T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:76- Finding
API Key May Be Disclosed Through Configuration Validation Commands
- Content
View full analysis
- Remediation
View remediation
Security audit
Qwen视频智能分析
Security checks for vulnerabilities and agentic risk
Overview
The skill is a video-analysis integration, but its instructions include unsafe API-key handling and unclear disclosure about sending video content to a third-party service.
Review before installing. Use it only for videos you are allowed to send to DashScope, avoid sensitive or private media unless your organization approves that processing, and do not run the documented API-key grep command because it may print the secret. Prefer a pinned dependency version and a secret-presence check that never displays the key.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:68- Finding
DashScope Dependency Is Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
\ --hash=sha256: ``` Install it with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` The version and hash must be populated from a reviewed distribution rather than copied from an untrusted source. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
At L010 the description says 'Use when 需要视频处理、音频编辑、媒体转换、配音生成时使用', implying the skill is suitable for audio editing, media conversion, and dubbing generation. But the rest of the document describes only video analysis and explicitly excludes editing/transcoding at L044 and L154, so the description actively contradicts the stated functionality.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger language is overly broad and overlaps with common media-related requests such as video processing, audio editing, media conversion, and dubbing generation, even though the skill is actually for video analysis. In an agent ecosystem, vague activation criteria can cause the skill to run unexpectedly on unrelated user requests, leading to unintended file access, remote URL handling, or third-party API submission.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description explicitly states "支持中文交互" in a way that frames Chinese as the expected interaction mode, and the document does not offer an opt-in or alternative language choice. For a general-purpose skill, this can violate language/locale policy by effectively forcing a specific language without user selection.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The description does not define clear trigger boundaries and uses ambiguous conditions for when the skill should be invoked. In practice, ambiguous routing can cause accidental execution with local files or remote URLs that the user did not intend to send through this skill, increasing exposure of sensitive media and unnecessary API usage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill supports analyzing remote video URLs through a third-party multimodal API but does not clearly warn that the video content or fetched media may be transmitted to an external service. This creates a meaningful privacy and data-governance risk because users may supply internal, sensitive, or copyrighted video links without informed consent about external processing.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill gives inconsistent secret-handling guidance: earlier sections instruct reading the DashScope API key from local JSON files, while the security section claims keys should be provided via environment variables. Conflicting instructions increase the chance that implementers mishandle credentials, store them in unintended locations, or build unsafe workarounds when the documented method does not match the stated security model.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The feature callouts repeat that the skill covers "中文交互" but do not present this as an optional capability or justified regional limitation. Reiterating a single-language mode in prominent natural-language guidance can steer agents toward a fixed locale even when the user has not requested it.
- Content
Static analysis
No suspicious patterns detected.