Qinglong

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:07 PM UTC
• Version: 0.1.1

Overview

This skill is a real Qinglong panel administration helper, but it handles powerful credentials and destructive admin APIs with weak safety guidance.

Review before installing. Use this only against a Qinglong panel you control, prefer HTTPS, avoid pasting long-lived admin credentials, redact tokens and environment-variable values from logs, and require explicit confirmation before deleting, changing, running, importing, updating, or executing shell commands.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:28

Finding

Administrative credentials and bearer tokens transmitted over plaintext HTTP

Content

View full analysis

","password":""}' \ "http:///api/user/login" ``` ```bash curl -s "http:///open/auth/token?client_id=&client_secret=" ``` The same insecure transport convention is used throughout `SKILL.md:63-156` and `api-reference.md:3-6,250-273`, including requests carrying bearer tokens and administrative data. ### Technical Analysis The Skill consistently documents Qinglong Panel communication over unencrypted HTTP. The login request transmits the username and password in cleartext at the transport layer. The alternative authentication flow also places the client ID and client secret in a URL query string. After authentication, bearer tokens are sent over the same plaintext channel. An attacker capable of observing or modifying traffic between the Agent and the panel can recover credentials or tokens. Query-string credentials may additionally be retained in web-server access logs, reverse-proxy logs, monitoring systems, browser history, or command history. This risk is especially significant because the token is described as having complete operational permissions. The accessible APIs include environment-variable access, script management, task execution, dependency management, system configuration, data import/export, panel updates, and shell-command execution. The pre-scan warning about `curl|bash` is not confirmed. At `api-reference.md:250-273`, HTTP responses are piped into local Python JSON parsers, not into Bash or another shell for remote payload execution. ### Attack Path 1. A user supplies credentials for a panel exposed over a local, corporate, wireless, container, or other shared network. 2. The Skill follows the documented workflow and sends ...[truncated 1325 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:28

Finding

Unsafe construction of shell commands from user-supplied connection and request values

Content

View full analysis

","password":""}' \ "http:///api/user/login" ``` A second generic command template appears at `SKILL.md:63-67`: ```bash curl -s -X \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '' \ "http:///api/" ``` ### Technical Analysis The Skill instructs the Agent to substitute user-provided values directly into Bash command templates. These values can include the panel host, username, password, token, JSON request body, environment-variable values, script names, paths, notification contents, and other administrative input. No requirement is provided to validate URLs, construct an argument array, escape shell metacharacters, or serialize JSON through a proper JSON encoder. Substitution into single-quoted JSON is unsafe when a value contains an apostrophe. Substitution into a double-quoted URL is unsafe if an implementation fails to neutralize shell expansions such as command substitution. Newlines or malformed quoting can also change argument boundaries. Because this package contains documentation rather than a fixed executable implementation, exploitation depends on how the Agent renders and executes the templates. Nevertheless, the prescribed pattern creates a credible injection surface whenever untrusted text is inserted into a generated Bash command. ### Attack Path 1. An attacker persuades a user or the Agent to use a crafted host, credential, name, path, content value, or JSON field. 2. The Agent inserts the value into one of the documented Bash templates without structured escaping. 3. The crafted value terminates or modifies the intended shell or JSON quoting context. 4. The sh ...[truncated 1327 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The examples use plaintext HTTP for login and authenticated API traffic without any warning to require HTTPS. This exposes usernames, passwords, bearer tokens, and administrative commands to interception or modification by any attacker on the network path, enabling full takeover of the Qinglong panel.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Documenting /system/command-run without any warning understates that it can run arbitrary shell commands on the underlying host. In the context of an automation skill, this can directly enable remote code execution, system tampering, data destruction, credential theft, or persistence if invoked by an agent or abused by an attacker.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · api-reference.md (reported line 246)May include surrounding context.

---

curl 完整示例合集

获取Token并保存

bash

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · api-reference.md (reported line 255)May include surrounding context.

批量查看任务状态（格式化输出）

bash

curl -s -H "Authorization: Bearer $TOKEN" "http://192.168.1.100:5700/api/crons" | python3 -c "
import sys, json
data = json.load(sys.stdin)['data']
for c in data.get('data', data) if isinstance(data, dict) else data:

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · api-reference.md (reported line 267)May include surrounding context.

搜索并运行指定名称任务

bash

# 搜索任务ID
IDS=$(curl -s -H "Authorization: Bearer $TOKEN" "http://<HOST>/api/crons" | python3 -c "
import sys, json
data = json.load(sys.stdin)['data']
tasks = data.get('data', data) if isinstance(data, dict) else data

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is explicitly designed to perform privileged Qinglong administrative actions such as running, stopping, creating, and deleting tasks and modifying environment variables, but it provides no guidance to require explicit user confirmation before destructive or high-impact actions. In an agent setting, this increases the risk of accidental or socially engineered destructive operations against a live automation panel.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to collect panel address plus username/password or client credentials, but it does not warn about handling secrets, minimizing retention, or avoiding disclosure in logs and responses. Because these credentials grant administrative panel access, careless collection or echoing can lead to credential theft and full compromise of the Qinglong instance.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This login example transmits credentials to an external service endpoint using curl. While external transmission is expected for a panel-management skill, it is still security-sensitive because the transmitted data includes administrator credentials and, as written elsewhere, may go over insecure transport.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

方式一（推荐）：账号密码登录获取 JWT

bash

curl -s -X POST \
  -H "Content-Type: application/json" \
  -d '{"username":"<USER>","password":"<PASS>"}' \
  "http://<HOST>/api/user/login"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The skill normalizes arbitrary API execution via curl with bearer tokens and JSON bodies, enabling transmission of sensitive tokens and high-impact administrative commands to a remote panel. In context this is intended behavior, but it becomes dangerous because no safeguards are defined for endpoint validation, transport security, confirmation, or secret redaction.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

使用 Bash 工具通过 curl 执行 API 请求。标准请求格式：

bash

curl -s -X <METHOD> \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '<JSON_BODY>' \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document explains token retrieval using client_id and client_secret and later describes environment-variable handling that can contain secrets such as cookies and push keys, but it provides no privacy or secret-handling guidance. This is dangerous because an agent or user may expose credentials in logs, prompts, examples, or notifications, leading to account or panel compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The reference includes many destructive or high-impact operations such as deleting tasks, disabling jobs, changing system configuration, importing/exporting data, and updating or reloading the system without any warning about operational risk. In an agent skill, omission of warnings and approval requirements increases the chance of unsafe automation or accidental destructive actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The API reference documents /system/command-run, which enables arbitrary shell command execution on the host running QingLong. For a panel-management skill, exposing this capability materially expands the attack surface from application administration to full host-level command execution, and there are no guardrails, warnings, or scope restrictions described.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-reference.md (reported line 275)May include surrounding context.

print(json.dumps([int(i) for i in ids])) ")

运行

curl -s -X PUT -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json"
-d "$IDS" "http:///api/crons/run"

text

Static analysis

No suspicious patterns detected.