dashscope
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill integrates with Alibaba Cloud (Aliyun) DashScope services, which is a well-known cloud service provider. All API interactions are directed to official domains such as dashscope.aliyuncs.com.
- [SAFE]: Credential management follows best practices by requiring the DASHSCOPE_API_KEY to be stored in an .env file rather than being hardcoded. The skill also mentions using a _safe_error() method to redact sensitive information from error messages.
- [INDIRECT_PROMPT_INJECTION]: The skill provides tools that process untrusted data, such as image prompts and text for speech synthesis.
- Ingestion points: Parameters prompt, text, and audio_url defined in SKILL.md take input from user-controlled sources.
- Boundary markers: No explicit delimiters or boundary instructions are defined in the skill documentation to isolate untrusted input.
- Capability inventory: The skill performs network operations to the DashScope API and writes output to the local filesystem via specified output_path parameters.
- Sanitization: The skill implements a _safe_error() method designed to redact sensitive credentials from error messages.
Audit Metadata