Security audit

Alibabacloud Video Forge

Security checks across malware telemetry and agentic risk

Overview

This Alibaba Cloud video-processing skill is mostly purpose-aligned, but it needs Review because it can automatically create cloud resources, recursively delete OSS objects, and broadly import environment variables from shell files.

Install only if you are comfortable granting Alibaba Cloud credentials that can process media, list and delete OSS objects, and possibly create MPS pipelines. Use least-privilege RAM policies, avoid broad OSS delete permissions unless cleanup is required, prefer explicit --pipeline-id values, review any --force deletion command carefully, and avoid running the skill against sensitive media or shell profiles containing unrelated secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code scans generic shell startup files and, once any target variable is present, imports every parsed KEY=VALUE from that file into the process environment. This broad ingestion can pull in unrelated secrets or sensitive configuration far beyond the stated MPS purpose, increasing secret exposure within the skill runtime and to any downstream code.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The file-level documentation says only specified target variables are loaded, but the implementation actually loads all variables from any file that contains at least one target key. That mismatch is dangerous because reviewers and users may believe the loader is narrowly scoped when it can import unrelated secrets from ~/.env or shell profiles.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script goes beyond discovery/selection and will create new MPS pipelines when none match, which is an infrastructure-modifying action not clearly aligned with the stated skill behavior. In an agent context, this can cause unintended resource provisioning, billing impact, and configuration drift when a caller expects a read/select helper for video workflows.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The module docstring advertises listing and auto-selection, but the implementation also performs pipeline creation. This documentation/behavior mismatch is dangerous because downstream agents or users may treat the script as non-mutating and invoke it in contexts where creating cloud resources is not authorized or expected.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This skill is described as a video-processing workflow, but the file implements a standalone destructive OSS deletion utility with broad object-removal capability. That scope mismatch is dangerous because an agent or user invoking the skill for media operations could be induced to delete arbitrary objects or operational data unrelated to the intended workflow.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The code supports recursive bulk deletion of all objects under any supplied prefix, which is an administrative storage operation rather than a normal media-processing action. Even with confirmation prompts, this enables mass destructive actions if misused, scripted with --force, or run under overly privileged credentials.

Context-Inappropriate Capability

Critical

Confidence: 99% confidence
Finding: The safety check explicitly recognizes and still permits deletion of an entire bucket's contents when the prefix is empty, '/' or '/*', especially when force is used. In the context of a video-processing skill, enabling full-bucket wipe capability is highly dangerous because it can irreversibly destroy all stored media and related assets far beyond any legitimate workflow need.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The script generates a presigned download URL for every uploaded object, creating a temporary access capability that may expose uploaded media to unintended parties if logged, returned to callers, or otherwise mishandled. In this skill context, upload is expected, but download-link generation is a separate access-expansion feature not clearly required for the stated workflow, so it increases the attack surface and risk of data leakage.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The guide recommends `aliyun configure list` and `--log-level=debug` for troubleshooting without warning that these outputs may reveal configuration details, request metadata, or sensitive authentication material in terminals, CI logs, shell history, or shared support transcripts. In an agent-driven or automation context, this increases the chance of credential leakage because logs are often persisted and broadly accessible.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The document lists credential-verification and cloud-query commands without clearly warning that they run against the user's active Alibaba Cloud account and can disclose account configuration, regions, pipelines, and other resource metadata. In an agent-skill context, this can normalize indiscriminate probing of cloud resources and increase the chance of unintended information exposure, even if the commands are read-only.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The content-audit examples instruct users to submit media to a remote moderation service but do not warn that uploaded videos, images, or audio may contain personal, confidential, or regulated data. In a video-processing skill, this omission can cause users to send sensitive media off-platform without informed consent or appropriate compliance review, creating privacy and data-governance risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The end-to-end workflow chains upload, remote processing, listing, and local download operations without an upfront notice that it transfers data to cloud services and writes output files to the local filesystem. That can lead users to unintentionally exfiltrate sensitive media to remote infrastructure and create local artifacts on shared or insecure machines.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The function reads user environment files and mutates the current process environment without an operation-site warning or explicit consent. In a skill context, this can surprise users and silently ingest sensitive data from personal shell files, making the behavior riskier than a narrowly scoped configuration loader.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script accepts a user-supplied public URL or OSS object and submits it to Alibaba Cloud MPS for remote processing without clearly warning that the referenced media location and contents will be transmitted to a third-party cloud service. In this skill context, that behavior is expected functionally, but the lack of an explicit privacy/data-transfer notice can still cause unintended disclosure of sensitive internal URLs, signed URLs, or private media assets.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The API-facing ensure_pipeline function silently creates a pipeline if none exists, without requiring explicit confirmation from the caller at the point of use. In automation, this can be triggered unintentionally, leading to unauthorized provisioning, unexpected charges, and policy violations under the caller's cloud credentials.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.