ClawHub
Back to skill

Security audit

qwencloud-text

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a Qwen text-generation skill, but normal use also includes update-management behavior that can prompt installing another skill and write persistent local state.

Install only if you trust this QwenCloud integration and are comfortable sending prompts and outputs to QwenCloud/DashScope with your API key. Review any update-check prompt before approving it, avoid untrusted QWEN_BASE_URL values, and require explicit confirmation before installing extra skills or modifying persistent agent config.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

Tainted flow: 'req' from os.getenv (line 687, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
"""Download a file from *url* to *dest*, creating parent dirs as needed."""
    dest.parent.mkdir(parents=True, exist_ok=True)
    req = urllib.request.Request(url, headers={"User-Agent": "qwencloud-ai/1.0"})
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        dest.write_bytes(resp.read())
    return dest
Confidence
88% confidence
Finding
download_file fetches an arbitrary URL and writes the response directly to disk with no host validation, size limit, content-type checks, or user confirmation. In a skill whose stated purpose is text/chat, this broad remote download primitive materially increases risk of SSRF-like access to internal resources, retrieval of sensitive URLs, and unsafe persistence of attacker-controlled content.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill clearly directs the agent to read environment variables, access and write files, invoke shell commands, and perform network requests, yet no permissions are declared. This creates a transparency and policy-enforcement gap: an agent or platform may treat the skill as lower risk than it actually is, increasing the chance of unintended secret access, command execution, or external communication.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The skill is presented as a Qwen text/chat interface, but the documented behavior extends into update management, installing another skill, persistent suppression state, skill discovery, and broader infrastructure not necessary for the stated purpose. This mismatch is dangerous because operators may approve or invoke the skill expecting narrow chat functionality while it can trigger additional system changes and expand trust boundaries.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to install and manage a separate skill via `npx skills add`, even when the user only intended to use text generation. That creates an unauthorized supply-chain expansion path: executing package/skill installation from within another skill can introduce unreviewed code and persistent changes to the environment.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill is a Qwen text skill, but it embeds update-management logic that prompts installation of and executes a separate skill from the same repository family. This creates an unexpected trust expansion and cross-skill execution path, which can lead agents or users to install or run extra code unrelated to the declared text-generation purpose.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
This file manages repository state in .agents/state.json, suppresses prompts, searches repository structure, and emits installation/update actions, all of which are outside the expected scope of a text-generation skill. In this context, hidden statefulness and maintenance behavior are more dangerous because they can influence agent behavior and user environment in ways not implied by the skill's advertised function.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The shared library includes upload and download primitives, managed-file resolution, and local-file-to-base64 conversion that are broader than the manifest's text/chat purpose. Excess capability increases attack surface and makes it easier for a text-oriented skill to move data in and out of the environment in ways users would not reasonably expect.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
Arbitrary remote file download is not justified by the declared purpose of a text/chat skill and creates a direct path to fetch attacker-controlled content or probe internal resources. Because the function also persists the result to disk, the impact is higher than a transient network request and can facilitate follow-on abuse by other components.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger keywords are broad enough to match very common requests such as 'chat', 'code', and 'text generation', which can cause this skill to activate outside clearly intended Qwen-specific contexts. In an agent ecosystem, overbroad activation increases the chance that the agent reads and follows bundled operational instructions like file discovery and config modification prompts, creating unnecessary prompt-surface expansion and possible unintended system changes.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The guide explicitly recommends prompting the model to 'Show reasoning before the answer,' which encourages disclosure of internal reasoning traces. In an agent skill that helps users construct prompts, this can normalize or propagate requests for hidden reasoning and may lead downstream integrations to solicit policy-sensitive chain-of-thought unnecessarily.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The function writes data fetched from a remote URL directly to disk without any warning, consent, or validation. Silent persistence of remote content is risky because users of a text/chat skill would not expect network-fetched files to be created locally, and attacker-controlled data could be stored for later execution or processing.

Ssd 2

Medium
Confidence
94% confidence
Finding
The prompt guide includes a concrete example that elicits chain-of-thought ('Think step by step. Show reasoning before the answer'), making the risky behavior easy for users or other components to copy verbatim. Because this skill is a prompt-authoring reference for a general text model, the unsafe phrasing is more dangerous than in a narrow educational context: it can systematically spread prompts that seek hidden reasoning across many use cases.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/prompt-guide.md:5