Security audit

qwencloud-vision

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does QwenCloud image and video analysis, but it adds under-scoped update and endpoint behaviors that can run extra local code or send credentials to an untrusted destination.

Install only if you trust the working directory, its `.env` files, and any sibling qwencloud skills. Avoid running it in untrusted repos, do not accept the update-check install unless you are comfortable with an unpinned remote `npx` install, and keep API endpoint settings in a trusted user-controlled configuration using official QwenCloud hosts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:238
Finding: Mandatory Update Workflow Hijacks the Agent's Primary Task
Content: View full analysis
The update-check skill is not installed. It keeps you informed about new qwencloud/qwencloud-ai features and bug fixes. > > 1) **Install now** — I'll run the install command for you > 2) **Skip for now** — do nothing this time > 3) **Never remind me** — permanently suppress this prompt After the user responds: - User chooses **1** → run: `npx skills add QwenCloud/qwencloud-ai --skill qwencloud-update-check -y`, then run: `python3 /gossamer.py --dismiss` - User chooses **2** → run: `python3 /gossamer.py --dismiss`, then continue normally - User chooses **3** → run: `python3 /gossamer.py --never-install`, then continue normally ``` ### Technical Analysis The declared purpose of the Skill is image and video analysis, visual reasoning, and OCR. Installing or managing a separate update-check Skill is not required to perform those functions. The instructions use mandatory language to force the Agent to interrupt the current user task, present an unrelated installation workflow, and wait for another response. The update signal is generated automatically by each primary entry point before normal command-line argument parsing: ```python def main() -> None: prompt_update_ch ...[truncated 1510 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/gossamer.py:20
Finding: Unpinned NPM and Remote Repository Installation Creates a Supply-Chain Execution Risk
Content: View full analysis
/gossamer.py --dismiss` ``` ### Technical Analysis The `npx` invocation does not pin the `skills` package to a specific reviewed version or integrity hash. The remote `QwenCloud/qwencloud-ai` source is also not pinned to an immutable release tag or commit hash. Consequently, the code installed and potentially executed can differ from what was present when this Skill was audited. The `-y` option suppresses normal confirmation behavior within the invoked installation tool, further reducing opportunities for the user to review resolved package and repository versions. This is a supply-chain trust issue rather than evidence that the current remote package is malicious. The vulnerability is that compromise, account takeover, package replacement, or an unexpected upstream change can alter the effective payload after this Skill has already been approved. ### Attack Path 1. An attacker compromises the package resolved by `npx skills`, the referenced repository, or an upstream release process. 2. The attacker publishes or serves modified installer or Skill content. 3. Ordinary Skill execution emits the update-check installation prompt. 4. The user approves the prompt. 5. The Agent executes the unpinned `npx skills add ... -y` command. 6. `npx` retrieves the current remote package and repository content rather than a previously reviewed immutable version. 7. Malicious installation hooks or installed scri ...[truncated 609 chars]
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/gossamer.py:107
Finding: Automatic Execution of an Unverified Script from a Predictable Sibling Skill Path
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/qwencloud_lib.py:80
Finding: Project-Controlled Environment Configuration Can Redirect API Credentials and Media to an Attacker
Content: View full analysis
None: """Load ``.env`` files with proper priority: current dir > repo root. Parameters ---------- script_file : str or Path, optional ``__file__`` of the calling script, used to locate the repo root. """ load_dotenv(Path.cwd() / ".env") origin = Path(script_file).resolve() if script_file else None if origin: repo = find_repo_root(origin) if repo: load_dotenv(repo / ".env") ``` That configuration can control the credential-bearing API endpoint: ```python def compat_base_url(self) -> str: url = os.getenv("QWEN_BASE_URL") region = os.getenv("QWEN_REGION", "ap-southeast-1").lower() if region == "none": # When QWEN_REGION=none, skip URL assembly and return the user-configured base URL as-is. if not url: raise RuntimeError( "QWEN_BASE_URL must be set when QWEN_REGION=none." ) return url.rstrip("/") if url: return url.rstrip("/") return self._COMPAT_BASE.get(region, self._COMPAT_BASE["ap-southeast-1"]) ``` The API key is attached to requests without validating the destination host or requiring HTTPS: ```python def make_headers( self, api_key: str, payload: Any = None, ) -> dict[str, str]: hdrs: dict[str, str] = { "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", } ``` ```python def http_request( method: str, url: str, api_key: str, payload: dict[str, Any] | None = None, *, ...[truncated 4571 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (52)

