T08 · Insecure Dependencies
Warning
- Location
SKILL.md:106- Finding
Unpinned DashScope Dependency Allows Execution of Mutable Third-Party Code
- Content
View full analysis
- Remediation
View remediation
Security audit
火一五媒体转写·百炼云 ASR
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed cloud transcription workflow that shares user-approved media with Alibaba Bailian and does not show hidden, destructive, or persistent behavior.
Install only if you are comfortable sending recordings through a public share URL to Alibaba Bailian for cloud transcription. Confirm sensitive recordings before upload, keep DASHSCOPE_API_KEY in the environment only, use short-lived share links, and prefer a pinned dashscope dependency in an isolated environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs use of network access, environment variables, and file output behavior, but it does not declare any explicit tool scope or allowed-tools/permissions boundary in the metadata. That creates an authorization ambiguity: an agent may execute sensitive actions more broadly than intended, increasing the chance of unintended data exfiltration, misuse of credentials, or writing files without clear policy constraints.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
该清单将单个模型名“Paraformer”作为独立触发别名，但未限定必须是请求执行转写、调用本技能或使用百炼云的上下文。仅凭该词就可能在用户讨论 ASR 模型、做方案比较或引用文档时触发本 skill，触发范围不够具体。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly instructs users to expose local media through a public URL and then submit that URL to a third-party transcription provider, but it does not provide a clear privacy warning, consent requirement, retention notice, or guidance about sensitive content. This creates a real risk of unintended disclosure of audio/video data, especially because recordings often contain personal, confidential, or regulated information and the public URL may be accessible beyond the intended service.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 62% confidence
- Finding
文件标题、描述和操作说明均固定为中文，且未看到显式说明可根据用户偏好切换交互语言或输出语言。对于面向通用用户可调用的 skill，这种默认单一语言表述可能与“应提供语言选择或明确限定适用对象”的政策要求不一致。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language instructions in this file are entirely in Chinese, which can impose a language constraint on users. There is no indication that Chinese is optional, user-selected, or required for a region-specific compliance reason, so this appears to violate the language/locale policy described in the audit rules.
- Content
Static analysis
No suspicious patterns detected.