Alibabacloud Video Translation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:01 AM UTC
• Version: 0.0.1

Overview

This cloud video translation skill is coherent, but it needs review because its setup and output handling are broader than the stated task and could expose user media if used carelessly.

Review before installing. Use a dedicated least-privileged Alibaba Cloud RAM user, restrict OSS permissions to specific input/output buckets, avoid root account keys, prefer temporary credentials, and treat videos, subtitles, credentials, and signed URLs as sensitive. Do not enable broad auto plugin installation unless you accept the supply-chain risk, and only send non-confidential media unless your organization permits Alibaba Cloud processing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/cli-installation-guide.md:40

Finding

Unverified Installation of Mutable CLI, Plugins, and Python Dependencies

Content

View full analysis

= 3.3.1 | STOP, see [cli-installation-guide.md](references/cli-installation-guide.md) | | Credential status | `aliyun configure list` | Valid status | STOP, guide configuration | | Plugin installation | `aliyun configure set --auto-plugin-install true` | Set | Auto-set | ``` Python packages are version-pinned but are installed without package hashes: ```text # Video Translation Script Dependencies # Install: pip3 install -r requirements.txt alibabacloud_tea_openapi==0.3.4 alibabacloud_credentials==0.3.5 alibabacloud_tea_util==0.3.4 alibabacloud_openapi_util==0.1.1 ``` ### Technical Analysis HTTPS protects packages in transit under normal conditions, but it does not establish artifact-level integrity against a compromised CDN, package repository, publisher account, DNS path, or signing infrastructure. The CLI URL uses a mutable `latest` filename, so the installed executable can change after the Skill has been reviewed. The downloaded `aliyun` binary is moved into `/usr/local/bin` using administrative privileges. A substitu ...[truncated 2101 chars]

Remediation

View remediation

aliyun-cli-linux-amd64.tgz" | sha256sum --check - ``` 3. Prefer vendor-provided signed release manifests and verify signatures using a pinned, independently obtained public key. 4. Extract archives into a temporary directory and inspect the expected file type and archive paths before installation. 5. Avoid enabling automatic plugin installation globally. Install only explicitly required plugins at pinned versions and verify their integrity. 6. Use a hash-locked requirements file containing hashes for all direct and transitive dependencies, and install it with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 7. Perform installation in an isolated virtual environment rather than the system Python environment. 8. Run the CLI and Python script under a dedicated, least-privileged account with narrowly scoped RAM permissions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/video_translation.py:95

Finding

Output URL Validation Allows Arbitrary Hosts and Plaintext HTTP

Content

View full analysis

str: """ Validate HTTP URL format (for video translation API). Args: url: URL to validate param_name: Parameter name for error messages Returns: Validated URL Raises: ValidationError: If URL format is invalid """ if not url: raise ValidationError(f"{param_name} cannot be empty") # Check for dangerous characters dangerous_chars = ['`', '$', '|', ';', '&', '<', '>', '\n', '\r'] for char in dangerous_chars: if char in url: raise ValidationError(f"{param_name} contains invalid character: {repr(char)}") # Must be http or https if not url.startswith("http://") and not url.startswith("https://"): raise ValidationError(f"{param_name} must start with 'http://' or 'https://'") try: parsed = urlparse(url) if not parsed.netloc: raise ValidationError(f"{param_name} invalid URL: missing host") return url except Exception as e: raise ValidationError(f"{param_name} invalid URL format: {e}") ``` The accepted value is used directly in the authenticated translation request: ```python elif args.command == "submit-translation": # input-file can be OSS URL or media ID (alphanumeric) if args.input_file.startswith("oss://") or args.input_file.startswith("http"): args.input_file = validate_oss_url(args.input_file, "--input-file") # Otherwise treat as media ID (validated by API) args.output_url = validate_http_url(args.output_ur ...[truncated 2887 chars]

Remediation

View remediation

.oss-.aliyuncs.com/ ``` 4. Compare the hostname against a strict allowlist derived from the selected region and explicitly approved bucket names. 5. Reject URL user information, fragments, unexpected ports, malformed percent encoding, and empty object paths. 6. Validate bucket names and object paths separately before constructing the URL. Prefer constructing the final OSS URL from trusted components instead of accepting a complete arbitrary URL. 7. Apply the same HTTPS and hostname restrictions to `--subtitle-url` where external subtitle URLs are not explicitly required. 8. Add tests covering arbitrary domains, HTTP URLs, user-info URLs, unexpected ports, mixed-case schemes, encoded host confusion, and valid OSS URLs. 9. Retain server-side destination validation and least-privileged OSS policies so jobs can write only to explicitly approved output buckets and prefixes. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence

Findings (24)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

| User explicitly specifies | Use user's path |
| User does not specify | Use default path and inform user |

**Default Output Rules**:
- Bucket: Same bucket as input video
- Directory: Same directory as input video
- Filename: `{source}_translated_{random8}.mp4`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

md

| [workflow-details.md](references/workflow-details.md) | Detailed execution flow for 4 scenarios |