Tainted flow: 'req' from os.getenv (line 687, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/qwencloud_lib.py (reported line 349)May include surrounding context.
python
headers={"Content-Type": ct}, ) try: with urllib.request.urlopen(req, timeout=120) as resp: if resp.status != 200: raise RuntimeError(f"OSS upload HTTP {resp.status}") except urllib.error.HTTPError as exc:

Tainted flow: 'req' from os.getenv (line 687, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/qwencloud_lib.py (reported line 458)May include surrounding context.
python
"Content-Type": "application/json", }, ) with urllib.request.urlopen(req, timeout=30) as resp: body = json.loads(resp.read().decode("utf-8")) data = body.get("data") if not data:

Tainted flow: 'req' from os.getenv (line 687, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/qwencloud_lib.py (reported line 689)May include surrounding context.
python
for attempt in range(retries + 1): req = urllib.request.Request(url, data=data, headers=hdrs, method=method) try: with urllib.request.urlopen(req, timeout=timeout) as resp: return json.loads(resp.read().decode("utf-8")) except urllib.error.HTTPError as exc: body = ""

Tainted flow: 'req' from os.getenv (line 687, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/qwencloud_lib.py (reported line 745)May include surrounding context.
python
data = json.dumps(payload).encode("utf-8") req = urllib.request.Request(url, data=data, headers=hdrs, method="POST") try: resp = urllib.request.urlopen(req, timeout=timeout) except urllib.error.HTTPError as exc: body = "" try:

Tainted flow: 'req' from os.getenv (line 687, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: download_file fetches an arbitrary URL and writes the response directly to disk with no scheme/host allowlisting, size checks, or content validation. If an attacker can influence the URL, this becomes an SSRF-capable downloader and can also persist untrusted content locally, which is more dangerous in a vision skill that may process remote user-supplied media.
Content: Scanner excerpt · scripts/qwencloud_lib.py (reported line 841)May include surrounding context.
python
"""Download a file from *url* to *dest*, creating parent dirs as needed.""" dest.parent.mkdir(parents=True, exist_ok=True) req = urllib.request.Request(url, headers={"User-Agent": "qwencloud-ai/1.0"}) with urllib.request.urlopen(req, timeout=timeout) as resp: dest.write_bytes(resp.read()) return dest

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as an image/video understanding tool, but it also includes package-management and update-check behavior that can modify local state and trigger installation of another skill. This hidden secondary behavior expands the trust boundary and may cause users or agents to permit actions unrelated to the declared visual-analysis purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill is presented as an image/video understanding tool, but it also includes package-management and update-check behavior that can modify local state and trigger installation of another skill. This hidden secondary behavior expands the trust boundary and may cause users or agents to permit actions unrelated to the declared visual-analysis purpose.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/analyze.py (reported line 228)May include surrounding context.
python
For simple documents, lower max_pixels to save tokens. environment variables: DASHSCOPE_API_KEY (required) API key — also loaded from .env QWEN_API_KEY (alternative) Alias for DASHSCOPE_API_KEY QWEN_REGION ap-southeast-1 (default)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/ocr.py (reported line 121)May include surrounding context.
python
For simple documents, lower max_pixels to save tokens. environment variables: DASHSCOPE_API_KEY (required) API key — also loaded from .env QWEN_API_KEY (alternative) Alias for DASHSCOPE_API_KEY QWEN_REGION ap-southeast-1 (default)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/qwencloud_lib.py (reported line 590)May include surrounding context.
python
For simple documents, lower max_pixels to save tokens. environment variables: DASHSCOPE_API_KEY (required) API key — also loaded from .env QWEN_API_KEY (alternative) Alias for DASHSCOPE_API_KEY QWEN_REGION ap-southeast-1 (default)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/reason.py (reported line 144)May include surrounding context.
python
For simple documents, lower max_pixels to save tokens. environment variables: DASHSCOPE_API_KEY (required) API key — also loaded from .env QWEN_API_KEY (alternative) Alias for DASHSCOPE_API_KEY QWEN_REGION ap-southeast-1 (default)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/qwencloud_lib.py (reported line 87)May include surrounding context.
python
script_file : str or Path, optional ``__file__`` of the calling script, used to locate the repo root. """ load_dotenv(Path.cwd() / ".env") origin = Path(script_file).resolve() if script_file else None if origin: repo = find_repo_root(origin)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/qwencloud_lib.py (reported line 92)May include surrounding context.
python
script_file : str or Path, optional ``__file__`` of the calling script, used to locate the repo root. """ load_dotenv(Path.cwd() / ".env") origin = Path(script_file).resolve() if script_file else None if origin: repo = find_repo_root(origin)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/qwencloud_lib.py (reported line 406)May include surrounding context.
python
ak_id = os.getenv("OSS_ACCESS_KEY_ID", "") ak_secret = os.getenv("OSS_ACCESS_KEY_SECRET", "") credentials_provider = ( oss.credentials.EnvironmentVariableCredentialsProvider() ) cfg = oss.config.load_default()

