qwencloud-ops-auth

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:17 AM UTC
• Version: 0.2.1

Overview

The auth setup is mostly coherent, but it also includes an unrelated path to install or run other skills using unpinned commands, which should be reviewed before use.

Review this skill before installing. It is reasonable for QwenCloud auth help to use API keys, .env files, and verification calls, but avoid letting the agent write real secrets unless you understand the local storage risk. Treat the update-check installation path as sensitive: inspect and pin the installer/source first, or skip it unless you explicitly want this skill to modify your agent's installed skills.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/custom-oss.md:13

Finding

Unpinned Python Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: references/custom-oss.md:13
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code:

bash

pip install alibabacloud-oss-v2

Technical Analysis

The setup instructions install alibabacloud-oss-v2 without specifying a reviewed version or validating package integrity with cryptographic hashes. Consequently, the installed artifact depends on mutable package-index state at installation time.

Python package installation can execute package-controlled build and installation logic. If the package distribution, publishing account, package index, or dependency chain is compromised, following this instruction could execute attacker-controlled code. An unintended future release could also introduce incompatible or vulnerable behavior without any change to the audited skill.

Attack Path

1. An attacker compromises the package publisher, distribution channel, or a transitive dependency.
2. The attacker publishes a malicious release that satisfies the unrestricted package name.
3. A user follows the documented setup command.
4. pip resolves and downloads the mutable malicious release.
5. Package-controlled installation logic executes with the privileges of the user running pip.
6. The installed package may subsequently execute malicious behavior when imported or used.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user performing the installation. Depending on that user's access, the malicious package could read project files and environment variables, access configured API or OSS credentials, alter local files, or compromise other resources available to the account.

The project does not direct users to run the command with elevated privileges, so administrator or root access is not inherently obtained. The affected scope is the installation environment and re ...[truncated 40 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specifically reviewed version rather than installing an unrestricted latest release.
• Publish a locked requirements file containing exact versions and cryptographic hashes.
• Install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
• Review and lock transitive dependencies as well as the direct dependency.
• Use an isolated virtual environment with only the permissions required for the task.
• Periodically update the lock file through a controlled dependency-review process rather than implicitly accepting new releases.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:204

Finding

Unpinned Remote Skill Installation Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:204
Vulnerability Type: Unpinned npm CLI and mutable remote skill installation
Risk Level: Medium

Vulnerable Code:

bash

npx skills add QwenCloud/qwencloud-ai --skill qwencloud-update-check -y

Technical Analysis

The instruction invokes the skills npm CLI through npx without pinning the CLI version and requests skill content from QwenCloud/qwencloud-ai without specifying a reviewed commit or immutable release. The -y argument also suppresses package-installation confirmation.

This creates two mutable supply-chain boundaries:

1. npx may download and execute a current version of the named npm CLI.
2. The CLI may retrieve current remote skill content rather than the content present at audit time.

Therefore, the effective code and skill instructions executed or installed can change after this project has been reviewed. A compromised npm package, package publisher, source repository, or future upstream release could introduce attacker-controlled behavior.

Attack Path

1. A user asks the skill to check for updates.
2. The update-check skill is not present, and the user selects the documented installation option.
3. The agent runs the unpinned npx command.
4. npx resolves and executes a mutable version of the skills package.
5. The CLI retrieves mutable content from the remote QwenCloud repository.
6. Compromised CLI code can execute immediately, while compromised skill content can be installed locally and influence later agent operations when loaded.
7. The malicious component acts with the permissions available to the user or agent running the command.

Exploitation requires compromise or malicious modification of an upstream distribution point; the audited project does not itself contain an embedded malicious payload.

Impact Assessment

A malicious npm CLI could execute arbitrary code with the invoking user's pr ...[truncated 521 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills npm package to an exact reviewed version, rather than allowing npx to resolve a mutable release.
• Pin QwenCloud/qwencloud-ai to an immutable commit hash or cryptographically verified release artifact.
• Verify package and downloaded-content integrity using trusted hashes or signatures.
• Remove automatic confirmation suppression where practical, and show the resolved CLI version, source repository, revision, and destination before execution.
• Require explicit user confirmation immediately before downloading and executing remote components.
• Download and inspect remote skill content before installation instead of loading it directly into an active agent environment.
• Run installation in a restricted environment without unnecessary credentials or filesystem access.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (15)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

Create a .env file in your project root or current working directory:

bash

echo 'DASHSCOPE_API_KEY=sk-your-key-here' >> .env

The script automatically loads .env from the current working directory and the project root (detected via .git or skills/ directory). Existing environment variables are not overwritten by .env values.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

Create a .env file in your project root or current working directory:

bash

echo 'DASHSCOPE_API_KEY=sk-your-key-here' >> .env

The script automatically loads .env from the current working directory and the project root (detected via .git or skills/ directory). Existing environment variables are not overwritten by .env values.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

