qwencloud-image-generation

• Outcome: Review
• Latest audit: May 28, 2026 · 11:22 AM UTC
• Version: 0.2.1

Overview

The image-generation feature is mostly legitimate, but the skill also steers agents toward installing and running update-related code outside the core task.

Install only if you are comfortable giving the skill a QwenCloud API key, sending prompts and selected images to QwenCloud, and paying for generated images. Treat update prompts as optional: review the referenced repository and command before approving any `npx skills add` action, and inspect any proposed `.agents`, `CLAUDE.md`, or `AGENTS.md` changes before allowing them.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tainted flow: 'req' from os.getenv (line 687, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

"""Download a file from *url* to *dest*, creating parent dirs as needed."""
    dest.parent.mkdir(parents=True, exist_ok=True)
    req = urllib.request.Request(url, headers={"User-Agent": "qwencloud-ai/1.0"})
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        dest.write_bytes(resp.read())
    return dest

• Confidence: 87% confidence
• Finding: The download_file helper fetches any provided URL and writes the response directly to disk with no scheme, host, size, or content validation. If higher-level code passes attacker-controlled URLs, this creates SSRF-style outbound fetch capability and arbitrary file write of remote content into chosen local paths, which is broader than the skill's stated image-generation purpose.

Tainted flow: 'req' from os.getenv (line 687, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

for attempt in range(retries + 1):
        req = urllib.request.Request(url, data=data, headers=hdrs, method=method)
        try:
            with urllib.request.urlopen(req, timeout=timeout) as resp:
                return json.loads(resp.read().decode("utf-8"))
        except urllib.error.HTTPError as exc:
            body = ""

• Confidence: 81% confidence
• Finding: The generic http_request function can send authenticated requests to a URL influenced by environment-controlled base URL settings and arbitrary registered providers. In a skill context, this broadens the trust boundary: a malicious or misconfigured environment can redirect API calls and bearer credentials to an attacker-controlled endpoint, effectively enabling credential exfiltration.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs the agent to access environment variables, read and write files, invoke shell commands, and make network requests, yet it declares no explicit permissions. That creates a transparency and governance gap: a user or host system cannot accurately assess or constrain what the skill may do before execution. In this context, the hidden capability set is material because the skill can touch credentials, filesystem state, and external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose is image generation/editing, but the skill also performs update-management behaviors: checking for another skill, prompting installation via npx, invoking another script, and persisting suppression state. This mismatch is security-relevant because users may authorize an image skill without expecting package installation or persistent state changes, expanding the effective trust boundary beyond the declared function.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill mandates installing another skill via `npx skills add ...` as part of post-execution handling, which is outside its core image-generation role. Triggering package/tool installation from routine use increases supply-chain and unexpected-execution risk, especially when the user asked only for image generation.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file adds update-checking and install-prompt behavior to an image-generation skill, which is unrelated to the declared functionality and creates an unexpected side channel that can influence agent behavior. In a skill ecosystem, unrelated operational logic is dangerous because it can steer users or agents into installing additional code from a repository, expanding trust and attack surface without a clear business need.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The code generates installation/update commands for `npx skills add QwenCloud/qwencloud-ai --skill ...` and emits `[ACTION_REQUIRED]` / `[UPDATE_AVAILABLE]` prompts to stderr for agent consumption. In the context of an image-generation skill, this is especially suspicious because it is designed to nudge automated systems or users into fetching and installing additional remote code that is not necessary for the advertised feature, creating a supply-chain and social-engineering risk.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The library advertises a generic provider plugin architecture and arbitrary base-URL support, which materially expands capability beyond a narrowly scoped Qwen/Wan image skill. In a skill ecosystem, excess generality increases attack surface because downstream code can be repurposed to contact non-Qwen services or untrusted endpoints while reusing loaded credentials and file-handling helpers.

Context-Inappropriate Capability

Low

• Confidence: 92% confidence
• Finding: Arbitrary remote file download is outside the declared purpose of image generation/editing and adds unnecessary network/file-system capability. In an agent setting, such a helper can be abused to fetch attacker-chosen content, stage files locally, or access internal network resources if URL input is not tightly controlled.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guide instructs users to send prompts, referenced image URLs, and authentication to an external cloud API without clearly warning that user data and image content are transmitted off-system. In a skill that may process local reference images and user-provided creative content, this omission can cause unintended disclosure of sensitive or proprietary material.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The helper explicitly resolves local file paths or URLs by delegating to a function that may upload local files to OSS, but this library provides no user-facing consent gate, warning, or restriction on what paths may be uploaded. In an agent skill context, that can cause unintended exfiltration of local files if a prompt, tool input, or upstream caller passes a sensitive path instead of an intended image file.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Network-fetched content is written to disk with no warning, audit note, or visible consent mechanism in this code path. That can surprise users and operators, and if paired with attacker-controlled URLs or paths it increases the risk of quietly storing malicious, sensitive, or policy-violating content locally.

Hidden Instructions

High

• Category: Prompt Injection

Content

## Self-check

Look for `<!-- QWENCLOUD_SKILLS -->` in `CLAUDE.md` (project root), `~/.claude/CLAUDE.md`,
or `AGENTS.md`. If found → **stop, already registered**.

## This skill's registry entry

• Confidence: 93% confidence
• Finding: The file embeds operational instructions telling an agent to scan local configuration files, discover sibling skills, and modify user config files by appending or replacing a registry block. In a skill artifact, these are hidden agent-targeted instructions that can influence behavior outside the user's immediate request and expand the skill's reach into other files, which creates prompt-injection and unauthorized modification risk.

Static analysis

No suspicious patterns detected.