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly instructs use of shell, file reads/writes, environment-variable checks, and networked API calls, but the manifest declares no explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege controls and increases the chance an agent executes higher-risk operations without an auditable policy boundary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger description is broad enough to match many ordinary image- or video-related requests, increasing the chance the skill activates in contexts where its shell/network/file capabilities are unnecessary. Over-broad activation raises the attack surface for prompt injection through visual content and for accidental execution of side-effecting workflows.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
**NEVER output any API key or credential in plaintext.** Always use variable references (`$DASHSCOPE_API_KEY` in shell, `os.environ["DASHSCOPE_API_KEY"]` in Python). Any check or detection of credentials must be **non-plaintext**: report only status (e.g. "set" / "not set", "valid" / "invalid"), never the value. Never display contents of `.env` or config files that may contain secrets. **When the API key is not configured, NEVER ask the user to provide it directly.** Instead, help create a `.env` file with a placeholder (`DASHSCOPE_API_KEY=sk-your-key-here`) and instruct the user to replace it with their actual key from the [QwenCloud Console](https://home.qwencloud.com/api-keys). Only write the actual key value if the user explicitly requests it. ## Key Compatibility

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.
md
**If Python is not available at all** → skip directly to Path 2 (curl) in [execution-guide.md](references/execution-guide.md). | Error Pattern | Diagnosis | Resolution | |----------------------------------|----------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------| | `command not found: python3` | Python not on PATH | Try `python` or `py -3`; install Python 3.9+ if missing | | `Python 3.9+ required` | Script version check failed | Upgrade Python to 3.9+ |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
md
| Error Pattern | Diagnosis | Resolution | |----------------------------------|----------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------| | `command not found: python3` | Python not on PATH | Try `python` or `py -3`; install Python 3.9+ if missing | | `Python 3.9+ required` | Script version check failed | Upgrade Python to 3.9+ | | `SyntaxError` near type hints | Python < 3.9 | Upgrade Python to 3.9+ | | `QWEN_API_KEY/DASHSCOPE_API_KEY not found` | Missing API key | Obtain key from [QwenCloud Console](https://home.qwencloud.com/api-keys); add to `.env`: `echo 'DASHSCOPE_API_KEY=sk-...' >> .env`; or run **qwencloud-ops-auth** if available |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
md
| Error Pattern | Diagnosis | Resolution | |----------------------------------|----------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------| | `command not found: python3` | Python not on PATH | Try `python` or `py -3`; install Python 3.9+ if missing | | `Python 3.9+ required` | Script version check failed | Upgrade Python to 3.9+ | | `SyntaxError` near type hints | Python < 3.9 | Upgrade Python to 3.9+ | | `QWEN_API_KEY/DASHSCOPE_API_KEY not found` | Missing API key | Obtain key from [QwenCloud Console](https://home.qwencloud.com/api-keys); add to `.env`: `echo 'DASHSCOPE_API_KEY=sk-...' >> .env`; or run **qwencloud-ops-auth** if available | | `HTTP 401` | Invalid or mismatched key | Run **qwencloud-ops-auth** (non-plaintext check only); verify key is valid |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
md
