Qwen Orchestrator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:43 AM UTC
• Version: 1.5.8

Overview

This skill appears purpose-built for Qwen browser automation, but it creates a persistent authenticated browser daemon and has several under-hardened local security behaviors users should review first.

Install only if you are comfortable with a local persistent Chromium/PM2 daemon holding your Qwen login state. Avoid piping sensitive files or secrets into it, run it under a dedicated low-privilege account if possible, review PM2 startup/removal behavior, and consider fixing session-name validation, file permissions, browser sandboxing, and dependency updates before use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T06 · System Persistence

Error

• Location: scripts/setup-daemon.sh:17

Finding

PM2 Setup Establishes Cross-Session System Persistence

Content

View full analysis

/dev/null || pm2 restart qwen-daemon echo "💾 Saving PM2 state..." pm2 save echo "🔧 Setting up startup..." pm2 startup 2>/dev/null || echo " (run 'pm2 startup' manually if needed)" ``` ### Technical Analysis The setup script does more than start a daemon for the current session. It saves the daemon in PM2's persistent process list and invokes `pm2 startup`, which attempts to configure operating-system startup integration. Consequently, the authenticated browser daemon can be restored after a restart or login session. Although the persistence behavior is documented, it changes host startup configuration and outlives the Skill invocation. It therefore constitutes cross-session system persistence. The use of `--no-autorestart` only prevents PM2 from immediately restarting the process after an ordinary process exit. It does not negate the persistence created by `pm2 save` and the operating-system startup integration. ### Attack Path 1. A user or agent follows the documented daemon setup procedure. 2. `scripts/setup-daemon.sh` starts `qwen-daemon.js` under PM2. 3. `pm2 save` records the daemon in PM2's saved process state. 4. `pm2 startup` attempts to create or configure a startup service. 5. PM2 can restore the daemon during later system or user sessions without another direct Skill invocation. ### Impact Assessment The setup can modify startup configuration for the account running it and maintain a long-lived Chromium process containing authenticated Qwen state. If the command is run with elevated privileges, the startup integration may have a broader system scope. No evidence was found that the daemon is an intentionally concealed backdoor. Nevertheless, persist ...[truncated 157 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: ask-puppeteer.js:712

Finding

Unvalidated Session Names Allow Path Traversal Outside the Session Directory

Content

View full analysis

!a.startsWith('--') && (SESSION_IDX === -1 || argv.indexOf(a) !== SESSION_IDX + 1)).join(' '); let browser = null; let qwenPage = null; let browserLaunchedByUs = false; let browserConnectionMode = 'local'; const DAEMON_LOCK_FILE = path.join(BASE_DIR, '.daemon-request.lock'); const RATE_LIMIT_FILE = path.join(BASE_DIR, '.last_prompt_send_time'); let daemonLockHeld = false; ensureDirSync(SESSIONS_DIR); ensureDirSync(PROFILE_DIR); function getSessionFile(name) { return path.join(SESSIONS_DIR, `${name}.json`); } function loadSession(name) { try { const f = getSessionFile(name); if (fs.existsSync(f)) return JSON.parse(fs.readFileSync(f, 'utf8')); } catch {} return { name, messageCount: 0, created: null, lastUsed: null, chatUrl: null }; } function saveSession(name, data) { try { fs.writeFileSync(getSessionFile(name), JSON.stringify(data, null, 2)); } catch {} } function deleteSession(name) { try { fs.unlinkSync(getSessionFile(name)); } catch {} } ``` The shell wrapper also constructs a deletion path directly from the same unvalidated value: ```bash if [[ "$END_SESSION" = true ]]; then if [[ -n "$SESSION_NAME" ]]; then node "$SCRIPT_DIR/ask-puppeteer.js" "${SESSION_ARGS[@]}" --end-session >/dev/null 2>&1 || true rm -f "$SCRIPT_DIR/.sessions/${SESSION_NAME}.json" echo "Сессия '$SESSION_NAME' завершена" else echo "Ошибка: --end-session требует --session NAME" >&2 exit 1 fi exit 0 fi ``` ### Technical Analysis The `-- ...[truncated 2030 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: qwen-daemon.js:144

