dashscope
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and implementation examples for DashScope multimodal services using legitimate Alibaba Cloud endpoints.
- [CREDENTIALS_UNSAFE]: The instructions advocate for secure credential management by using environment variables (.env) and explicitly warn against logging or exposing the DASHSCOPE_API_KEY, which aligns with industry security standards.
- [EXTERNAL_DOWNLOADS]: The skill documents the use of official Alibaba Cloud API endpoints (aliyuncs.com) for its core functionality. These are well-known service domains and represent standard operational behavior for the stated purpose.
- [INDIRECT_PROMPT_INJECTION]: Although the ASR functionality processes external content via an audio URL, this is a required feature for the service. The documentation outlines standard asynchronous processing and status polling, presenting no unusual security risks in its design.
Audit Metadata