Security audit

qwencloud-model-selector

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a Qwen model-advice skill, but it asks agents to install/run external tools and persistently modify agent configuration in ways users should review first.

Install only if you trust the QwenCloud CLI and any sibling qwencloud-* skills on your machine. Before approving actions, ask to see exact commands and any CLAUDE.md or AGENTS.md diffs, avoid global unpinned installs where possible, and do not let untrusted model names or search text be interpolated into shell commands.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: references/pricing-disclaimer.md:51
Finding: Mandatory Provider-Controlled Output and Link Injection
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: references/agent-compatibility.md:17
Finding: Persistent Agent Configuration Poisoning Through Skill Registration
Content: View full analysis
## QwenCloud Skills When a request matches a skill below, read its SKILL.md before responding. ``` ``` The remaining generated block adds discovered Skill paths and trigger keywords to `CLAUDE.md`, `~/.claude/CLAUDE.md`, or `AGENTS.md`. ### Technical Analysis The compatibility procedure scans project-level and user-level Skill directories, extracts instructions from sibling Skill frontmatter, and writes persistent loading rules into Agent configuration files. These files influence future conversations and therefore act as long-term Agent memory or policy state. Although the document says to ask the user before modification, the requested operation remains broader than the declared model-selection function. It registers not only the current Skill but every matching sibling `qwencloud-*` Skill found in selected directories. A malicious or compromised sibling can therefore obtain future execution opportunities through the generated registry without being individually reviewed. The first-match search behavior also creates a path-precedence risk. An attacker who can place a matching Skill in an earlier s ...[truncated 1356 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:38
Finding: Unpinned Global Installation of a Mutable npm Package
Content: View full analysis
Remediation: View remediation
`. 2. Publish and verify package integrity hashes, signatures, or npm provenance attestations. 3. Avoid global installation; use a project-local dependency or a sandboxed package runner with an exact version. 4. Require explicit user approval before installing any package. 5. Display the package name, exact version, registry origin, required permissions, and expected network access before installation. 6. Disable lifecycle scripts where operationally possible, or audit all lifecycle scripts before execution. 7. Use a lockfile and a trusted registry configuration. 8. Run the CLI with least privilege and isolate its configuration and credential storage. 9. Document an uninstall and cleanup procedure for the installed binary and local session data. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/cli-usage.md:45
Finding: Unvalidated User Input in Shell-Style CLI Command Templates
Content: View full analysis
--format json` | | Keyword search | `qwencloud models search "" --format json` | | Free tier remaining | `qwencloud usage free-tier --format json` | ``` Related interpolation guidance appears in `references/error-handling.md:18`: ```markdown Run `qwencloud models search "" --format json` ``` ### Technical Analysis The documentation instructs the Agent to interpolate model IDs, search queries, and approximate keywords into shell-style command strings. It does not require validation, escaping, argument-array execution, or avoidance of a command shell. Wrapping a query in double quotes is not a sufficient defense if the input itself can contain a double quote, command substitution, shell expansion, or other metacharacters. A model identifier is even shown without quoting. If an Agent implementation passes the constructed string to `sh`, `bash`, PowerShell, or a comparable shell, attacker-controlled input may escape the intended argument and execute additional commands. The vulnerability depends on the Agent’s command execution API. An implementation that invokes the executable directly with a fixed argument array would not be vulnerable to shell interpretation. The Skill does not require that safer mechanism, leaving downstream Agents exposed. ### Attack Path 1. An attacker asks for information about a crafted model ID or supplies a malicious search query. 2. The Agent inserts the value into one of the documented command templates. 3. The Agent executes the resulting string throug ...[truncated 1054 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Rogue AgentSelf-Modification, Session Persistence
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (23)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
| Location | Purpose | |-------------------------------------------|----------------------------------------------------------------------------------| | `references/cli-usage.md` | **CLI-first data strategy**: when to use CLI, 3-step login flow, display rules | | `references/error-handling.md` | CLI error classification & recovery actions (auth, not-found, network, ...) | | `references/recommendation-matrix.md` | Full model recommendation tables, Cross-Skill Resolution, Coding Plan, Thinking | | `references/pricing-disclaimer.md` | Pricing guidance + **mandatory** cost-estimation disclaimer (CN/EN) + console links |

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.
md
| Location | Purpose | |-------------------------------------------|----------------------------------------------------------------------------------| | `references/cli-usage.md` | **CLI-first data strategy**: when to use CLI, 3-step login flow, display rules | | `references/error-handling.md` | CLI error classification & recovery actions (auth, not-found, network, ...) | | `references/recommendation-matrix.md` | Full model recommendation tables, Cross-Skill Resolution, Coding Plan, Thinking | | `references/pricing-disclaimer.md` | Pricing guidance + **mandatory** cost-estimation disclaimer (CN/EN) + console links |

