qwencloud-deploy

• Outcome: Review
• Latest audit: Aug 6, 2026 · 4:14 AM UTC
• Version: 1.0.1

Overview

This cloud deployment skill is mostly coherent, but it can make high-impact account, billing, domain, credential, remote-command, update, and deletion changes that need careful review before use.

Install only if you intentionally want an agent to manage Alibaba Cloud resources for you. Use a least-privilege Alibaba Cloud account, verify the active profile is the international site and intended region, read every cost/deletion/domain prompt carefully, back up data before cleanup or redeploy, and avoid the domain-purchase flow unless you are comfortable sending registrant details to Alibaba Cloud.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill clearly describes powerful capabilities including shell execution, filesystem reads/writes, network access, and cloud-resource provisioning, yet it declares no permissions. That mismatch prevents meaningful user or platform review of what the skill can do and increases the risk of unexpected code execution, data access, or infrastructure changes under the guise of a deployment workflow.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill is presented as a deploy/publish/update tool, but it also supports irreversible deletion of cloud resources. That expands the operational blast radius far beyond user expectations and could lead to accidental or socially engineered destruction of running services and associated data, especially since the same state file and workflow route into cleanup behavior.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill metadata says it should deploy only to Alibaba Cloud International, but the documented command uses the `aliyun` CLI, which is commonly associated with Aliyun China workflows and can point users toward the wrong account scope, API environment, or operational assumptions. In a deployment skill that provisions public cloud resources, this mismatch is dangerous because it can cause deployments, discovery, or destructive actions to occur in an unintended cloud environment or tenant.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is explicitly scoped to Alibaba Cloud International, but the implementation uses the Aliyun CLI and API namespaces, which are associated with the China-cloud ecosystem. This mismatch can cause requests to be sent to the wrong control plane, create or inspect resources in an unintended account/environment, and undermine user expectations about where cloud operations occur.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file instructs users to run `aliyun ros` commands even though the skill is explicitly scoped to Alibaba Cloud International (`alibabacloud.com`) and says it should not be used for Aliyun China. This mismatch can direct deployments, validation, or pricing requests to the wrong control plane/account context, causing accidental use of China-region services, incorrect estimates, policy/compliance violations, or unintended exposure of templates and parameters to a different provider environment.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill extends an HTTPS/domain-binding workflow into domain purchasing, registrant-profile creation, email verification, and collection of substantial personal data. That scope expansion increases privacy, compliance, and consent risk because the agent is handling regulated account/commerce operations and sensitive PII that are not strictly necessary for core deployment.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script claims to manage Alibaba Cloud International deployments, but its cleanup flow points users to the Aliyun China ROS console and uses AliDNS-specific cleanup logic. This service-boundary mismatch can cause operators to clean up the wrong environment, fail to remove public DNS records, or leave cloud resources exposed and billable because the intended international control plane is not actually being targeted.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to run `aliyun ossadmin OpenOssService` automatically, which changes the user's cloud account state without explicit user confirmation at that moment. In a deployment skill with direct CLI execution, this can silently enable billable or security-relevant services and violates the principle of requiring informed consent before mutating cloud resources or account settings.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The delete-and-redeploy branch performs `scripts/delete_stack.sh --yes` after a high-level choice, but the flow does not require an explicit user-facing confirmation that the existing stack and its resources will be deleted. In this skill context, where stacks create public-facing infrastructure, an under-warned destructive path can lead to accidental service outage, data loss, or deletion of active cloud resources.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent to generate a database password and pass it via an environment variable, but it does not specify controls for secret storage, log redaction, process exposure, rotation, or cleanup. In a deployment skill that provisions public cloud infrastructure, this omission can lead to accidental credential disclosure through logs, subprocess inspection, deployment records, or debugging output, especially because the password is meant to be handled automatically and never shown to the user.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Passing DB_PASSWORD via an inline environment variable avoids argv/ps exposure, but it still risks credential disclosure through shell history practices, inherited environment inspection in some environments, CI logs, and accidental persistence in generated artifacts or debug output. In a cloud deployment skill that provisions public-facing infrastructure and database-backed services, insufficient secret-handling guidance increases the chance of real credential compromise.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The file instructs the agent to directly execute cloud CLI commands that make external network requests, but does not require any user-facing disclosure that Alibaba Cloud APIs will be contacted. Even though these are read-oriented stock checks, they still expose environment/account context to a third-party service and may surprise users who did not expect outbound API activity.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document states that the script will automatically call `aliyun ossadmin OpenOssService` if OSS is not activated, which changes the user's cloud account state and can enable billable cloud functionality. Even though activation itself may be free, this is an account-affecting side effect that can lead to unexpected charges, governance issues, or violation of change-control expectations if performed without explicit advance warning and consent.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: Requiring registrant details in English without user opt-in can cause data quality issues, failed registrations, and coercive handling of user identity data in a fixed format. While not a code-execution flaw, it is a workflow security/privacy weakness because it pressures users into transforming sensitive identity information without validation of locale requirements or consent.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This mode collects and transmits sensitive registrant PII such as name, address, phone number, and email to Alibaba Cloud without any built-in explicit consent gate or warning in the script itself. In an agent-driven workflow, that increases the risk of users unknowingly disclosing personal data to an external service, especially if the calling layer does not surface the transfer clearly.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The buy mode performs a real domain registration order against a cloud provider and can incur irreversible charges, yet the script contains no mandatory confirmation or purchase guard before execution. In an autonomous or semi-autonomous agent context, this is risky because a mistaken invocation could spend money and register a domain the user did not intend to buy.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Install docker compose plugin (if not already available)
  if ! docker compose version >/dev/null 2>&1; then
    mkdir -p /usr/local/lib/docker/cli-plugins
    curl -fsSL https://github.com/docker/compose/releases/latest/download/docker-compose-linux-x86_64 \
      -o /usr/local/lib/docker/cli-plugins/docker-compose
    chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
  fi

• Confidence: 96% confidence
• Finding: The script downloads an executable Docker Compose plugin from GitHub at deploy time and installs it as root without pinning a version or verifying a checksum/signature. This creates a supply-chain risk: if the release endpoint, network path, or upstream account is compromised, arbitrary code would be installed and executed on the target host.

