T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:66- Finding
DashScope API Key May Be Exposed Through Standard Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Analyze Video By Qwen Free
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches a Qwen video-analysis purpose, but its credential-check instructions can print the user's DashScope API key and it adds under-scoped outbound behavior.
Install only after fixing the API-key check so it reports presence without printing the secret, clarifying exactly where credentials are stored, removing or tightly scoping callback_url, and making the third-party upload of local videos explicit. Avoid using sensitive, confidential, copyrighted, or regulated videos until those disclosures and controls are in place.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:58- Finding
Unpinned Third-Party Package Installation Creates a Mutable Supply-Chain Boundary
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill sends local video content to the DashScope remote API for analysis, but the markdown does not clearly warn users that local files will leave the device and be processed by a third-party service. This is a significant privacy and data-governance issue, especially for sensitive or copyrighted media, because users may reasonably assume 'local file input' means local-only processing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says to use the skill whenever the user needs video processing, audio editing, media conversion, or dubbing generation. This scope is far broader than the documented capability of basic local video analysis, making activation boundaries unclear and increasing the risk of unintended invocation for unrelated media tasks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description explicitly states '支持中文交互' while the document does not offer users a language choice or indicate that Chinese is optional. This can violate language/locale policy expectations when a skill appears to constrain interaction language without opt-in.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill is described as a local-file video analysis tool with no remote URL analysis, yet it exposes a callback_url parameter for asynchronous notifications. Even if not overtly malicious, this expands network behavior beyond the stated purpose and can be used to transmit metadata or results to external endpoints, undermining user expectations about a local-input workflow.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
A callback URL is not necessary for the core task of analyzing a local video and returning the result to the invoking agent. Adding a user-supplied outbound destination introduces unnecessary external communication that could enable data exfiltration, SSRF-style behavior, or unauthorized disclosure of analysis results and file-derived metadata.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation presents conflicting authentication guidance: earlier sections say the API key must only be read from a local config file and must never be accepted from chat input, but later '快速指引' instructs users to configure an API key via environment variables. This inconsistency can cause agents or users to supply secrets through less-controlled channels than intended, increasing the chance of credential exposure or accidental propagation into logs and subprocess environments.
- Content