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · references/cli-usage.md (reported line 120)May include surrounding context.
md
| Location | Purpose | |-------------------------------------------|----------------------------------------------------------------------------------| | `references/cli-usage.md` | **CLI-first data strategy**: when to use CLI, 3-step login flow, display rules | | `references/error-handling.md` | CLI error classification & recovery actions (auth, not-found, network, ...) | | `references/recommendation-matrix.md` | Full model recommendation tables, Cross-Skill Resolution, Coding Plan, Thinking | | `references/pricing-disclaimer.md` | Pricing guidance + **mandatory** cost-estimation disclaimer (CN/EN) + console links |

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
md
| Free tier remaining | `qwencloud usage free-tier --format json` | | Auth status | `qwencloud auth status --format json` | **Display rules**: Parse `--format json` output and present a human-readable summary; never dump raw JSON. Display `--format text` output as-is, then add analysis after `---`. See [cli-usage.md](references/cli-usage.md#agent-display-rules-for-cli-output) for details.

Self-Modification

High

Category: Rogue Agent
Confidence: 91% confidence
Finding: The skill instructs the agent to discover a sibling skill directory and execute a Python script from it. Running code from another local skill path creates a trust-boundary violation: a malicious or tampered sibling skill could supply an unexpected script and gain code execution in the agent context.
Content: Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.
md
## Update Check When the user asks to check for updates ("check for updates", "check version", "is there a new version", "update skills"): 1. **Find qwencloud-update-check**: Look for `qwencloud-update-check/SKILL.md` in sibling skill directories. 2. **If found** — run: `python3 <qwencloud-update-check-dir>/scripts/check_update.py --print-response`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/cli-usage.md (reported line 58)May include surrounding context.
All qwencloud models and qwencloud usage commands require an active CLI session (browser device-flow login — see Authentication Model above; this is NOT the API key). When CLI returns Not authenticated / AUTH_REQUIRED / 401, do not fall back to snapshots immediately, and do not ask the user for an API key. Run this flow:

