Skills
Navigate
skills/cinience/alicloud-skills/aliyun-wan-image/Gen Agent Trust Hub

aliyun-wan-image

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external data including text prompts and image URLs provided by the user through the script parameters.\n
  • Ingestion points: prompt and reference_image/reference_images parameters in scripts/generate_image.py.\n
  • Boundary markers: None present in the multimodal prompt construction.\n
  • Capability inventory: Local file writes (image persistence) and network operations (API calls and downloads).\n
  • Sanitization: Inputs are passed directly to the official SDK without explicit sanitization.\n- [EXTERNAL_DOWNLOADS]: The execution script downloads generated image files from remote URLs returned by the DashScope API. These downloads target Alibaba Cloud's established infrastructure (aliyuncs.com) and are required for the skill's primary function.\n- [SAFE]: The utility script accesses standard local credential storage paths, including ~/.alibabacloud/credentials and .env, to retrieve the DASHSCOPE_API_KEY. This is consistent with standard authentication practices for Alibaba Cloud services and the official SDK.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 02:43 AM