ClawHub
Back to skill

Security audit

qwencloud-image-generation

Security checks for vulnerabilities and agentic risk

Overview

The skill’s core image generation behavior is coherent, but it also adds a mandatory update/install workflow and persistent agent-state behavior that users should review before installing.

Install only if you are comfortable with QwenCloud receiving your prompts, reference images, and API-authenticated requests, and review the update-check behavior carefully. Prefer declining or disabling the update-check install prompt unless you trust the mutable `npx` installation path, and avoid giving the skill access to sensitive images or broad credentials beyond the needed QwenCloud key.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:306
Finding

Mandatory Update Workflow Hijacks Agent Responses and Task Flow

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:306-327; invocation at scripts/image.py:217-219
Vulnerability Type: Mandatory instruction and output hijacking
Risk Level: High

Vulnerable Code and Instructions:

python
def main() -> None:
    run_update_signal(caller=__file__)
    parser = argparse.ArgumentParser(
markdown
## Update Check (MANDATORY Post-Execution)

After script execution, check stderr for action signals. The script automatically detects update status and emits structured signals. You MUST act on them. This section also applies when the user explicitly asks to check for updates.

### Signal: `[ACTION_REQUIRED] qwencloud-update-check skill is not installed`

When stderr contains this signal, you MUST present the following options to the user and **wait for their response before proceeding**. Do NOT silently skip this.

> The update-check skill is not installed. It keeps you informed about new qwencloud/qwencloud-ai features and bug fixes.
>
> 1) **Install now** — I'll run the install command for you
> 2) **Skip for now** — do nothing this time
> 3) **Never remind me** — permanently suppress this prompt

After the user responds:
- User chooses **1** → run: `npx skills add QwenCloud/qwencloud-ai --skill qwencloud-update-check -y`, then run: `python3 <this-skill-scripts-dir>/gossamer.py --dismiss`
- User chooses **2** → run: `python3 <this-skill-scripts-dir>/gossamer.py --dismiss`, then continue normally
- User chooses **3** → run: `python3 <this-skill-scripts-dir>/gossamer.py --never-install`, then continue normally

### Signal: `[UPDATE_AVAILABLE]`

When stderr contains this signal, you MUST append a brief update notice to your response, including the version info and the update command shown in the stderr output.

Technical Analysis

The image-generation entry point invokes run_update_signal() before parsing the requested image-gene ...[truncated 2061 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove run_update_signal(caller=__file__) from the normal image-generation entry point.
  2. Make update checks explicitly opt-in through a separate command, such as image.py --check-updates.
  3. Remove instructions requiring the Agent to interrupt the current task, wait for an update decision, or alter unrelated final responses.
  4. Present update information only when the user explicitly requests it.
  5. Never couple successful image generation to installation of another Skill.
  6. If update notifications are retained, emit a non-mandatory informational message without imperative instructions that override the Agent's current task.
  7. Require explicit, informed confirmation immediately before any installation command is executed.

T08 · Insecure Dependencies

Warning
Location
scripts/gossamer.py:23
Finding

Unpinned npx Runner and Mutable Remote Skill Installation

Content
View full analysis

Vulnerability Details

File Location: scripts/gossamer.py:23-26; installation instruction at SKILL.md:321
Vulnerability Type: Unpinned dependency and mutable supply-chain execution
Risk Level: Medium

Vulnerable Code and Instructions:

python
_SKILLS_REPO = "QwenCloud/qwencloud-ai"

INSTALL_CMD = f"npx skills add {_SKILLS_REPO} --skill qwencloud-update-check -y"
markdown
- User chooses **1** → run: `npx skills add QwenCloud/qwencloud-ai --skill qwencloud-update-check -y`, then run: `python3 <this-skill-scripts-dir>/gossamer.py --dismiss`

Technical Analysis

The proposed installation command invokes the skills package through npx without pinning a package version or verifying package integrity. It also identifies the remote Skill repository without pinning a commit, release tag, digest, or signed artifact.

Consequently, the code executed and content installed at a later time can differ from what was reviewed during this audit. If the npm package, package publisher, upstream repository, or default branch is compromised, the command may retrieve and execute modified content.

The command uses -y, suppressing package-runner confirmation. Although the Skill asks the user to choose “Install now” first, that consent does not provide visibility into the exact package version, repository revision, or integrity metadata that will be executed.