| Error Pattern | Diagnosis | Resolution | |----------------------------------|----------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------| | `command not found: python3` | Python not on PATH | Try `python` or `py -3`; install Python 3.9+ if missing | | `Python 3.9+ required` | Script version check failed | Upgrade Python to 3.9+ | | `SyntaxError` near type hints | Python < 3.9 | Upgrade Python to 3.9+ | | `QWEN_API_KEY/DASHSCOPE_API_KEY not found` | Missing API key | Obtain key from [QwenCloud Console](https://home.qwencloud.com/api-keys); add to `.env`: `echo 'DASHSCOPE_API_KEY=sk-...' >> .env`; or run **qwencloud-ops-auth** if available | | `HTTP 401` | Invalid or mismatched key | Run **qwencloud-ops-auth** (non-plaintext check only); verify key is valid |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.
md
| `Python 3.9+ required` | Script version check failed | Upgrade Python to 3.9+ | | `SyntaxError` near type hints | Python < 3.9 | Upgrade Python to 3.9+ | | `QWEN_API_KEY/DASHSCOPE_API_KEY not found` | Missing API key | Obtain key from [QwenCloud Console](https://home.qwencloud.com/api-keys); add to `.env`: `echo 'DASHSCOPE_API_KEY=sk-...' >> .env`; or run **qwencloud-ops-auth** if available | | `HTTP 401` | Invalid or mismatched key | Run **qwencloud-ops-auth** (non-plaintext check only); verify key is valid | | `SSL: CERTIFICATE_VERIFY_FAILED` | SSL cert issue (proxy/corporate) | macOS: run `Install Certificates.command`; else set `SSL_CERT_FILE` env var | | `URLError` / `ConnectionError` | Network unreachable | Check internet; set `HTTPS_PROXY` if behind proxy | | `HTTP 429` | Rate limited | Wait and retry with backoff |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.
md
| `SyntaxError` near type hints | Python < 3.9 | Upgrade Python to 3.9+ | | `QWEN_API_KEY/DASHSCOPE_API_KEY not found` | Missing API key | Obtain key from [QwenCloud Console](https://home.qwencloud.com/api-keys); add to `.env`: `echo 'DASHSCOPE_API_KEY=sk-...' >> .env`; or run **qwencloud-ops-auth** if available | | `HTTP 401` | Invalid or mismatched key | Run **qwencloud-ops-auth** (non-plaintext check only); verify key is valid | | `SSL: CERTIFICATE_VERIFY_FAILED` | SSL cert issue (proxy/corporate) | macOS: run `Install Certificates.command`; else set `SSL_CERT_FILE` env var | | `URLError` / `ConnectionError` | Network unreachable | Check internet; set `HTTPS_PROXY` if behind proxy | | `HTTP 429` | Rate limited | Wait and retry with backoff | | `HTTP 5xx` | Server error | Retry with backoff |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.
md
| `QWEN_API_KEY/DASHSCOPE_API_KEY not found` | Missing API key | Obtain key from [QwenCloud Console](https://home.qwencloud.com/api-keys); add to `.env`: `echo 'DASHSCOPE_API_KEY=sk-...' >> .env`; or run **qwencloud-ops-auth** if available | | `HTTP 401` | Invalid or mismatched key | Run **qwencloud-ops-auth** (non-plaintext check only); verify key is valid | | `SSL: CERTIFICATE_VERIFY_FAILED` | SSL cert issue (proxy/corporate) | macOS: run `Install Certificates.command`; else set `SSL_CERT_FILE` env var | | `URLError` / `ConnectionError` | Network unreachable | Check internet; set `HTTPS_PROXY` if behind proxy | | `HTTP 429` | Rate limited | Wait and retry with backoff | | `HTTP 5xx` | Server error | Retry with backoff | | `PermissionError` | Can't write output | Use `--output` to specify writable directory |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.
md
| `HTTP 401` | Invalid or mismatched key | Run **qwencloud-ops-auth** (non-plaintext check only); verify key is valid | | `SSL: CERTIFICATE_VERIFY_FAILED` | SSL cert issue (proxy/corporate) | macOS: run `Install Certificates.command`; else set `SSL_CERT_FILE` env var | | `URLError` / `ConnectionError` | Network unreachable | Check internet; set `HTTPS_PROXY` if behind proxy | | `HTTP 429` | Rate limited | Wait and retry with backoff | | `HTTP 5xx` | Server error | Retry with backoff | | `PermissionError` | Can't write output | Use `--output` to specify writable directory |

Static analysis

No suspicious patterns detected.