qwen-image

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:21 AM UTC
• Version: 0.1.2

Overview

This skill is a straightforward RunAPI recipe for generating and editing Qwen images, with a disclosed third-party CLI dependency users should install cautiously.

Before installing, review the runapi Homebrew tap and CLI source, prefer a pinned or otherwise verified CLI version where possible, and use a narrowly scoped RunAPI credential. Expect the skill to upload only media you provide for the requested image task and to submit potentially billable RunAPI jobs under your account.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned CLI Installation from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–18
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

yaml

install:
- kind: brew
  formula: runapi-ai/tap/runapi
  bins:
  - runapi

Technical Analysis

The skill requires the runapi executable to be installed from the custom Homebrew tap runapi-ai/tap. The dependency declaration does not pin the CLI to a reviewed version and does not specify a checksum, cryptographic signature, or other integrity control.

The installed executable is trusted to interact with authentication state, read and upload user-provided media, submit potentially billable API tasks, and download generated results. If the tap, formula, release artifact, or upstream distribution account is compromised, a modified package could execute arbitrary code under the privileges of the user installing or invoking the CLI.

This is a supply-chain risk rather than evidence that the current package is malicious. No malicious payload was found in the audited project itself.

Attack Path

1. An attacker compromises the third-party Homebrew tap, its release infrastructure, or an associated distribution account.
2. The attacker publishes a modified runapi formula or executable under the expected package identity.
3. A user installs or upgrades runapi-ai/tap/runapi without a pinned version or independent integrity verification.
4. Homebrew installs and runs the attacker-controlled executable in place of the expected CLI.
5. When the skill invokes the CLI, the malicious executable can access files passed to it, available RunAPI credentials, CLI authentication state, and task data.
6. The executable may exfiltrate those assets, tamper with API requests, or execute other commands with the invoking user's privileges.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user who installs or invokes the CLI. The accessible ...[truncated 502 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to an explicitly reviewed version rather than accepting the latest formula release.
• Verify downloaded artifacts using vendor-published cryptographic checksums or signatures.
• Document the expected package source, version, checksum, and verification procedure.
• Review the Homebrew formula and its download URL before approving version updates.
• Prevent unattended dependency upgrades in environments that execute the skill.
• Run the CLI with least privilege and restrict its access to only the media files and credentials required for the current task.
• Use narrowly scoped API credentials where supported, and avoid exposing unrelated secrets through the process environment.
• Revalidate the pinned version and integrity metadata as part of a controlled dependency-update process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.