dashscope
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes official Alibaba Cloud DashScope API endpoints (
dashscope.aliyuncs.com) for all multimodal services. - [SAFE]: Secret management follows industry best practices by instructing users to store API keys in environment variables (
.env) and mentioning internal redaction mechanisms (_safe_error) to prevent credential leakage in logs. - [INDIRECT_PROMPT_INJECTION]: The ASR tool (
dashscope_asr) ingests audio data from external public URLs. This constitutes an attack surface where malicious audio content could theoretically attempt to inject instructions into the agent's context via the resulting transcription. This is a characteristic of the underlying cloud API's design rather than a flaw in the skill itself, and the skill includes clear documentation regarding the requirement for public accessibility. - [SAFE]: The skill does not include any arbitrary command execution, local file system manipulation beyond designated output paths, or obfuscated content.
Audit Metadata