Security audit
Security checks for vulnerabilities and agentic risk
The verdict is benign because the scanners report no confirmed harmful behavior, though they flag a mismatch between the skill’s described Qwen capabilities and its authentication and CLI setup instructions.
The verdict is benign with medium confidence, not a guarantee of safety. Before installing, consider that the skill’s described model capabilities are not demonstrated by the supplied content, that its CLI package behavior was not established by the scan, and that some references could not be resolved.
The supplied code only sets an authentication credential. It contains no model invocation, input handling, or connection to Qwen that would establish this as a supporting implementation detail of the declared functionality.
The supplied code only configures CLI authentication; it does not invoke Qwen, process text or images, or perform reasoning. Authentication could support a model integration, but no such integration is present in this chunk. There is no evidence of credential exfiltration.
The only supplied behavior is a CLI login command, which is materially different from the declared model functionality. Nothing in the chunk establishes that this login is a supporting implementation step for accessing Qwen. The command's specific authentication mechanism and downstream effects cannot be determined from this snippet.
The only supplied behavior is a login command, which is materially different from the declared model capabilities. Nothing in the chunk connects this authentication operation to the described model service or establishes it as a supporting implementation detail. The command's authentication mechanism and effects cannot be determined from this snippet.
The description presents a reasoning model, while the supplied content is a generic external CLI invocation with no visible connection to Qwen. This is a material description-behavior mismatch, although the package's downstream behavior cannot be determined from this chunk alone.
The supplied chunk is a generic external CLI invocation rather than an implementation of the described model capabilities. Although a CLI could support model access, neither the command nor any integration establishing that relationship is provided. The package's downstream behavior cannot be determined from this snippet, so no additional capabilities or malicious behavior are inferred.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |