qwencloud-update-check
Analysis
The skill mostly matches its update-checking purpose, but it emits auto-confirm, unpinned install/update commands and uses shared persistent state that other qwencloud skills can act on.
Findings (7)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
skill_args = " ".join(skills) if skills else ""
return f"npx skills add {_SKILLS_REPO} --skill {skill_args} -y"The helper builds a shell command from local `skills-lock.json` skill names and includes `-y` auto-confirm. It prints the command for users or agents to run, but the skill names are only prefix-filtered and not shell-quoted.
_SKILLS_REPO = "QwenCloud/qwencloud-ai"
INSTALL_CMD = f"npx skills add {_SKILLS_REPO} --skill qwencloud-update-check -y"The suggested installation/update source is a repository reference rather than a pinned version or commit, and the command uses auto-confirm. This creates a mutable supply-chain dependency for updates.
proc = subprocess.run(
[sys.executable, str(script), "--print-response"],
capture_output=True, text=True, timeout=15,
)The helper executes the bundled update-check script through Python subprocess. The arguments are fixed and this is purpose-aligned, but users should know the skill is not purely declarative.
return sorted(k for k in skills if k.startswith("qwencloud-"))
...
return f"npx skills add {_SKILLS_REPO} --skill {skill_args} -y"The update command can include all installed `qwencloud-` skills from the lock file, so one accepted update prompt may affect multiple skills in the pack.
print(
f"[ACTION_REQUIRED] qwencloud-update-check skill is not installed. "
f"Install: {INSTALL_CMD}",
file=sys.stderr,
)The wording `ACTION_REQUIRED` and an auto-confirm install command may make an optional installation feel mandatory, even though it is an update-helper prompt.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Records the check timestamp (`last_interaction`) in `<repo_root>/.agents/state.json` to rate-limit network requests to once every 24 hours.
The skill stores persistent state that survives sessions and is shared with `gossamer.py`. It does not store sensitive content, but that state can influence future update prompts.
emits structured signals to stderr that agents can parse and act on: [ACTION_REQUIRED] [UPDATE_AVAILABLE]
The helper communicates with other agent flows through parseable stderr signals. This is disclosed and limited to update/install notifications, but origin and action boundaries depend on the consuming agent.