ClawHub
Back to skill

Security audit

qwen-delegation

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Qwen CLI delegation guide, with some install and data-sharing precautions users should understand.

Install qwen-cli in an isolated environment, avoid elevated installs, verify the package source/version yourself, and only include files you intend to share with the Qwen service.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:49
Finding

Unpinned Third-Party Qwen CLI Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 49
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
# Install Qwen CLI
pip install qwen-cli

Technical Analysis

The installation command retrieves the latest available qwen-cli package from pip's configured package index without specifying an audited version, cryptographic hash, lockfile, verified publisher, or trusted repository. Consequently, the installed code can change after this skill has been reviewed.

Python package installation may execute package-controlled build or installation logic. A compromised publisher account, malicious package release, dependency confusion involving a configured private index, or unexpected upstream update could therefore result in arbitrary code execution during installation or subsequent CLI use.

This finding does not establish that qwen-cli is malicious. The risk arises from the non-reproducible and insufficiently verified dependency acquisition process.

Attack Path

  1. An attacker compromises the package publisher, package-index account, distribution channel, or a higher-priority package source configured on the user's system.
  2. The attacker publishes a malicious or backdoored package version under the resolved package name.
  3. A user follows the documented prerequisite and runs pip install qwen-cli.
  4. Pip resolves and downloads the attacker-controlled release because no trusted version or hash is specified.
  5. Malicious installation/build logic executes, or the installed qwen command executes the payload when later invoked.
  6. The payload operates with the privileges of the user performing the installation or running the CLI.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the installing user's privileges. Depending on that user's access, the payload could read or modify project f ...[truncated 282 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a specifically reviewed version rather than installing the latest release.
  • Use a requirements or lock file containing cryptographic hashes, and install with hash enforcement such as pip install --require-hashes.
  • Document the verified official package publisher and trusted package index.
  • Review the pinned distribution and its transitive dependencies before approval.
  • Install the CLI in a dedicated virtual environment or another isolated, least-privilege environment.
  • Avoid elevated installation and execution unless explicitly required.
  • Establish a controlled update process in which new versions are reviewed, tested, and repinned before adoption.

T08 · Insecure Dependencies

Warning
Location
modules/qwen-specifics.md:36
Finding

Repeated Unpinned Third-Party Qwen CLI Installation Guidance

Content
View full analysis

Vulnerability Details

File Location: modules/qwen-specifics.md, line 36
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown
- Install: `pip install qwen-cli`

Technical Analysis

The troubleshooting guidance repeats the instruction to install qwen-cli without a fixed version, cryptographic hash, lockfile, verified publisher, or trusted index restriction. This creates the same non-reproducible supply-chain exposure as the primary installation instructions.

Because package contents and resolved dependencies may change over time, a package version installed after the skill audit is not necessarily the version that was implicitly assessed. Package-controlled build logic or a malicious installed CLI can execute code locally.

This finding identifies an unsafe dependency-management practice and does not assert that the referenced package is currently malicious.

Attack Path

  1. An attacker gains control over a relevant package release, publisher account, dependency, or higher-priority configured package source.
  2. A malicious release is made available under the package name resolved by pip.
  3. A user encountering installation trouble follows the troubleshooting command.
  4. Pip retrieves the attacker-controlled package because the command imposes no version or integrity constraint.
  5. The payload executes during installation or when the installed Qwen CLI is invoked.
  6. Execution occurs within the security context of the installing or invoking user.

Impact Assessment

Exploitation could lead to arbitrary user-level code execution and compromise of files, credentials, environment variables, source code, and tools accessible to that user. The impact may be broader if installation is performed in a privileged or shared Python environment, though elevated installation is not explicitly recommended by the project.

Remediation
View remediation

Remediation Suggestions

  • Replace the command with a pinned and reviewed package version.
  • Provide a hash-locked dependency file and require integrity verification during installation.
  • State the verified official package source and publisher.
  • Recommend a dedicated virtual environment and least-privilege installation.
  • Keep troubleshooting instructions synchronized with the hardened primary installation procedure.
  • Require security review and compatibility testing before updating the pinned version.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest declares triggers such as "qwen", "cli", and "delegation", plus a free-form condition about when large-context batch processing is needed. Terms like "cli" and "delegation" are broad and could overlap with many unrelated requests, while the activation condition does not clearly define boundaries or exclusions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.