Qwen Web Agent

• Analyzed: May 9, 2026, 8:43 AM
• Findings: 1
• Version: 1.0.0
• Hash: 348c4a3487f946466c612dd74521376d8cc91b95dc05fc5215d78234761e22e0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The scripts 'qwen_agent.py' and 'qwen_multi_agent.py' contain hardcoded absolute file paths to a specific user's home directory ('/home/derek/文档/Derek_Obsidian_DB/...'), which is highly irregular for a shared skill bundle and could cause execution failures or unintended file writes on a target system. Additionally, the Playwright configuration uses the '--no-sandbox' flag, which unnecessarily increases the browser's attack surface. While the logic appears intended for Qwen AI automation, these hardcoded paths and security-weakening flags suggest a lack of sanitization and pose a risk to the host environment.