Tianshu Wan Video

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:24 PM UTC
• Version:
  1.0.0

Overview

This skill is a straightforward DashScope video-generation helper, with expected use of a DashScope API key and outbound requests to Alibaba’s API.

Before installing, make sure you are comfortable providing a DashScope API key and sending prompts or image URLs to Alibaba DashScope. Use a dedicated key if possible, monitor quota or costs, and avoid submitting confidential prompts or private image URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares required environment variables but does not declare permissions despite clearly needing both environment access and outbound network access to call DashScope. This creates a transparency and policy-enforcement gap: platforms or users may approve the skill without understanding that it can read secrets and transmit data externally.

VirusTotal

64/64 vendors flagged this skill as clean.