Security audit

Qwen视频智能分析

Security checks across malware telemetry and agentic risk

Overview

This video-analysis skill has a coherent purpose, but its API-key handling, broad activation text, and third-party media transfer disclosure need review before installation.

Install only after reviewing the skill carefully. Use it only for videos you are comfortable sending to Alibaba Cloud DashScope/Qwen, avoid sensitive or internal URLs, do not run commands that print API keys, and prefer a single well-protected secret source with clear file permissions or environment-variable handling.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill gives conflicting guidance for secret handling: earlier sections instruct reading the DashScope API key from a local JSON file, while the security section claims keys are provided via environment variables. This inconsistency is dangerous because operators may store credentials in less protected locations or implement the skill incorrectly, increasing the chance of secret exposure and weakening security controls.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document claims command execution is restricted to a whitelist, but the skill declares the exec tool and provides shell command examples without defining any actual whitelist or enforcement mechanism. This can mislead reviewers and users into assuming command execution is constrained when, in practice, an agent may run broader commands than intended, creating command injection or arbitrary execution risk in an exec-enabled skill.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The invocation description is broad and ambiguous, mixing unrelated media-processing use cases with video analysis and lacking clear boundaries for when the skill should activate. Overly permissive activation criteria can cause an agent to invoke an exec-capable, networked skill in contexts not intended by the user, increasing the chance of unsafe data handling or unnecessary external transmission.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The manifest and description do not provide concrete trigger phrases or operational constraints, despite the skill having read, write, and exec capabilities plus third-party API use. Without precise invocation constraints, an orchestrating agent may route loosely related requests to this skill, exposing local files or remote content to analysis workflows that the user did not specifically intend.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill description says it uses the Qwen multimodal model but does not clearly warn, at the point of invocation, that local video contents and remote URLs are sent to a third-party API service. This is dangerous because users and routing agents may not realize sensitive media or internal URLs will leave the local environment, creating privacy, confidentiality, and compliance risks.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.