ClawHub
Back to skill

Security audit

Wan 2.6 & 2.5 — AI Video & Image Generation by Alibaba

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but its image script can automatically use an undeclared Google provider and send prompts or local images there.

Review this before installing if your environment has a GEMINI_API_KEY or strict provider allowlists. Use explicit provider selection, avoid sensitive prompts or private media unless you approve third-party processing, and remember Atlas API usage is billed to the configured account.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_image.py:56
Finding

Undocumented Automatic Google Provider Can Transmit Local Images

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/generate_image.py:309
Finding

API-Controlled Output URLs Are Downloaded Without Validation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

There is a material description-behavior mismatch. The description presents a broad Wan video-and-image generation skill centered on Alibaba Wan 2.6/2.5, with multiple video modalities and video-specific controls. The supplied code chunk only implements image generation/editing workflows and file upload/model listing, with Atlas Cloud and Google AI Studio providers. It does not generate, edit, transform, upload, or download videos, and contains no logic for duration, resolution, camera shots, audio guidance, or prompt expansion. The code’s actual primary purpose is image generation/editing, not the declared video-heavy multimodal Wan skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The code substantially matches part of the description: it does support text-to-video, image-to-video, video-to-video, audio input, local file upload, model listing, polling, and downloading outputs through Atlas Cloud. However, the declared purpose is broader than the actual implementation. The script only targets video workflows via the /model/generateVideo endpoint and saves video outputs; there is no separate image-generation or image-editing path, no text-to-image endpoint, and no photo editing logic. Many claimed features such as prompt expansion, multi/single camera shot support, 1080p/15-second constraints, and support for 18 model variants are not directly implemented in code—they may be pass-through API parameters at best, but are not evidenced here. Because the description explicitly says to use the skill for generating/editing images and photos, while the code only implements video-related operations, this is a material description/behavior mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The trigger text is extremely broad and could cause the skill to activate for generic image, video, marketing, or visual-content requests that may not specifically require this third-party integration. Because the skill sends prompts and media to an external paid API, over-triggering raises risks of unnecessary data disclosure, unexpected charges, and users unknowingly routing content to a third party.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares access to environment secrets and makes outbound network calls, but does not explicitly scope or constrain those capabilities with a permissions/allowed-tools declaration. In a skill that handles a billing-enabled API key and transmits user prompts and media to a third-party service, missing tool scoping increases the chance of unintended secret access or broader-than-expected external communication.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This workflow explicitly sends prompts and authorization credentials to a third-party API and may upload user media for processing. In context, external transmission is expected for the feature, but it remains security-relevant because it exposes potentially sensitive user content and uses an account-wide billing key.

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

bash
# Step 1: Submit
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This workflow explicitly sends prompts and authorization credentials to a third-party API and may upload user media for processing. In context, external transmission is expected for the feature, but it remains security-relevant because it exposes potentially sensitive user content and uses an account-wide billing key.

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

bash
# Step 1: Submit
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This example sends an image URL, prompt, and API credential to an external service for image-to-video generation. Even though that is the intended function, user-supplied media may contain sensitive or proprietary content, so automatic transmission to a third party has privacy and billing implications.

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

Image-to-Video Example (Wan 2.6)

bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

Video-to-video processing transmits source video URLs and prompts to a third-party API, which can expose sensitive recordings or proprietary media. Because video content often carries more identifying or confidential information than text alone, the context makes external transmission more sensitive here.

Content

Scanner excerpt · SKILL.md (reported line 311)May include surrounding context.

Video-to-Video Example (Wan 2.6)

bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

Audio-guided generation transmits audio URLs and prompts externally, which may reveal copyrighted, confidential, or personal audio content. The inclusion of additional media types broadens the privacy surface and increases the chance that users unintentionally share sensitive data.

Content

Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.

Audio-Guided Generation Example (Wan 2.6)

bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This text-to-image example still sends user prompts and the authorization token to a third-party service, which can leak sensitive prompt content or incur charges. Although lower risk than direct media upload, prompts may still contain confidential business, personal, or regulated information.

Content

Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.

Text-to-Image Example (Wan 2.6)

bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateImage" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

Image editing requires sending one or more source images to the remote API, which creates a direct privacy and confidentiality exposure for user-provided media. Because edited images may be personal photos or proprietary assets, this external transfer is materially security-relevant even if intentional.

Content

Scanner excerpt · SKILL.md (reported line 357)May include surrounding context.

Image Editing Example (Wan 2.6)

bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateImage" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The flash image-to-video example also transmits user image content and prompts to the external provider. The faster or cheaper model variant does not reduce the underlying privacy and billing risk associated with sending user media off-platform.

Content

Scanner excerpt · SKILL.md (reported line 371)May include surrounding context.

Image-to-Video Flash Example (Wan 2.6)

bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a skill for generating both AI videos and images, including text-to-image and image editing across Wan 2.5/2.6 variants. This file only supports listing models, uploading media, submitting to a /model/generateVideo endpoint, polling video predictions, and downloading returned outputs; there is no image-generation or image-editing implementation here.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

md
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 51)May include surrounding context.

python
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_video.py (reported line 41)May include surrounding context.

python
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The docstring says the script supports text-to-video, image-to-video, video-to-video, and local file upload, which can imply local files are accepted directly as generation inputs. In the implemented CLI, generate only accepts --image, --video, and --audio as URL strings, while local files must be uploaded separately via the upload command first.

Content

No source excerpt is available for this finding.