Qwen Wan 2.6 Video Generation

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:45 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward DashScope video-generation client; it sends prompts, optional image URLs, and the required API key to Alibaba's declared API, with no hidden persistence or unrelated local access found.

Install only if you are comfortable sending prompts, reference image URLs, and your DashScope API key to Alibaba Cloud DashScope for video generation. Avoid confidential prompts or private image URLs unless your organization allows that provider, and consider adding request timeouts before heavy use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/qwen_wan_client.py:48
• Finding: Outbound HTTP Requests Lack Explicit Timeouts## Vulnerability Details **File Location**: `scripts/qwen_wan_client.py:48-52` and `scripts/qwen_wan_client.py:65-68` **Vulnerability Type**: Unbounded network operations **Risk Level**: Medium ### Vulnerable Code ```python response = requests.post( f"{BASE_URL}/services/aigc/video-generation/video-synthesis", headers=headers, json=payload ) ``` ```python response = requests.get( f"{BASE_URL}/tasks/{task_id}", headers=headers ) ``` ### Technical Analysis Both outbound HTTP operations omit the `timeout` argument. The 600-second deadline in `poll_task_status` only controls the polling loop; it does not interrupt an individual `requests.get` call that has stalled. Similarly, task creation can remain blocked inside `requests.post`. The requests send data only to the hardcoded HTTPS DashScope endpoint, `https://dashscope.aliyuncs.com/api/v1`. Sending the API key, prompt, and optional reference-image URL to this declared provider is necessary for the Skill's advertised functionality and does not, by itself, indicate credential exfiltration or excessive privileges. ### Attack Path 1. A user invokes text-to-video or image-to-video generation. 2. The Skill opens an HTTPS request to DashScope. 3. A network outage, stalled remote service, or connection-level interference causes the server to accept the connection without completing the response. 4. Because no connect or read timeout is configured, the request can remain blocked. 5. The polling deadline is not reevaluated while execution is blocked inside `requests`, causing the Skill or hosting Agent worker to become unavailable indefinitely. ### Impact Assessment Exploitation does not grant additional system privileges, expose arbitrary local files, or enable code execution. The primary impact is denial of service against the current Skill invocation and potentially the hosting Agent worker. Repeated blocked invocations could consume ava ...[truncated 54 chars]
• Remediation: ## Remediation Suggestions - Configure explicit connect and read timeouts for every HTTP request, for example: ```python REQUEST_TIMEOUT = (5, 30) response = requests.post( f"{BASE_URL}/services/aigc/video-generation/video-synthesis", headers=headers, json=payload, timeout=REQUEST_TIMEOUT, ) response = requests.get( f"{BASE_URL}/tasks/{task_id}", headers=headers, timeout=REQUEST_TIMEOUT, ) ``` - Catch `requests.Timeout` and `requests.ConnectionError`, then return a controlled and non-sensitive error. - If retries are required, use a bounded retry count with exponential backoff and jitter. - Calculate the remaining overall polling time before each request and ensure that per-request timeouts never exceed that remaining budget. - Avoid including authorization headers or other sensitive request details in exception logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tainted flow: 'headers' from os.getenv (line 27, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

}
    }
    
    response = requests.post(
        f"{BASE_URL}/services/aigc/video-generation/video-synthesis",
        headers=headers,
        json=payload

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.getenv (line 64, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

while time.time() - start_time < timeout:
        headers = {"Authorization": f"Bearer {DASHSCOPE_API_KEY}"}
        response = requests.get(
            f"{BASE_URL}/tasks/{task_id}",
            headers=headers
        )

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises capabilities that require environment-variable access and outbound network access, but it does not declare any explicit tool scope or permissions. This can lead to overbroad execution in host environments, making it unclear to users and policy engines that the skill will read API credentials and transmit data to an external service.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation states that prompts and image URLs are sent directly to the DashScope API, but it does not clearly warn users that their inputs may leave the local environment and be processed by a third party. This creates a privacy and data-governance risk, especially if users provide sensitive prompts, private image URLs, or internal-only references.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Natural-language strings in the module docstring, CLI description, help text, and error messages are all Chinese, with no opt-in or alternative locale support. Per the policy rule, forcing a specific language without user choice can be a language/locale policy violation unless the locale constraint is explicitly justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

}
    }
    
    response = requests.post(
        f"{BASE_URL}/services/aigc/video-generation/video-synthesis",
        headers=headers,
        json=payload

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code sends the user-provided prompt and optional image URL to the external DashScope API, which is a data-transmitting network operation covered by the missing-warning rule for code files. Although the file has brief docstrings and prints success/errors, it does not clearly disclose to the user that their content will be sent to a remote third-party service.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: Reading DASHSCOPE_API_KEY is access to a sensitive credential source, which falls under operations to check for missing warnings in code files. The script raises an error if the variable is absent, but it does not include a user-facing notice or documentation about credential sensitivity, safe setup, or how the key will be used for outbound API authentication.

Static analysis

No suspicious patterns detected.