qwencloud-update-check

• Outcome: Pass
• Latest audit: May 28, 2026 · 11:35 AM UTC
• Version: 0.2.1

Overview

This is a disclosed QwenCloud update checker that reads version metadata, checks GitHub, writes a small local state file, and prints update commands without running installs itself.

Install only if you trust QwenCloud update notices. Expect occasional GitHub version checks and a persistent .agents/state.json timestamp/preference file. Review any printed npx skills add command before running it, especially if QWEN_SKILLS_REPO or skills-lock.json has been changed.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not script.is_file():
                return
            try:
                proc = subprocess.run(
                    [sys.executable, str(script), "--print-response"],
                    capture_output=True, text=True, timeout=15,
                )

• Confidence: 86% confidence
• Finding: The code executes a Python script located under the repository's skills directories without any trust validation, integrity check, or path ownership check. In a hostile or compromised repository, an attacker can place a malicious check_update.py at that expected location and get arbitrary code execution whenever this helper runs, making the update-check context more dangerous because the execution is automatic and appears routine.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no explicit permissions despite documented behavior requiring environment access, file reads/writes, network access, and shell execution. This undermines least-privilege review and can cause the skill to be invoked with broader capabilities than users or hosts expect, reducing transparency and increasing the chance of unsafe execution in agent environments.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 83% confidence
• Finding: The documented purpose is a narrow version check, but the analyzed behavior expands into installation detection, recommending update commands for multiple skills, and persisting prompt-suppression preferences. This mismatch is dangerous because operators may approve or auto-run the skill expecting a read-only check when it actually influences update workflows and writes persistent state, creating room for unauthorized or surprising actions.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger description includes broad conditions such as 'any other qwen skill delegates to this skill' and generic update-related phrasing, which increases the chance of unintended activation. In an agent system, overbroad triggers can cause network calls, file writes, or update-related guidance to occur in contexts where the user did not specifically request this skill, expanding attack surface and reducing user control.

Static analysis

No suspicious patterns detected.