Finding

Chromium Is Launched with Process Sandboxing Disabled

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: qwen-daemon.js:30

Finding

Sensitive Browser State and CDP Endpoint Files Lack Explicit Permission Hardening

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/test-mode-matrix.sh:1

Finding

Default Test Command Performs Live Account Activity and Reads a Host-Specific External Path

Content

View full analysis

/tmp/qwen-test-dryrun.txt echo '[2/6] single prompt daemon' bash ask-qwen.sh --daemon 'Reply with exactly: MATRIX_ONE' >/tmp/qwen-test-single.txt grep -q 'MATRIX_ONE' /tmp/qwen-test-single.txt echo '[3/6] follow-up continuity matrix (5 rounds)' QWEN_CONTINUITY_ROUNDS=5 node scripts/test-followup-continuity.js >/tmp/qwen-test-followup.txt echo '[4/6] search mode daemon' bash ask-qwen.sh --daemon --search 'Reply with exactly: MATRIX_SEARCH' >/tmp/qwen-test-search.txt if ! grep -Eq 'MATRIX_SEARCH|📦 Ответ:|У выбранной модели нет оставшихся использований|selected model has no remaining uses' /tmp/qwen-test-search.txt; then echo '[FAIL] search mode did not produce a usable response path' >&2 cat /tmp/qwen-test-search.txt >&2 exit 1 fi echo '[5/6] stdin daemon' printf 'Reply with exactly: MATRIX_STDIN' | bash ask-qwen.sh --daemon --stdin >/tmp/qwen-test-stdin.txt if ! grep -Eq 'MATRIX_STDIN|📦 Ответ:|У выбранной модели нет оставшихся использований|selected model has no remaining uses' /tmp/qwen-test-stdin.txt; then echo '[FAIL] stdin mode did not produce a usable response path' >&2 cat /tmp/qwen-test-stdin.txt >&2 exit 1 fi echo '[6/8] end-session path already covered by follow-up test' echo '[7/8] oversize detection path' python3 - <<'PY' > /tmp/qwen-oversize-prompt.txt print('Reply with exactly: TOO_BIG\\n') print('X' * 260000) PY set +e bash ask-qwen.sh --daemon --session qwen-oversize-test --stdin ...[truncated 2741 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (42)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · REFERENCE.md (reported line 44)May include surrounding context.

If Chromium profile lock errors appear:

bash

cd ~/.openclaw/workspace/skills/qwen-orchestrator
rm -f .profile/Singleton*
pm2 restart qwen-daemon
bash ask-qwen.sh --dry-run

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

If Chromium profile lock errors appear:

bash

cd ~/.openclaw/workspace/skills/qwen-orchestrator
rm -f .profile/Singleton*
pm2 restart qwen-daemon
bash ask-qwen.sh --dry-run

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

If Chromium profile lock errors appear:

bash

cd ~/.openclaw/workspace/skills/qwen-orchestrator
rm -f .profile/Singleton*
pm2 restart qwen-daemon
bash ask-qwen.sh --dry-run

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented purpose is a Qwen browser automation wrapper, but the analysis indicates additional behavior involving sibling-directory inspection, recursive source scanning, and process termination on isolation failures. Undisclosed cross-directory inspection and kill behavior expands the trust boundary beyond what a user would expect and can create review evasion or denial-of-service risk inside the local skill environment.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