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence

Finding

The skill clearly instructs the agent to perform networked and cloud-side operations such as OSS uploads, media registration, job submission, polling, and signed URL generation, yet it declares no explicit tool scope or allowed-tools boundary. That creates an authorization ambiguity where an agent may be permitted to perform external actions without a least-privilege declaration or user-visible capability boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill tells the agent to upload local videos to OSS and submit them for translation, but it does not prominently warn that user media will be transmitted to Alibaba Cloud and processed by third-party services. This is a privacy and consent issue because videos may contain sensitive personal, business, or regulated data, and users may not realize local files are leaving their machine.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md

| `NeedSpeechTranslate` | Always | **MUST ask** | None | DO NOT infer from input |
| `NeedFaceTranslate` | Always | **Fixed value** | `false` | DO NOT set to true |
| `DetextArea` | User chooses erasure | **MUST ask** | None | DO NOT set to Auto arbitrarily |
| `SubtitleConfig` | User chooses burn-in | **Can use default** | Standard style | DO NOT skip confirmation |
| `TextSource` | Scenario decides | **Scenario rules** | See scenario mapping | DO NOT choose arbitrarily |
| `CustomSrtType` | Scenario 4 | **MUST ask** | None | DO NOT infer arbitrarily |
| `OutputConfig.MediaURL` | Output path | **Can use default** | Default rules | DO NOT use shell variables |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation recommends generating signed URLs for private OSS objects but does not warn that these links are shareable bearer tokens that grant temporary access to the object. In a skill that processes user media, this omission can lead operators to expose sensitive video, subtitle, or translated output to unintended parties through copied logs, chat transcripts, or screenshots.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 45)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 58)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 71)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide instructs users to pass access keys directly on the command line and elsewhere export secrets as environment variables, but it does not clearly warn that shell history, process listings, CI logs, and shared terminal sessions may expose those credentials. In an agent skill context, this is more dangerous because users may copy-paste commands into automated environments where secrets can be retained or surfaced unintentionally.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 118)May include surrounding context.

md

1. Log in to Aliyun Console: https://ram.console.aliyun.com/
2. Navigate to: AccessKey Management
3. Create a new AccessKey pair
4. Save the secret immediately — it's only shown once

### Configuration Modes

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 404)May include surrounding context.

bash

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill manifest describes a video translation skill focused on subtitle extraction, translation, and speech synthesis translation. This guide instructs users to install arbitrary Aliyun product plugins and explore unrelated service commands such as ECS, VPC, RDS, and FC, which expands into general cloud administration capabilities outside the stated purpose.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/troubleshooting.md (reported line 233)May include surrounding context.

md

- DO NOT auto-switch to subtitle translation mode
- DO NOT assume user's choice
- DO NOT skip user confirmation

### 3.3 Standard Inquiry

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow instructs the agent to output extracted subtitle content directly to the user without an explicit disclosure warning or confirmation step about revealing potentially sensitive spoken or on-screen text. If the source video contains personal, confidential, or regulated content, verbatim subtitle display increases the chance of unnecessary data exposure in the chat transcript.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Requiring the agent to display extracted subtitle content 'as-is' removes any opportunity for minimization, redaction, or contextual confirmation before disclosure. In a video translation skill, subtitles may capture names, contact details, internal discussions, or other sensitive data from speech or on-screen text, making verbatim output riskier in this context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to inspect configured credentials and later generate signed URLs for private objects, but it does not include safeguards against exposing credential details or sharing time-limited access links too broadly. Even if the commands are legitimate, they touch sensitive account access and can produce links that bypass normal access controls for the validity period.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

L256-L262 maps top to Y=0.15 and bottom to Y=0.85, but L214 in the same file defines Y as 0=bottom, 1=top, which would make 0.15 near the bottom and 0.85 near the top. This is an active contradiction in the documentation that could cause users or agent code to place subtitles in the wrong location.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The subtitle extraction examples set "lang":"ch" directly, which imposes a specific language choice in user-facing command templates. The file later documents other supported language values, but these example commands do not invite user choice or note that the language should be selected based on the source media.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The translation command templates hard-code SourceLanguage as zh and TargetLanguage as en, which enforces a specific language/locale pair in natural-language-facing examples. Because the document presents these as ready-to-use templates, it should make language selection explicit rather than defaulting users into one pair.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The sample config sets "language": "en", which implicitly steers users toward a fixed language choice. The document does not indicate that this is optional or that users may select a different locale, so it can conflict with a policy requiring language choice or opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The workflow explicitly checks credentials and generates signed URLs for private bucket outputs, but does not require notifying the user about privacy implications, temporary access semantics, or who can access the generated result link. This can lead to unintentional disclosure or mishandling of sensitive media outputs, especially when users assume the process is entirely private or local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code file contains multiple natural-language docstrings and inline comments in Chinese while other user-facing help text is in English. For a general-purpose skill, this creates an implicit locale/language constraint without offering the user a language choice or documenting that the skill is intended only for Chinese-speaking operators.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.