qwencloud-usage

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 0.2.1

Overview

The skill is mostly coherent, but it tells agents to globally install an unpinned third-party CLI that will handle QwenCloud login, credentials, usage, and billing data.

Install only if you trust the QwenCloud CLI package source and are comfortable with a persistent global CLI handling your QwenCloud session and billing information. Prefer installing a reviewed pinned version in a constrained environment, and check where credentials will be stored before logging in.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Global Installation of a Third-Party CLI Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-21
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

markdown

If not installed, run:

```bash
npm install -g @qwencloud/qwencloud-cli

text

### Technical Analysis

The Skill instructs the agent to install `@qwencloud/qwencloud-cli` from npm without specifying a reviewed version or integrity value. Consequently, the package contents installed at runtime may differ from those reviewed when the Skill was published.

npm installation can execute package lifecycle scripts. The `-g` option also installs the package globally rather than confining it to a project-local environment, increasing its filesystem reach and making its executable available to other sessions. This is particularly sensitive because the installed CLI subsequently handles QwenCloud authentication credentials, account usage, and billing information.

The audit did not establish that the referenced package is currently malicious. The vulnerability is the unsafe and mutable dependency installation process, which creates a supply-chain execution path if the package, its publisher account, or a transitive dependency is compromised.

### Attack Path

1. An attacker compromises the npm publisher account, the package release process, or a transitive dependency used by `@qwencloud/qwencloud-cli`.
2. The attacker publishes a malicious release under the same package name or introduces a malicious lifecycle script into the dependency chain.
3. The Skill is invoked on a system where `qwencloud` is not installed.
4. Following the Skill instructions, the agent executes `npm install -g @qwencloud/qwencloud-cli`.
5. npm retrieves the mutable latest release and may execute attacker-controlled lifecycle scripts with the privileges of the user running the installation.
6. The malicious package can modify user-accessible files, replace the
...[truncated 665 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specific version that has been reviewed, for example:

   bash

   npm install --save-exact @qwencloud/qwencloud-cli@<reviewed-version>
   

2. Record and verify package integrity through a committed lockfile or an equivalent trusted checksum mechanism.
3. Prefer a project-local, isolated installation over npm install -g so the package cannot broadly affect the user's command environment.
4. Require explicit user approval before installing any missing dependency; do not allow the agent to install it automatically.
5. Verify that the package originates from the expected npm registry and official publisher before installation.
6. Review package lifecycle scripts and transitive dependencies. Where compatible with the verified package, disable installation scripts using --ignore-scripts.
7. Execute the CLI under a minimally privileged account or sandbox with access limited to the credential and network resources required for QwenCloud operations.
8. Reassess and approve dependency upgrades instead of automatically consuming the latest release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

qwencloud usage breakdown --model qwen3.6-plus --period month

text

## Output and Agent Display Rules

CLI commands return JSON by default in agent/pipe environments (`auto` format: TTY → table, pipe → json).
**JSON is the primary output mode for agents** — always pass `--format json` explicitly, parse the structured response, then present a human-readable summary to the user.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

### Environment Variables

| Variable                    | Description                                                                                  |
|-----------------------------|----------------------------------------------------------------------------------------------|
| `QWENCLOUD_KEYRING`         | Set to `plaintext`, `no`, `0`, `false`, or `off` to opt out of OS keychain credential storage. |
| `QWENCLOUD_CREDENTIALS_DIR` | Override file-based credential directory (default: `~/.qwencloud/credentials`).              |