qwencloud-update-check

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:04 AM UTC
• Version: 0.2.1

Overview

The skill mostly performs a disclosed update check, but it also emits unpinned auto-confirming install/update commands that could change installed skills if followed.

Review this before installing. The update check itself is narrow, but do not let an agent automatically run the printed npx skills add ... -y commands. If you use it, treat update/install commands as manual actions, verify the QwenCloud/qwencloud-ai source and installer package version, and prefer a pinned installer or trusted lockfile.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/gossamer.py:24

Finding

Unpinned npx Package Creates a Supply-Chain Execution Risk

Content

View full analysis

str: skills = _read_installed_skills(repo) skill_args = " ".join(skills) if skills else "" return f"npx skills add {_SKILLS_REPO} --skill {skill_args} -y" ``` `scripts/gossamer.py:134-139`: ```python dismiss_install_prompt() print( f"[ACTION_REQUIRED] qwencloud-update-check skill is not installed. " f"Install: {INSTALL_CMD}", file=sys.stderr, ) ``` ### Technical Analysis The generated installation command invokes the unversioned npm package `skills` through `npx`. No exact package version or integrity value is specified, so the code selected by the package registry can change after this Skill has been reviewed. The `-y` option also suppresses the normal npm installation confirmation. The script prints this command rather than executing it directly. However, it emits the command through a structured `[ACTION_REQUIRED]` message explicitly intended for agents or users to parse and act upon. Consequently, following the recommendation may retrieve and execute mutable third-party package code. This behavior exceeds the minimum privileges required to perform a version check. Checking the remote `version.json` requires only a constrained HTTPS GET request; it does not require executing an unpinned npm package or installing remote Skill content. The separately flagged request in `scripts/check_update.py:58-70` does not itself expose sensitive information: it performs a GET to a fixed GitHub host using a fi ...[truncated 1648 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (6)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: qwencloud-update-check
description: "[QwenCloud] Check for qwencloud-ai updates and notify the user when a new version is available. TRIGGER when: user asks to check for updates, check version, asks 'is there a new version', 'latest version', 'update skills', 'check update', or any other qwen skill delegates to this skill, or user explicitly invokes this skill by name (e.g. use qwencloud-update-check). DO NOT TRIGGER when: non-update-related tasks, general version questions about other software."
compatibility: "Requires Python 3.9+ and curl. Cursor: auto-loaded. Claude Code: read this skill's SKILL.md before first use."
---

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises capabilities to read files, write state, access environment variables, use shell, and perform network requests, but it does not declare any explicit tool scope or permissions boundaries. In an auto-loaded skill that other skills may delegate to, this increases the chance of overbroad execution and makes it harder for a host platform to enforce least privilege or for reviewers to understand what the skill can actually do.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger text is overly broad because it activates not only on direct update-check requests but also whenever 'any other qwen skill delegates to this skill' and on generic phrases like 'latest version' or 'check update'. In an auto-loaded ecosystem, broad delegation criteria can cause unintended invocation, unnecessary network access, and execution in contexts the user did not clearly authorize.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command uses 'npx skills' without pinning a specific package version, so the resolved package can change over time and may pull a compromised or unexpected release. In an update/install workflow, this expands the supply-chain attack surface because users may be encouraged to run the command exactly as printed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This dynamically generated update command also relies on 'npx skills' with no version pinning, so it may fetch different code each time and could execute a compromised release during updates. Because this string is presented as the recommended remediation path for updates, it directly steers users toward an unpinned supply-chain dependency.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gossamer.py (reported line 120)May include surrounding context.

python

if not script.is_file():
                return
            try:
                proc = subprocess.run(
                    [sys.executable, str(script), "--print-response"],
                    capture_output=True, text=True, timeout=15,
                )

Static analysis

No suspicious patterns detected.