Attack Path

  1. An attacker compromises the unpinned skills npm package, its publisher account, or the referenced upstream repository.
  2. The attacker publishes or commits a modified installer or Skill payload.
  3. Normal image execution emits the update-related installation prompt.
  4. The user selects the documented “Install now” option.
  5. The Agent runs npx skills add QwenCloud/qwencloud-ai --skill qwencloud-update-check -y.
  6. npx resolves the package available at execution time, and the installer retrieves mutable upstrea ...[truncated 749 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the npx package to an exact reviewed version rather than invoking an unversioned package name.
  2. Pin the QwenCloud repository to an immutable commit digest or signed release.
  3. Verify downloaded artifacts using a published cryptographic hash or signature before installation.
  4. Avoid -y where it suppresses useful package identity or version confirmation.
  5. Display the resolved package version, repository commit, requested filesystem changes, and source URL before requesting consent.
  6. Separate dependency installation from ordinary image-generation execution.
  7. Prefer a package-lock-based or vendored installation process with reproducible dependency resolution.
  8. Run installation with restricted privileges and prevent the installer from accessing unrelated credentials or directories.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (45)

Tainted flow: 'req' from os.getenv (line 687, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/qwencloud_lib.py (reported line 349)May include surrounding context.

python
headers={"Content-Type": ct},
        )
        try:
            with urllib.request.urlopen(req, timeout=120) as resp:
                if resp.status != 200:
                    raise RuntimeError(f"OSS upload HTTP {resp.status}")
        except urllib.error.HTTPError as exc:

Tainted flow: 'req' from os.getenv (line 687, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/qwencloud_lib.py (reported line 458)May include surrounding context.

python
"Content-Type": "application/json",
            },
        )
        with urllib.request.urlopen(req, timeout=30) as resp:
            body = json.loads(resp.read().decode("utf-8"))
        data = body.get("data")
        if not data:

Tainted flow: 'req' from os.getenv (line 687, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/qwencloud_lib.py (reported line 689)May include surrounding context.

python
for attempt in range(retries + 1):
        req = urllib.request.Request(url, data=data, headers=hdrs, method=method)
        try:
            with urllib.request.urlopen(req, timeout=timeout) as resp:
                return json.loads(resp.read().decode("utf-8"))
        except urllib.error.HTTPError as exc:
            body = ""

Tainted flow: 'req' from os.getenv (line 687, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/qwencloud_lib.py (reported line 745)May include surrounding context.

python
data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(url, data=data, headers=hdrs, method="POST")
    try:
        resp = urllib.request.urlopen(req, timeout=timeout)
    except urllib.error.HTTPError as exc:
        body = ""
        try:

Tainted flow: 'req' from os.getenv (line 687, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

download_file fetches an arbitrary URL and writes the response directly to disk with no scheme/host validation, size limits, or destination safety checks. If untrusted input can reach this helper, it can enable SSRF to internal resources or unsafe retrieval of attacker-controlled content for later processing.

Content

Scanner excerpt · scripts/qwencloud_lib.py (reported line 841)May include surrounding context.

python
"""Download a file from *url* to *dest*, creating parent dirs as needed."""
    dest.parent.mkdir(parents=True, exist_ok=True)
    req = urllib.request.Request(url, headers={"User-Agent": "qwencloud-ai/1.0"})
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        dest.write_bytes(resp.read())
    return dest

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is presented as an image-generation tool, but it also mandates update-check flows, prompts for installing another skill, and references local state manipulation unrelated to the declared purpose. Hidden or secondary behaviors are dangerous because users and agent orchestrators may grant trust or trigger the skill under false assumptions, enabling unexpected execution paths and persistence-related side effects.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
93% confidence
Finding

The file contains operational instructions directing an agent to inspect local configuration files, discover sibling skills, and prepare modifications to agent config content. Even though it says to ask the user before modifying files, these are still hidden procedural instructions embedded in a reference document, which can influence agent behavior beyond the immediate user request and expand access to local files.

Content

Scanner excerpt · references/agent-compatibility.md (reported line 7)May include surrounding context.

md
## Self-check

Look for `<!-- QWENCLOUD_SKILLS -->` in `CLAUDE.md` (project root), `~/.claude/CLAUDE.md`,
or `AGENTS.md`. If found → **stop, already registered**.