Step 1 — Check status

bash

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to detect the host OS and execute platform-specific commands such as open, xdg-open, and start to launch a browser. Even though the stated purpose is authentication, this is still agent-initiated command execution based on dynamic environment data and a returned URL, which expands the attack surface and can trigger unintended local actions in sandboxed or privileged environments.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/model-list.md (reported line 8)May include surrounding context.
md
## Text Generation — Commercial | Model ID | Context | Thinking | Key Info | |-------------------|-------------------------------------|------------------|------------------------------------------------------------------------------------------------------------------------------------| | qwen3-max | 256K | Yes (hybrid) | Strongest. Built-in tools (web search, code interpreter). Tiered pricing. | | qwen3.6-plus | 1M | Yes (default on) | **Latest flagship.** Multimodal (text + image + video). Best balance of quality, speed, cost. Surpasses qwen3-vl series. Tiered pricing. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/model-list.md (reported line 13)May include surrounding context.
md
| qwen3-max | 256K | Yes (hybrid) | Strongest. Built-in tools (web search, code interpreter). Tiered pricing. | | qwen3.6-plus | 1M | Yes (default on) | **Latest flagship.** Multimodal (text + image + video). Best balance of quality, speed, cost. Surpasses qwen3-vl series. Tiered pricing. | | qwen3.5-plus | 1M | Yes (default on) | Multimodal (text + image + video input). On par with qwen3-max for text; surpasses qwen3-vl series for vision. Tiered pricing. | | qwen3.5-flash | 1M | Yes (default on) | Fastest Qwen3.5. Tiered pricing. | | qwen-plus | 1M | Yes (hybrid) | General purpose (Qwen3 series). Tiered pricing. | | qwen-flash | 1M | Yes (hybrid) | Economy. Tiered pricing. Context cache supported. | | qwen-turbo | 1M (non-thinking) / 128K (thinking) | Yes (hybrid) | Cheapest per-token. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/model-list.md (reported line 20)May include surrounding context.
md
| qwen3-max | 256K | Yes (hybrid) | Strongest. Built-in tools (web search, code interpreter). Tiered pricing. | | qwen3.6-plus | 1M | Yes (default on) | **Latest flagship.** Multimodal (text + image + video). Best balance of quality, speed, cost. Surpasses qwen3-vl series. Tiered pricing. | | qwen3.5-plus | 1M | Yes (default on) | Multimodal (text + image + video input). On par with qwen3-max for text; surpasses qwen3-vl series for vision. Tiered pricing. | | qwen3.5-flash | 1M | Yes (default on) | Fastest Qwen3.5. Tiered pricing. | | qwen-plus | 1M | Yes (hybrid) | General purpose (Qwen3 series). Tiered pricing. | | qwen-flash | 1M | Yes (hybrid) | Economy. Tiered pricing. Context cache supported. | | qwen-turbo | 1M (non-thinking) / 128K (thinking) | Yes (hybrid) | Cheapest per-token. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/model-list.md (reported line 14)May include surrounding context.
md
| qwen3.6-plus | 1M | Yes (default on) | **Latest flagship.** Multimodal (text + image + video). Best balance of quality, speed, cost. Surpasses qwen3-vl series. Tiered pricing. | | qwen3.5-plus | 1M | Yes (default on) | Multimodal (text + image + video input). On par with qwen3-max for text; surpasses qwen3-vl series for vision. Tiered pricing. | | qwen3.5-flash | 1M | Yes (default on) | Fastest Qwen3.5. Tiered pricing. | | qwen-plus | 1M | Yes (hybrid) | General purpose (Qwen3 series). Tiered pricing. | | qwen-flash | 1M | Yes (hybrid) | Economy. Tiered pricing. Context cache supported. | | qwen-turbo | 1M (non-thinking) / 128K (thinking) | Yes (hybrid) | Cheapest per-token. | | qwq-plus | 128K | Always-on CoT | Reasoning specialist. Max CoT 32K, response 8K. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/model-list.md (reported line 17)May include surrounding context.
md
| qwen3.6-plus | 1M | Yes (default on) | **Latest flagship.** Multimodal (text + image + video). Best balance of quality, speed, cost. Surpasses qwen3-vl series. Tiered pricing. | | qwen3.5-plus | 1M | Yes (default on) | Multimodal (text + image + video input). On par with qwen3-max for text; surpasses qwen3-vl series for vision. Tiered pricing. | | qwen3.5-flash | 1M | Yes (default on) | Fastest Qwen3.5. Tiered pricing. | | qwen-plus | 1M | Yes (hybrid) | General purpose (Qwen3 series). Tiered pricing. | | qwen-flash | 1M | Yes (hybrid) | Economy. Tiered pricing. Context cache supported. | | qwen-turbo | 1M (non-thinking) / 128K (thinking) | Yes (hybrid) | Cheapest per-token. | | qwq-plus | 128K | Always-on CoT | Reasoning specialist. Max CoT 32K, response 8K. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/model-list.md (reported line 15)May include surrounding context.
md
| qwen3.5-plus | 1M | Yes (default on) | Multimodal (text + image + video input). On par with qwen3-max for text; surpasses qwen3-vl series for vision. Tiered pricing. | | qwen3.5-flash | 1M | Yes (default on) | Fastest Qwen3.5. Tiered pricing. | | qwen-plus | 1M | Yes (hybrid) | General purpose (Qwen3 series). Tiered pricing. | | qwen-flash | 1M | Yes (hybrid) | Economy. Tiered pricing. Context cache supported. | | qwen-turbo | 1M (non-thinking) / 128K (thinking) | Yes (hybrid) | Cheapest per-token. | | qwq-plus | 128K | Always-on CoT | Reasoning specialist. Max CoT 32K, response 8K. | | qwen3-coder-next | 256K | No | Top code recommendation. Balances quality, speed, cost. Agentic coding, multi-turn tool calling. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/model-list.md (reported line 16)May include surrounding context.
md
| qwen3.5-flash | 1M | Yes (default on) | Fastest Qwen3.5. Tiered pricing. | | qwen-plus | 1M | Yes (hybrid) | General purpose (Qwen3 series). Tiered pricing. | | qwen-flash | 1M | Yes (hybrid) | Economy. Tiered pricing. Context cache supported. | | qwen-turbo | 1M (non-thinking) / 128K (thinking) | Yes (hybrid) | Cheapest per-token. | | qwq-plus | 128K | Always-on CoT | Reasoning specialist. Max CoT 32K, response 8K. | | qwen3-coder-next | 256K | No | Top code recommendation. Balances quality, speed, cost. Agentic coding, multi-turn tool calling. | | qwen3-coder-plus | 1M | No | Best code model. Tiered pricing. Context cache supported. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/model-list.md (reported line 21)May include surrounding context.
md
| qwen3-coder-next | 256K | No | Top code recommendation. Balances quality, speed, cost. Agentic coding, multi-turn tool calling. | | qwen3-coder-plus | 1M | No | Best code model. Tiered pricing. Context cache supported. | | qwen3-coder-flash | 1M | No | Fast code model. Tiered pricing. | | qwen-plus-character-ja | 32K | No | Role-playing, Japanese. Recommended for Singapore. | | qwen-plus-character | 32K | No | Role-playing, character restoration, empathetic dialog. | | qwen-flash-character | 8K | No | Role-playing, fast, lower cost. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/model-list.md (reported line 23)May include surrounding context.
md
| qwen3-coder-flash | 1M | No | Fast code model. Tiered pricing. | | qwen-plus-character-ja | 32K | No | Role-playing, Japanese. Recommended for Singapore. | | qwen-plus-character | 32K | No | Role-playing, character restoration, empathetic dialog. | | qwen-flash-character | 8K | No | Role-playing, fast, lower cost. | ## Vision — Commercial

