qwen-2

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 0.2.9

Overview

This skill is a coherent RunAPI/Qwen image-generation guide with disclosed CLI installation, authentication, upload, task, and download behavior.

Before installing, confirm you trust the RunAPI Homebrew tap and CLI because it will handle your RunAPI authentication and any local media you choose to send for generation or editing. Use a scoped API key where possible and avoid giving the CLI unrelated sensitive files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party CLI Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–18
Vulnerability Type: Unpinned dependency from a third-party Homebrew tap
Risk Level: Medium

Complete Code Snippet:

yaml

install:
- kind: brew
  formula: runapi-ai/tap/runapi
  bins:
  - runapi

Technical Analysis

The skill requires the runapi executable to be installed from the third-party runapi-ai/tap Homebrew tap without specifying an immutable version, formula revision, source commit, checksum, or signature. Consequently, the dependency retrieved during installation may differ from the version originally reviewed.

The installed executable is subsequently trusted to handle authentication, read and upload local media, submit potentially billable tasks, and retrieve generated artifacts. The skill does not independently establish the integrity or provenance of that executable. This creates a supply-chain trust boundary in which compromise of the tap, formula, release artifact, or associated distribution infrastructure could introduce attacker-controlled native code.

Attack Path

1. An attacker compromises the third-party Homebrew tap, formula repository, release account, or artifact hosting infrastructure.
2. The attacker publishes a malicious or backdoored runapi release while retaining the expected formula and executable names.
3. An Agent following the skill installs or upgrades runapi-ai/tap/runapi without enforcing an immutable reviewed version or verifying an artifact digest.
4. Homebrew executes installation logic and places the attacker-controlled runapi binary on the local system.
5. During normal skill execution, the malicious binary receives access to authentication context, request data, local media paths, and service responses.
6. The binary can exfiltrate accessible data or manipulate submitted tasks and downloaded results under the invoking user's privileges.

Impact Assessment

Successful e ...[truncated 691 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a specifically reviewed version and, where supported, an immutable Homebrew formula revision or source commit.
• Publish and verify a cryptographic checksum for the expected release artifact before trusting or executing it.
• Prefer signed release artifacts and verify signatures against a documented, trusted maintainer key.
• Document the canonical tap repository, release source, expected version, and artifact digest so substitutions can be detected.
• Prevent silent or automatic upgrades from replacing the reviewed executable with a newer unreviewed version.
• Fail closed when the installed CLI version or digest does not match the approved value.
• Run the CLI with least privilege and restrict its access to unrelated credentials and files where practical.
• Require manual review when dependency integrity cannot be established rather than automatically installing the mutable formula.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.