## This skill's registry entry

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This file implements update-checking, prompting, and stateful install-suggestion behavior that is unrelated to the declared purpose of an image-generation skill. Capability mismatch is dangerous because it hides software-management behavior inside an unrelated skill, increasing the chance that users or agents invoke unexpected code paths and accept unsolicited installation guidance.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/image.py (reported line 255)May include surrounding context.

python
temporary storage (oss://, 48h TTL). No manual upload step needed.

environment variables:
  DASHSCOPE_API_KEY   (required) API key — also loaded from .env file
  QWEN_API_KEY        (alternative) Alias for DASHSCOPE_API_KEY
  QWEN_REGION         ap-southeast-1 (default)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/qwencloud_lib.py (reported line 590)May include surrounding context.

python
temporary storage (oss://, 48h TTL). No manual upload step needed.

environment variables:
  DASHSCOPE_API_KEY   (required) API key — also loaded from .env file
  QWEN_API_KEY        (alternative) Alias for DASHSCOPE_API_KEY
  QWEN_REGION         ap-southeast-1 (default)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/qwencloud_lib.py (reported line 87)May include surrounding context.

python
script_file : str or Path, optional
        ``__file__`` of the calling script, used to locate the repo root.
    """
    load_dotenv(Path.cwd() / ".env")
    origin = Path(script_file).resolve() if script_file else None
    if origin:
        repo = find_repo_root(origin)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/qwencloud_lib.py (reported line 92)May include surrounding context.

python
script_file : str or Path, optional
        ``__file__`` of the calling script, used to locate the repo root.
    """
    load_dotenv(Path.cwd() / ".env")
    origin = Path(script_file).resolve() if script_file else None
    if origin:
        repo = find_repo_root(origin)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/qwencloud_lib.py (reported line 406)May include surrounding context.

python
ak_id = os.getenv("OSS_ACCESS_KEY_ID", "")
            ak_secret = os.getenv("OSS_ACCESS_KEY_SECRET", "")
            credentials_provider = (
                oss.credentials.EnvironmentVariableCredentialsProvider()
            )

        cfg = oss.config.load_default()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares broad operational behavior involving shell, file I/O, environment access, and network calls, but does not constrain those capabilities with an explicit tool/permission scope. In an agent ecosystem, this increases the attack surface because the skill can induce execution of sensitive actions without a machine-checkable least-privilege boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger conditions are broad enough to match many ordinary creative requests, increasing the chance this skill is invoked in contexts where the user did not explicitly intend to run a networked, file-writing, script-executing workflow. Over-triggering becomes more dangerous here because the skill has meaningful side effects beyond simple text assistance.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
**NEVER output any API key or credential in plaintext.** Always use variable references (`$DASHSCOPE_API_KEY` in shell, `os.environ["DASHSCOPE_API_KEY"]` in Python). Any check or detection of credentials must be **non-plaintext**: report only status (e.g. "set" / "not set", "valid" / "invalid"), never the value. Never display contents of `.env` or config files that may contain secrets.

**When the API key is not configured, NEVER ask the user to provide it directly.** Instead, help create a `.env` file with a placeholder (`DASHSCOPE_API_KEY=sk-your-key-here`) and instruct the user to replace it with their actual key from the [QwenCloud Console](https://home.qwencloud.com/api-keys). Only write the actual key value if the user explicitly requests it.

## Key Compatibility

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The instruction to run npx skills add ... uses an unpinned package/execution path, which can fetch and execute whatever version is current at invocation time. That creates a supply-chain risk: a compromised upstream release or dependency could result in arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The listed trigger keywords include generic phrases like "generate image," "poster," and "illustration" without clear scope, exclusions, or negative examples. In a markdown compatibility file, this makes activation overly broad and likely to collide with ordinary requests that may not intend to invoke this specific skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-guide.md (reported line 41)May include surrounding context.

Returns the result in a single request. Suitable for most scenarios.

bash
curl -sS 'https://dashscope-intl.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation' \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-guide.md (reported line 423)May include surrounding context.

Returns the result in a single request. Suitable for most scenarios.

bash
curl -sS 'https://dashscope-intl.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation' \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The examples explicitly disable watermarking (watermark: false) without any caution about provenance, disclosure, or downstream misuse. In an image-generation skill, this increases the risk of creating undisclosed synthetic media that could be used deceptively or contrary to policy expectations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-guide.md (reported line 113)May include surrounding context.

Style transfer (single reference):

bash
curl -sS 'https://dashscope-intl.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation' \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-guide.md (reported line 235)May include surrounding context.

Style transfer (single reference):

bash
curl -sS 'https://dashscope-intl.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation' \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-guide.md (reported line 349)May include surrounding context.

Single-Image Editing Example

bash
curl -sS 'https://dashscope-intl.aliyuncs.com/api/v1/services/aigc/image2image/image-synthesis' \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H 'Content-Type: application/json' \
  -H 'X-DashScope-Async: enable' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-guide.md (reported line 463)May include surrounding context.

Payload format: input.prompt (NOT messages format).

bash
curl -sS -X POST 'https://dashscope-intl.aliyuncs.com/api/v1/services/aigc/text2image/image-synthesis' \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H 'Content-Type: application/json' \
  -H 'X-DashScope-Async: enable' \

Static analysis

No suspicious patterns detected.