Bailian Studio

• Outcome: Review
• Latest audit: May 29, 2026 · 9:29 PM UTC
• Version: 0.2.0

Overview

This looks like a legitimate DashScope/Bailian media skill, but it sends local images and text to third-party cloud services without consistently clear prompts or consent in the user-facing flows.

Install only if you are comfortable sending prompts, text, and any local images you select to Alibaba Cloud/DashScope and related OSS storage. Avoid using it on confidential documents or private images unless retention, access control, and deletion behavior are clear, and check whether audio playback can be disabled before using TTS in shared spaces.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation shows access to environment secrets, local file I/O, network access, and shell execution, but no permissions are declared to make those capabilities explicit. This is dangerous because users and hosting platforms cannot accurately assess or constrain what the skill can do, especially given it reads credentials, uploads user-provided files, writes outputs to disk, and invokes ffplay as a subprocess.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose suggests a straightforward DashScope integration, but the documented behavior also includes uploading local images to OSS, persisting generated media locally, and executing ffplay for playback. That mismatch is security-relevant because users may provide sensitive local files or run the skill in restricted environments without realizing data will be transferred to third-party storage or that shell execution will occur.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly states that local images are uploaded to OSS before OCR or image-to-image processing, but it does not clearly warn users that local files will be transmitted to third-party cloud services. This can cause unintended disclosure of sensitive images or metadata, especially if users assume processing is local based on the feature description.

Missing User Warnings

Low

• Confidence: 75% confidence
• Finding: The README says TTS output is played using ffplay, but does not clearly warn that running the feature will produce audible output on the local machine. In shared, recorded, or quiet environments, this may disclose generated content unexpectedly or create operational/safety issues from surprise audio playback.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The OCR usage for local images does not warn that the image will be uploaded to OSS and then sent onward for processing. This creates a privacy and data-handling risk because users may assume a local file path is processed locally when in fact the content leaves the machine and may be stored or exposed through external services.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The image-to-image documentation for local reference images omits that those files are first uploaded to OSS before being processed. In context, this is particularly relevant because reference images may contain personal, proprietary, or regulated content, and the hidden upload step increases the chance of accidental data disclosure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The design explicitly sends user-supplied text to the external Bailian/DashScope TTS service but does not mention any user-facing disclosure, consent, or guidance about privacy-sensitive content. This can lead users or downstream integrators to unknowingly transmit secrets, personal data, or regulated content off-host to a third-party API, creating privacy and compliance risk even though the behavior appears intended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The plan explicitly sends user-provided text to a remote Bailian TTS API but does not require any user-facing disclosure, consent prompt, or warning that the text leaves the local environment. This can cause inadvertent disclosure of sensitive prompts, secrets, or personal data if operators assume the tool is purely local audio synthesis.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: When a user supplies a local file via --image, the script transparently uploads that file to a remote service to obtain a URL for img2img processing. This is a real privacy and data-handling issue because users may reasonably expect a local path to remain local, and the CLI does not provide an explicit warning, confirmation, or disclosure before transmitting potentially sensitive images off-host.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script sends user prompt text and optional reference images to DashScope over the network, but the interface does not clearly warn that user-supplied content leaves the local environment. In a skill context, prompts and images can contain confidential business data, personal data, or regulated content, so silent transmission increases the risk of unintentional disclosure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: When --image is used, the script uploads a local file via upload_image(...) and then sends the resulting image URL to DashScope for OCR processing, but this file provides no user-facing disclosure, confirmation, or consent step about that outbound transfer. In a skill context, users may reasonably expect local OCR or may not realize sensitive documents are being transmitted to third-party services, creating privacy and data-handling risk rather than a memory-safety flaw.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script sends arbitrary user-provided text to Aliyun/DashScope for speech synthesis without any explicit disclosure, warning, or consent flow in the code path. If users provide sensitive prompts, secrets, or regulated data, this can cause unintended third-party data disclosure to an external service.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.