Create a .env file in your project root or current working directory:

bash

echo 'DASHSCOPE_API_KEY=sk-your-key-here' >> .env

The script automatically loads .env from the current working directory and the project root (detected via .git or skills/ directory). Existing environment variables are not overwritten by .env values.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

text

.env
.env.local
*.env

Self-Modification

High

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The mandatory post-execution update workflow directs the agent to check for and potentially install or modify skills, introducing self-modification behavior unrelated to authentication. Self-update or cross-skill mutation increases the blast radius of a compromised workflow and can lead to persistence or unreviewed code changes in the agent environment.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

md

## Update Check (MANDATORY Post-Execution)

When the user asks to check for updates (e.g. "check for updates", "check version", "is there a new version", "update skills"):

1. **Find qwencloud-update-check**: Look for `qwencloud-update-check/SKILL.md` in sibling skill directories.
2. **If found** — run: `python3 <qwencloud-update-check-dir>/scripts/check_update.py --print-response` and report the result. Use `--force` if the user asks to force-check.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill can install another skill via npx skills add, which is not justified by its stated purpose of configuring authentication. This grants the skill a software installation capability that can alter the environment and introduce arbitrary new code paths, making compromise or abuse significantly more impactful.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/codingplan.md (reported line 53)May include surrounding context.

md

| Error | Cause | Resolution |
|-------|-------|------------|
| `401 invalid access token` | `sk-` on coding-intl endpoint, or expired subscription | Use plan-specific key; check subscription status |
| `403 invalid api-key` | `sk-sp-` on standard DashScope endpoint | Use a standard key for scripts |
| `model 'xxx' is not supported` | Model not in Coding Plan list (case-sensitive) | Check model IDs above |
| `Coding Plan is currently only available for Coding Agents` | Script/curl calling coding-intl | Use through coding tools only, not scripts |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

When the API key is not configured or a script reports missing credentials:

1. **NEVER ask the user to provide their API key directly.** Do not prompt "please paste your API key" or similar. Do not request the key value in any form.
2. **Help create a `.env` file** with a placeholder, then instruct the user to fill in their own key:
   - Run: `echo 'DASHSCOPE_API_KEY=sk-your-key-here' >> .env`
   - Tell the user: "Please replace `sk-your-key-here` with your actual API key from the [QwenCloud Console](https://home.qwencloud.com/api-keys)."

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The instructions allow writing a real API key into .env if the user insists, but they do not require a contemporaneous warning that this stores a secret on disk and may expose it through backups, shell history, file permissions, or accidental commits. In a credential-management skill, omission of that warning makes unsafe secret handling more likely.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

### Environment Variables

| Variable            | Purpose                                                                                                                                   |
|---------------------|-------------------------------------------------------------------------------------------------------------------------------------------|
| `DASHSCOPE_API_KEY` | API key (required)                                                                                                                        |
| `QWEN_API_KEY`      | Alias for `DASHSCOPE_API_KEY`. If both are set, `QWEN_API_KEY` takes priority.                                                            |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

| Variable            | Purpose                                                                                                                                   |
|---------------------|-------------------------------------------------------------------------------------------------------------------------------------------|
| `DASHSCOPE_API_KEY` | API key (required)                                                                                                                        |
| `QWEN_API_KEY`      | Alias for `DASHSCOPE_API_KEY`. If both are set, `QWEN_API_KEY` takes priority.                                                            |
| `QWEN_BASE_URL`     | Override default endpoint (optional; for custom deployments)                                                                              |
| `QWEN_TMP_OSS_BUCKET` | Custom OSS bucket for file uploads (replaces 48h temp storage). See [custom-oss.md](references/custom-oss.md).                         |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

Unless explicitly stated otherwise, any script or task mentioned in this skill runs in the foreground — wait for standard output; do not run it as a background task.

Test authentication with a simple curl request:

bash

curl -sS -X POST "https://dashscope-intl.aliyuncs.com/compatible-mode/v1/chat/completions" \

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

An authentication setup skill contains an unrelated update-check and skill-installation workflow. This violates least functionality and broadens the skill's authority, increasing the chance that a user invoking auth help is steered into executing unrelated code or modifying their environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs the agent to execute npx skills add ..., which fetches and runs remote package-managed code without a pinned version or integrity control. In an authentication-focused skill, this creates unnecessary supply-chain risk: a compromised package, dependency, or newly published version could execute arbitrary code in the user's environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill instructs the agent to send an authenticated curl request using the user's API key to an external endpoint to test authentication. While this is expected for auth verification, the markdown does not explicitly warn the user at the command point that the command will transmit their credential to QwenCloud for validation.

Content

No source excerpt is available for this finding.