Qwen

• Outcome: Review
• Latest audit: Sep 7, 2026 · 9:57 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its stated Qwen connector purpose, but its setup instructions tell users to execute remote installer scripts directly, which deserves review before installation.

Review the installer path before using this skill. Prefer installing oo from a pinned, signed, or checksum-verified release and avoid running the curl-to-bash or irm-to-iex commands in an elevated shell. For Qwen operations, confirm any write or delete action payload before allowing it to run.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:68
• Finding: Unverified Remote Shell Script Execution on macOS and Linux## Vulnerability Details **File Location**: `SKILL.md:68` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes a remotely retrieved script directly into Bash. The payload is obtained from a mutable URL and is executed without local inspection, version pinning, cryptographic signature verification, or checksum validation. Consequently, the code that ultimately runs can differ from the content available when this Skill was audited. Installing the `oo` CLI supports the declared Qwen integration, but immediate execution of an unverified remote response exceeds the minimum-risk mechanism necessary to install that CLI. The repository does not contain the installer, so its behavior and future changes cannot be assessed from the reviewed artifact. ### Attack Path 1. A Qwen action fails because the `oo` CLI is unavailable. 2. The agent or user follows the first-time setup instructions in `SKILL.md`. 3. An attacker compromises the installer host, its deployment pipeline, or another component of the network trust chain. 4. The `curl` request receives attacker-controlled shell code. 5. Bash executes the response immediately, before the user can inspect or verify it. 6. The payload performs arbitrary actions using the privileges of the account running the command. ### Impact Assessment Successful exploitation provides arbitrary command execution with the current user's privileges. The reachable scope can include the user's files, application data, environment variables, accessible credentials, and network resources. The payload could modify local configuration or install persistence where the current account has permission. If the command is run from an elevated shell, the impact may extend to system-wide resources.
• Remediation: ## Remediation Suggestions - Do not pipe a network response directly into a shell. - Refer users to a trusted package manager or an official, immutable release artifact. - Pin the CLI to a specific version instead of using a mutable installer endpoint. - Download the installer or package to a local file without executing it. - Verify a publisher signature or a SHA-256 digest delivered through an independent trusted channel. - Permit inspection of the downloaded content before execution. - Run installation with the least-privileged account required and avoid unnecessary elevation. - Document the expected files, permissions, and network operations performed by the installer.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:72
• Finding: Unverified Remote PowerShell Script Execution on Windows## Vulnerability Details **File Location**: `SKILL.md:72` **Vulnerability Type**: Remote payload retrieval and immediate PowerShell execution **Risk Level**: High ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The command uses `Invoke-RestMethod` (`irm`) to retrieve a mutable remote PowerShell script and sends its contents directly to `Invoke-Expression` (`iex`). This executes the response as PowerShell code without version pinning, source inspection, signature validation, or checksum verification. Although installation of the `oo` CLI is related to the Skill's declared functionality, executing an unverified network response is not the least-risk installation approach. Because the installer is not included in the project, the audit cannot determine what commands it currently performs or prevent the remote payload from changing after review. ### Attack Path 1. A Qwen operation fails because the `oo` CLI is not installed on Windows. 2. The agent or user follows the documented PowerShell setup command. 3. An attacker compromises the remote installer, its publication pipeline, or another relevant trust-chain component. 4. `Invoke-RestMethod` retrieves attacker-controlled PowerShell content. 5. `Invoke-Expression` immediately evaluates that content as code. 6. The malicious script accesses or modifies resources available to the PowerShell process. ### Impact Assessment Successful exploitation allows arbitrary PowerShell execution under the current user's security context. This may expose user files, application configuration, environment variables, accessible credentials, and network resources. It may also permit configuration changes or persistence within the account's authorized scope. If PowerShell is running with administrative privileges, the resulting compromise may affect system-wide resources.
• Remediation: ## Remediation Suggestions - Remove the `irm ... | iex` installation pattern. - Distribute the CLI through a trusted Windows package manager or a signed, versioned release artifact. - Pin the recommended download to an immutable release version. - Download the artifact without evaluating it, then verify its Authenticode signature or a trusted SHA-256 digest. - Allow users to inspect the script before execution. - Execute installation without administrative privileges unless a documented installation step strictly requires them. - Publish installer provenance, expected filesystem changes, requested permissions, and network destinations.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill declaration instructs the agent to route ANY Qwen-related task through this skill, including reads, writes, updates, and deletes. That broad trigger scope can cause over-selection of a privileged connector wrapper even when a narrower or safer path would be more appropriate, increasing the chance of unintended state-changing or destructive operations being invoked through the skill.

Static analysis

No suspicious patterns detected.