include surrounding context.

Copy the example file and fill in real values:

bash

cp .env.example .env

Edit .env with your DashScope API Key:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The example export $(cat .env | xargs) is unsafe because it can leak or corrupt secret values containing spaces, quotes, or shell metacharacters, and it encourages indiscriminate export of all entries from a file into the shell environment. In shared or logged shell environments, this increases the risk of accidental credential exposure and insecure secret handling.

Content

Scanner excerpt · SKILL.md (reported line 460)May include surrounding context.

bash

# macOS / Linux
source .env
# or
export $(cat .env | xargs)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 471)May include surrounding context.

md

python scripts/parse_x.py parse ./SKILL.md --output markdown

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 491)May include surrounding context.

md

python scripts/parse_x.py parse ./SKILL.md --output markdown

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill exposes capabilities that include environment access, local file read/write, and outbound network calls, but it does not declare an explicit tool scope or permission boundary. In an agent setting, this weakens least-privilege controls and can allow broader-than-expected access to sensitive files, credentials, or remote endpoints if the skill is invoked inappropriately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill accepts local file paths and automatically uploads those files to Alibaba Cloud for processing, but the description does not clearly warn users about this data transfer at the point where the capability is introduced. Users may reasonably believe processing is local, leading to unintentional disclosure of sensitive documents, code, or regulated data to a third-party service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation tells the agent not to use Parse-X for text/code files and to prefer local read_file, but the local development examples explicitly run parse_x.py on ./SKILL.md. That contradiction can cause agents or operators to upload repository files and other text sources to a remote cloud service contrary to the stated safety model, increasing the risk of unintended data disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/parse_x.py (reported line 145)May include surrounding context.

python

url = f"{self.endpoint}/parse/submit"
        try:
            resp = requests.post(url, json=payload, timeout=30, headers=self._headers())
        except requests.ConnectionError as e:
            raise RuntimeError(
                f"Cannot connect to Parse-X endpoint '{self.endpoint}'. "

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/parse_x.py (reported line 169)May include surrounding context.

python

url = f"{self.endpoint}/parse/submit"
        try:
            resp = requests.post(url, json=payload, timeout=30, headers=self._headers())
        except requests.ConnectionError as e:
            raise RuntimeError(
                f"Cannot connect to Parse-X endpoint '{self.endpoint}'. "

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/parse_x.py (reported line 283)May include surrounding context.

python

url = f"{self.endpoint}/parse/submit"
        try:
            resp = requests.post(url, json=payload, timeout=30, headers=self._headers())
        except requests.ConnectionError as e:
            raise RuntimeError(
                f"Cannot connect to Parse-X endpoint '{self.endpoint}'. "

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/parse_x.py (reported line 301)May include surrounding context.

python

url = f"{self.endpoint}/parse/submit"
        try:
            resp = requests.post(url, json=payload, timeout=30, headers=self._headers())
        except requests.ConnectionError as e:
            raise RuntimeError(
                f"Cannot connect to Parse-X endpoint '{self.endpoint}'. "

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

When a local path is provided, the tool silently uploads the file to Alibaba Cloud before parsing. That creates an unintended data exfiltration path for sensitive local documents because users may believe processing is local or may not realize execution causes immediate remote transfer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The workflow states that uploaded files are deleted remotely after processing, but this data-affecting behavior is not surfaced clearly as a user-facing warning. Even if deletion is intended as cleanup, remote creation and deletion of user data should be disclosed so users understand lifecycle, retention assumptions, and potential failure modes if cleanup does not occur.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:451