| If you see this symptom | Run this exact command | Then verify with |
|---|---|---|
| `Connection refused`, daemon not online | `pm2 restart qwen-daemon && sleep 8 && ask-qwen.sh --dry-run --daemon` | `ask-qwen.sh "Say OK" --daemon` |
| `auth expired`, `CAPTCHA`, login page | `cd ~/.openclaw/workspace/skills/qwen-orchestrator && pm2 stop qwen-daemon && rm -f .daemon-ws-endpoint && bash ask-qwen.sh --visible --wait --dry-run && pm2 start qwen-daemon` | `bash ask-qwen.sh --dry-run --daemon` |
| response cuts off | `ask-qwen.sh "Part 1" --session temp && ask-qwen.sh "Continue" --session temp` | `ask-qwen.sh --session temp --end-session` |
| `lock`, `Singleton`, profile already in use | `cd ~/.openclaw/workspace/skills/qwen-orchestrator && rm -f .profile/Singleton* && pm2 restart qwen-daemon` | `bash ask-qwen.sh --dry-run` |
| selector not found | `ask-qwen.sh --dry-run --visible` | only after manual inspection consider selector edits |

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md

| If you see this symptom | Run this exact command | Then verify with |
|---|---|---|
| `Connection refused`, daemon not online | `pm2 restart qwen-daemon && sleep 8 && ask-qwen.sh --dry-run --daemon` | `ask-qwen.sh "Say OK" --daemon` |
| `auth expired`, `CAPTCHA`, login page | `cd ~/.openclaw/workspace/skills/qwen-orchestrator && pm2 stop qwen-daemon && rm -f .daemon-ws-endpoint && bash ask-qwen.sh --visible --wait --dry-run && pm2 start qwen-daemon` | `bash ask-qwen.sh --dry-run --daemon` |
| response cuts off | `ask-qwen.sh "Part 1" --session temp && ask-qwen.sh "Continue" --session temp` | `ask-qwen.sh --session temp --end-session` |
| `lock`, `Singleton`, profile already in use | `cd ~/.openclaw/workspace/skills/qwen-orchestrator && rm -f .profile/Singleton* && pm2 restart qwen-daemon` | `bash ask-qwen.sh --dry-run` |
| selector not found | `ask-qwen.sh --dry-run --visible` | only after manual inspection consider selector edits |

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

| If you see this symptom | Run this exact command | Then verify with |
|---|---|---|
| `Connection refused`, daemon not online | `pm2 restart qwen-daemon && sleep 8 && ask-qwen.sh --dry-run --daemon` | `ask-qwen.sh "Say OK" --daemon` |
| `auth expired`, `CAPTCHA`, login page | `cd ~/.openclaw/workspace/skills/qwen-orchestrator && pm2 stop qwen-daemon && rm -f .daemon-ws-endpoint && bash ask-qwen.sh --visible --wait --dry-run && pm2 start qwen-daemon` | `bash ask-qwen.sh --dry-run --daemon` |
| response cuts off | `ask-qwen.sh "Part 1" --session temp && ask-qwen.sh "Continue" --session temp` | `ask-qwen.sh --session temp --end-session` |
| `lock`, `Singleton`, profile already in use | `cd ~/.openclaw/workspace/skills/qwen-orchestrator && rm -f .profile/Singleton* && pm2 restart qwen-daemon` | `bash ask-qwen.sh --dry-run` |
| selector not found | `ask-qwen.sh --dry-run --visible` | only after manual inspection consider selector edits |

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

| If you see this symptom | Run this exact command | Then verify with |
|---|---|---|
| `Connection refused`, daemon not online | `pm2 restart qwen-daemon && sleep 8 && ask-qwen.sh --dry-run --daemon` | `ask-qwen.sh "Say OK" --daemon` |
| `auth expired`, `CAPTCHA`, login page | `cd ~/.openclaw/workspace/skills/qwen-orchestrator && pm2 stop qwen-daemon && rm -f .daemon-ws-endpoint && bash ask-qwen.sh --visible --wait --dry-run && pm2 start qwen-daemon` | `bash ask-qwen.sh --dry-run --daemon` |
| response cuts off | `ask-qwen.sh "Part 1" --session temp && ask-qwen.sh "Continue" --session temp` | `ask-qwen.sh --session temp --end-session` |
| `lock`, `Singleton`, profile already in use | `cd ~/.openclaw/workspace/skills/qwen-orchestrator && rm -f .profile/Singleton* && pm2 restart qwen-daemon` | `bash ask-qwen.sh --dry-run` |
| selector not found | `ask-qwen.sh --dry-run --visible` | only after manual inspection consider selector edits |

