Qoder Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:58 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Qoder coding integration, but it needs review because it gives an external CLI broad access to prompts, files, directories, and the full environment while also suggesting sensitive non-code uses like email analysis without safeguards.

Install only if you trust the local `qoder` binary and the Alibaba Cloud/Qoder service with the prompts, source files, directories, and environment variables available in your session. Avoid using the email-analysis/reporting examples on sensitive communications, store API keys with restrictive permissions or a secret manager, and run refactor or project-wide analysis only in a controlled workspace after reviewing intended file changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Copying the full parent environment into an externally executed tool can expose sensitive secrets such as API keys, tokens, proxy credentials, and CI metadata to that tool and any downstream service it uses. In this skill context, that is more dangerous because qoder is an AI coding integration and may transmit context externally, making inadvertent secret disclosure plausible.

Content

Scanner excerpt · scripts/qoder_cli.py (reported line 38)May include surrounding context.

python

"""
        try:
            cmd = [self.qoder_path] + args
            env = os.environ.copy()
            
            # Set environment variables for Qoder if needed
            if 'QODER_MODEL' not in env:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/qoder_cli.py (reported line 217)May include surrounding context.

python

if command == "generate":
        if len(sys.argv) < 3:
            print("Usage: generate <prompt> [--language <lang>] [--mode <mode>]")
            return
        prompt = sys.argv[2]
        result = qoder.generate_code(prompt)
        print(json.dumps(result, indent=2))

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents commands that imply shell execution, file access, and use of environment/configuration, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates ambiguity about what the agent may access at runtime, increasing the risk of over-privileged execution or unintended file/system interaction when users invoke the skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is ներկայացted as a programming tool, but the documentation expands its use to public-opinion analysis and automated reporting, which are materially different tasks. This scope drift can cause operators to use the skill on broader datasets and workflows than expected, weakening governance and increasing the chance of misuse, sensitive-data processing, or unreviewed automation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples include generating weekly report templates and summarizing emails, which go beyond the declared code-generation/refactoring role. Such examples normalize using the skill for general content and potentially sensitive communications processing, creating a mismatch between user expectations, security review scope, and actual operational use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly suggests analyzing email inputs and generating summaries, but it provides no warning about privacy, confidentiality, or handling of sensitive personal or business information. Because emails often contain credentials, personal data, or privileged content, encouraging ingestion without safeguards raises the risk of unauthorized disclosure, retention, or downstream leakage through model processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation shows an API key stored directly in a plaintext configuration file under the user's home directory without any warning about file permissions, secret managers, or safer alternatives. This can lead users to persist long-lived credentials in insecure locations where they may be exposed through backups, repo commits, shared machines, or local compromise.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This wrapper spawns an external qoder executable, which is a materially sensitive capability not evident from a simple programming-assistant description alone. An undeclared subprocess boundary can lead to execution of a different binary than expected, data transfer to external tooling, or unexpected side effects under the agent's privileges.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/qoder_cli.py (reported line 44)May include surrounding context.

python

if 'QODER_MODEL' not in env:
                env['QODER_MODEL'] = 'qwen3-max-2026-01-23'
                
            process = subprocess.Popen(
                cmd,
                stdin=subprocess.PIPE if input_data else None,
                stdout=subprocess.PIPE,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The wrapper launches the external qoder tool without any user-facing notice about the action, what data may be sent, or what side effects may occur. In an agent setting, silent execution is risky because prompts, file paths, or repository contents may be passed to another tool or service without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The refactor operation can hand a user-specified file to an external tool that may modify it, but the wrapper provides no warning, dry-run mode, backup, or confirmation step. That creates integrity risk for source files and can cause unintended destructive changes if triggered automatically by an agent workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The wrapper implements whole-codebase analysis functionality that appears broader than the declared skill scope. Scope mismatch is dangerous because it can give the agent undeclared access to inspect large portions of a user's repository, increasing unintended data exposure and violating least-privilege expectations.

Content

No source excerpt is available for this finding.