Credential Access

High

• Category: Privilege Escalation

Content

# echoes DB_PASSWORD in cleartext into the log.
            set +x
            mkdir -p /etc/qwencloud
            cat > /etc/qwencloud/db.env <<DBENV
            DATABASE_URL="mysql://${DbAccount}:${DbPassword}@${RdsAddr}:${RdsPort}/${DbName}"
            DB_HOST="${RdsAddr}"
            DB_PORT="${RdsPort}"

• Confidence: 92% confidence
• Finding: The bootstrap script writes database credentials, including the password and full DATABASE_URL, to a persistent file on disk under /etc/qwencloud/db.env. Even with mode 600, any root compromise, backup leakage, image snapshot, later misconfiguration, or unsafe sourced child script can expose the credentials; this is more dangerous here because the template explicitly sources and propagates the secrets into subsequent runtime logic via __USERDATA_BODY__.

Credential Access

High

• Category: Privilege Escalation

Content

chmod 600 /etc/qwencloud/db.env

            set -a
            . /etc/qwencloud/db.env
            set +a
            set -x
            echo "[bootstrap] /etc/qwencloud/db.env written (contents omitted)"

• Confidence: 88% confidence
• Finding: Sourcing /etc/qwencloud/db.env loads database credentials into the shell environment, making them available to all subsequent bootstrap commands and any injected script content. In this template, that is particularly sensitive because __USERDATA_BODY__ is sourced/runtime-injected later, increasing the chance that secrets are consumed, echoed, inherited by subprocesses, or exposed through debugging and process inspection.

Credential Access

High

• Category: Privilege Escalation

Content

. /etc/qwencloud/db.env
            set +a
            set -x
            echo "[bootstrap] /etc/qwencloud/db.env written (contents omitted)"

            # ↓↓↓ generate_template.py injects base64-encoded bootstrap script (decoded and sourced at runtime, inheriting db.env) ↓↓↓
            __USERDATA_BODY__

• Confidence: 86% confidence
• Finding: The template explicitly notes that the later injected bootstrap body executes while inheriting db.env, meaning database credentials are intentionally propagated into opaque downstream logic. Because this file is a generic cloud deployment skill that provisions a public-facing service with follow-on script injection, inherited secrets materially increase the blast radius if the injected code, dependencies, or app setup are unsafe.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

2. **Phase 2: Atomic Swap** (downtime window)
   - `systemctl stop qwencloud-app`
   - `rm -rf /opt/qwencloud && mv staging → /opt/qwencloud`
   - Offline dependency install (using Phase 1 pre-downloaded cache)
   - `systemctl restart qwencloud-app`
   - Local health check (curl localhost, retry 15 times)

• Confidence: 88% confidence
• Finding: This duplicate finding points to the same destructive replacement primitive in the systemd update path. Because the skill deploys to publicly reachable cloud infrastructure via Cloud Assistant, a bad parameter, corrupted state file, or malicious artifact could remotely trigger deletion and replacement of production code at scale.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

2. **Phase 2: Atomic Swap** (downtime window)
   - `systemctl stop qwencloud-app`
   - `rm -rf /opt/qwencloud && mv staging → /opt/qwencloud`
   - Offline dependency install (using Phase 1 pre-downloaded cache)
   - `systemctl restart qwencloud-app`
   - Local health check (curl localhost, retry 15 times)

• Confidence: 88% confidence
• Finding: This duplicate finding points to the same destructive replacement primitive in the systemd update path. Because the skill deploys to publicly reachable cloud infrastructure via Cloud Assistant, a bad parameter, corrupted state file, or malicious artifact could remotely trigger deletion and replacement of production code at scale.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

1. Download to `/var/www/static.staging`
2. Integrity check
3. `rm -rf /var/www/static && mv staging`
4. `nginx -t && systemctl reload nginx`

---

• Confidence: 91% confidence
• Finding: The static update path uses `rm -rf /var/www/static && mv staging`, which can irreversibly remove the live web root before full validation of the replacement is proven good. If the new content is malformed, incomplete, or malicious, the website can be defaced, broken, or replaced with attacker-controlled files.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

fi

# 5) Clean up local state files
rm -f "$STATE" "$ROOT/.qwencloud-deploy.local"
echo "[delete] Done. Local .qwencloud-deploy(.local) deleted."

• Confidence: 89% confidence
• Finding: The script allows a caller-controlled --project-root and then performs rm -f on paths derived from it. While the filenames are fixed, an attacker or mistaken caller can point ROOT at arbitrary directories or symlinked locations, causing deletion of unintended local files outside the expected project workspace and potentially erasing security-relevant state needed for safe cleanup.

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.generated_source_template_injection

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: reference/hotfix/update_app.md:42

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: reference/hotfix/update_recipe.md:49

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: reference/https/https_setup.md:258