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · ask-puppeteer.js (reported line 126)May include surrounding context.

js

function ensureDirSync(d) { try { fs.mkdirSync(d, { recursive: true }); } catch {} }

function shortenPromptForRetry(prompt, attempt) {
  if (typeof prompt !== 'string') return prompt;
  const lines = prompt.split('\n');
  if (lines.length <= 6) {
    const hardMax = Math.max(OVERSIZE_RETRY_MIN_CHARS, Math.floor(prompt.length * Math.pow(OVERSIZE_RETRY_KEEP_RATIO, attempt)));

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · ask-puppeteer.js (reported line 130)May include surrounding context.

js

function ensureDirSync(d) { try { fs.mkdirSync(d, { recursive: true }); } catch {} }

function shortenPromptForRetry(prompt, attempt) {
  if (typeof prompt !== 'string') return prompt;
  const lines = prompt.split('\n');
  if (lines.length <= 6) {
    const hardMax = Math.max(OVERSIZE_RETRY_MIN_CHARS, Math.floor(prompt.length * Math.pow(OVERSIZE_RETRY_KEEP_RATIO, attempt)));

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

This shell invocation combines rm -rf with output redirection and || true, masking failures and making destructive cleanup harder to observe or audit. Silent failure handling around host-destructive operations increases operational risk and hinders incident response.

Content

Scanner excerpt · ask-puppeteer.js (reported line 755)May include surrounding context.

js

try { process.kill(pid.trim(), 'SIGKILL'); } catch {}
    }
    await sleep(1000);
    try { execSync('rm -rf /dev/shm/.com.google.Chrome.* 2>/dev/null || true'); } catch {}
    try { execSync('rm -rf /tmp/.com.google.Chrome.* 2>/dev/null || true'); } catch {}
  } catch {}
}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This shell invocation combines rm -rf with output redirection and || true, masking failures and making destructive cleanup harder to observe or audit. Silent failure handling around host-destructive operations increases operational risk and hinders incident response.

Content

Scanner excerpt · ask-puppeteer.js (reported line 755)May include surrounding context.

js

try { process.kill(pid.trim(), 'SIGKILL'); } catch {}
    }
    await sleep(1000);
    try { execSync('rm -rf /dev/shm/.com.google.Chrome.* 2>/dev/null || true'); } catch {}
    try { execSync('rm -rf /tmp/.com.google.Chrome.* 2>/dev/null || true'); } catch {}
  } catch {}
}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

This shell invocation combines rm -rf with output redirection and || true, masking failures and making destructive cleanup harder to observe or audit. Silent failure handling around host-destructive operations increases operational risk and hinders incident response.

Content

Scanner excerpt · ask-puppeteer.js (reported line 755)May include surrounding context.

js

try { process.kill(pid.trim(), 'SIGKILL'); } catch {}
    }
    await sleep(1000);
    try { execSync('rm -rf /dev/shm/.com.google.Chrome.* 2>/dev/null || true'); } catch {}
    try { execSync('rm -rf /tmp/.com.google.Chrome.* 2>/dev/null || true'); } catch {}
  } catch {}
}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

This /tmp cleanup command is both destructive and intentionally quiet due to redirection and || true, reducing visibility into what was removed or whether the target was valid. In shared environments, silent wildcard deletion is particularly risky and exceeds the needs of the stated functionality.

Content

Scanner excerpt · ask-puppeteer.js (reported line 756)May include surrounding context.

js

}
    await sleep(1000);
    try { execSync('rm -rf /dev/shm/.com.google.Chrome.* 2>/dev/null || true'); } catch {}
    try { execSync('rm -rf /tmp/.com.google.Chrome.* 2>/dev/null || true'); } catch {}
  } catch {}
}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This /tmp cleanup command is both destructive and intentionally quiet due to redirection and || true, reducing visibility into what was removed or whether the target was valid. In shared environments, silent wildcard deletion is particularly risky and exceeds the needs of the stated functionality.

