Qwen Wan 2.6 Video Generation

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:45 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward DashScope video-generation client; it sends prompts, optional image URLs, and the required API key to Alibaba's declared API, with no hidden persistence or unrelated local access found.

Install only if you are comfortable sending prompts, reference image URLs, and your DashScope API key to Alibaba Cloud DashScope for video generation. Avoid confidential prompts or private image URLs unless your organization allows that provider, and consider adding request timeouts before heavy use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/qwen_wan_client.py:48

Finding

Outbound HTTP Requests Lack Explicit Timeouts

Content

View full analysis

Vulnerability Details

File Location: scripts/qwen_wan_client.py:48-52 and scripts/qwen_wan_client.py:65-68
Vulnerability Type: Unbounded network operations
Risk Level: Medium

Vulnerable Code

python

response = requests.post(
    f"{BASE_URL}/services/aigc/video-generation/video-synthesis",
    headers=headers,
    json=payload
)

python

response = requests.get(
    f"{BASE_URL}/tasks/{task_id}",
    headers=headers
)

Technical Analysis

Both outbound HTTP operations omit the timeout argument. The 600-second deadline in poll_task_status only controls the polling loop; it does not interrupt an individual requests.get call that has stalled. Similarly, task creation can remain blocked inside requests.post.

The requests send data only to the hardcoded HTTPS DashScope endpoint, https://dashscope.aliyuncs.com/api/v1. Sending the API key, prompt, and optional reference-image URL to this declared provider is necessary for the Skill's advertised functionality and does not, by itself, indicate credential exfiltration or excessive privileges.

Attack Path

1. A user invokes text-to-video or image-to-video generation.
2. The Skill opens an HTTPS request to DashScope.
3. A network outage, stalled remote service, or connection-level interference causes the server to accept the connection without completing the response.
4. Because no connect or read timeout is configured, the request can remain blocked.
5. The polling deadline is not reevaluated while execution is blocked inside requests, causing the Skill or hosting Agent worker to become unavailable indefinitely.

Impact Assessment

Exploitation does not grant additional system privileges, expose arbitrary local files, or enable code execution. The primary impact is denial of service against the current Skill invocation and potentially the hosting Agent worker. Repeated blocked invocations could consume ava ...[truncated 54 chars]

Remediation

View remediation

Remediation Suggestions

• Configure explicit connect and read timeouts for every HTTP request, for example:

  python

  REQUEST_TIMEOUT = (5, 30)
  
  response = requests.post(
      f"{BASE_URL}/services/aigc/video-generation/video-synthesis",
      headers=headers,
      json=payload,
      timeout=REQUEST_TIMEOUT,
  )
  
  response = requests.get(
      f"{BASE_URL}/tasks/{task_id}",
      headers=headers,
      timeout=REQUEST_TIMEOUT,
  )
  

• Catch requests.Timeout and requests.ConnectionError, then return a controlled and non-sensitive error.

• If retries are required, use a bounded retry count with exponential backoff and jitter.

• Calculate the remaining overall polling time before each request and ensure that per-request timeouts never exceed that remaining budget.

• Avoid including authorization headers or other sensitive request details in exception logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tainted flow: 'headers' from os.getenv (line 27, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/qwen_wan_client.py (reported line 49)May include surrounding context.

python

}
    }
    
    response = requests.post(
        f"{BASE_URL}/services/aigc/video-generation/video-synthesis",
        headers=headers,
        json=payload

Tainted flow: 'headers' from os.getenv (line 64, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/qwen_wan_client.py (reported line 65)May include surrounding context.

python

while time.time() - start_time < timeout:
        headers = {"Authorization": f"Bearer {DASHSCOPE_API_KEY}"}
        response = requests.get(
            f"{BASE_URL}/tasks/{task_id}",
            headers=headers
        )

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises capabilities that require environment-variable access and outbound network access, but it does not declare any explicit tool scope or permissions. This can lead to overbroad execution in host environments, making it unclear to users and policy engines that the skill will read API credentials and transmit data to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation states that prompts and image URLs are sent directly to the DashScope API, but it does not clearly warn users that their inputs may leave the local environment and be processed by a third party. This creates a privacy and data-governance risk, especially if users provide sensitive prompts, private image URLs, or internal-only references.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Natural-language strings in the module docstring, CLI description, help text, and error messages are all Chinese, with no opt-in or alternative locale support. Per the policy rule, forcing a specific language without user choice can be a language/locale policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/qwen_wan_client.py (reported line 49)May include surrounding context.

python

}
    }
    
    response = requests.post(
        f"{BASE_URL}/services/aigc/video-generation/video-synthesis",
        headers=headers,
        json=payload

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code sends the user-provided prompt and optional image URL to the external DashScope API, which is a data-transmitting network operation covered by the missing-warning rule for code files. Although the file has brief docstrings and prints success/errors, it does not clearly disclose to the user that their content will be sent to a remote third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Reading DASHSCOPE_API_KEY is access to a sensitive credential source, which falls under operations to check for missing warnings in code files. The script raises an error if the variable is absent, but it does not include a user-facing notice or documentation about credential sensitivity, safe setup, or how the key will be used for outbound API authentication.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.