Behavior Manipulation

Medium

Category: Prompt Injection
Confidence: 75% confidence
Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
Content: Scanner excerpt · references/pricing-disclaimer.md (reported line 81)May include surrounding context.
md
**explicitly state each assumption** used in the calculation. - Never present estimated costs as exact or guaranteed amounts. Use hedging language such as "approximately", "estimated at", "roughly" (or Chinese equivalents "约", "预估", "约合") throughout the cost breakdown. - **Never tell the user a call will be free or cost $0/¥0.** Even if a free quota exists, the user may have already consumed it. Always present the paid price and note that a free quota *may* apply — subject to the user verifying in their console. - **If pricing data is unavailable or uncertain, say so explicitly and link to the official pricing page.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/recommendation-matrix.md (reported line 81)May include surrounding context.
md
### Vision Models | Use Case | Recommended | Why | |--------------------------------|----------------|--------------------------------------------------------------------------------------------------------------------------------| | Best accuracy | qwen3.6-plus | **Latest flagship.** Multimodal (text + image + video). Surpasses qwen3-vl series on many benchmarks. Thinking on by default. | | High-precision localization | qwen3-vl-plus | Highest vision understanding for object localization (2D/3D), document/webpage parsing. Thinking mode. 256K context. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/recommendation-matrix.md (reported line 86)May include surrounding context.
md
| Best accuracy | qwen3.6-plus | **Latest flagship.** Multimodal (text + image + video). Surpasses qwen3-vl series on many benchmarks. Thinking on by default. | | High-precision localization | qwen3-vl-plus | Highest vision understanding for object localization (2D/3D), document/webpage parsing. Thinking mode. 256K context. | | Fast analysis | qwen3-vl-flash | Quick image understanding. Thinking mode supported. | | Visual reasoning (math/charts) | qvq-max | Always-on CoT for visual reasoning | | OCR specialist | qwen-vl-ocr | Document/scan text extraction, max 30K tokens/image | | Unified text+vision | qwen3.6-plus | Best when both text quality and vision matter. 1M context. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/recommendation-matrix.md (reported line 126)May include surrounding context.
md
### Omni Models | Use Case | Recommended | Why | |---------------------|---------------------------|---------------------------------------------------------------------------------------| | Voice + vision chat | qwen3-omni-flash | Text/image/audio/video → text or speech. 49 voices, 10 languages. Thinking supported. | | Real-time voice | qwen3-omni-flash-realtime | Streaming audio input + built-in VAD. 49 voices. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/recommendation-matrix.md (reported line 155)May include surrounding context.
md
Several models support hybrid thinking/non-thinking modes: | Model | Thinking Default | Notes | |-------------------------------------|------------------|-----------------------------------------------------------------------------------------------| | qwen3.6-plus | **On** | Latest flagship. Thinking enabled by default. Use `enable_thinking: false` to disable. | | qwen3.5-plus | **On** | Thinking enabled by default. Use `enable_thinking: false` to disable. |

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The entry for qwen-plus-character-ja states 'Recommended for Singapore,' which introduces a locale-specific recommendation in natural language without explaining why that locale is required or offering user choice. This can conflict with language/locale policy guidance that discourages forcing or biasing toward a locale absent opt-in or clear justification.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · references/pricing-disclaimer.md (reported line 51)May include surrounding context.
md
> [official pricing page](https://docs.qwencloud.com/developer-guides/getting-started/pricing). > Outputting a made-up price is a **critical failure** — worse than saying "I don't know." When responding to **any** cost-related query — including but not limited to price evaluation, usage estimation, budget forecasting, or cost comparison — you **MUST** append a professional disclaimer. This applies regardless of language or response format.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T02 · Agent Memory Poisoning

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Direct Prompt Extraction

Direct Prompt Extraction

Direct Prompt Extraction

Direct Prompt Extraction

Self-Modification

Autonomous Decision Making

Step 1 — Check status

Context-Inappropriate Capability

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Behavior Manipulation

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Natural-Language Policy Violations

Scope Creep