Content

Scanner excerpt · ask-puppeteer.js (reported line 756)May include surrounding context.

js

}
    await sleep(1000);
    try { execSync('rm -rf /dev/shm/.com.google.Chrome.* 2>/dev/null || true'); } catch {}
    try { execSync('rm -rf /tmp/.com.google.Chrome.* 2>/dev/null || true'); } catch {}
  } catch {}
}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

This /tmp cleanup command is both destructive and intentionally quiet due to redirection and || true, reducing visibility into what was removed or whether the target was valid. In shared environments, silent wildcard deletion is particularly risky and exceeds the needs of the stated functionality.

Content

Scanner excerpt · ask-puppeteer.js (reported line 756)May include surrounding context.

js

}
    await sleep(1000);
    try { execSync('rm -rf /dev/shm/.com.google.Chrome.* 2>/dev/null || true'); } catch {}
    try { execSync('rm -rf /tmp/.com.google.Chrome.* 2>/dev/null || true'); } catch {}
  } catch {}
}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · ask-qwen.sh (reported line 148)May include surrounding context.

sh

if [[ "$END_SESSION" = true ]]; then
  if [[ -n "$SESSION_NAME" ]]; then
    node "$SCRIPT_DIR/ask-puppeteer.js" "${SESSION_ARGS[@]}" --end-session >/dev/null 2>&1 || true
    rm -f "$SCRIPT_DIR/.sessions/${SESSION_NAME}.json"
    echo "Сессия '$SESSION_NAME' завершена"
  else
    echo "Ошибка: --end-session требует --session NAME" >&2

Known Vulnerable Dependency: basic-ftp==5.2.0 — 4 advisory(ies): GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-39983 (basic-ftp has FTP Command Injection via CRLF); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The lockfile includes basic-ftp 5.2.0, which is flagged for FTP command injection and denial-of-service issues. Although this package is only transitive here via get-uri/pac-proxy-agent/proxy-agent used by Puppeteer’s proxy support, shipping a known-vulnerable version still creates risk if attacker-influenced FTP or proxy/PAC inputs are ever processed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The lockfile includes extract-zip 2.0.1, which has reported arbitrary file write and symlink traversal issues during archive extraction. In this skill, extract-zip is pulled in by @puppeteer/browsers and may be exercised when downloading/extracting browser binaries, so a compromised or malicious archive source could potentially write outside the intended directory.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 86% confidence

Finding

The lockfile includes ip-address 10.1.0 with advisories for leading-zero parsing ambiguity and XSS in HTML-emitting helpers. Here it is a transitive dependency of socks, so exploitability depends on whether the skill exposes attacker-controlled address parsing or renders HTML from this library; based on the lockfile alone, that is less certain.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile includes js-yaml 4.1.1, which is flagged for CPU consumption issues from malicious YAML structures. In this skill, js-yaml is transitive through cosmiconfig and the skill description explicitly mentions configuration via .qwen.json; even if YAML is not the primary format, cosmiconfig commonly loads multiple config syntaxes, so attacker-controlled config content could trigger denial of service.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The lockfile includes ws 8.20.0, which has advisories for memory disclosure and memory exhaustion via fragmented frames. Because Puppeteer-core relies on WebSocket connections to control the browser over DevTools/BiDi, a vulnerable ws version in a browser-automation daemon increases risk if an attacker can influence or connect through those channels, especially in a persistent service context.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill clearly performs network access to a third-party service and uses local environment/process state, but the manifest does not declare any tool scope or permission boundary. That makes the operational trust model opaque and can cause an orchestrator or reviewer to underestimate what the skill is allowed to access or transmit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation encourages piping arbitrary files and prompts directly into Qwen Chat, including source code and multi-line content, without an explicit warning that this data is sent to an external third-party service. Users may unintentionally exfiltrate proprietary code, secrets, or regulated data because the examples normalize transmission without privacy guidance.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: ask-puppeteer.js:111

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/test-followup-continuity.js:11