Security audit
Security checks for vulnerabilities and agentic risk
Review is needed because troubleshooting can change local settings and update checks can execute an unspecified neighboring skill.
Before installing, require approval for configuration repairs and verify the exact sibling script before allowing update checks. Review ticket drafts, including their language and sensitive details. Confirm the ticket and its current status before closure. The publisher should also correct the manifest version mismatch.
scripts/qianwen_support.pyIrreversible ticket closure bypasses the required confirmation gate
An active support ticket can be closed before the user approves the target and action. references/operations-guide.md:130 states that closed tickets cannot be reopened.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
method="POST"
)
try:
with urllib.request.urlopen(req, timeout=API_TIMEOUT) as resp:
raw = json.loads(resp.read().decode("utf-8"))
except urllib.error.HTTPError as e:
return {"error": f"HTTP {e.code}", "detail": e.read().decode("utf-8", errors="replace")}
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- API Key / AccessKey: `sk-****xxxx`
- User ID: `08****94`
## Output Display Rules
Parse the JSON output and present a human-readable summary — never dump raw JSON. Add analysis AFTER the summary, separated with `---`. Full rules and examples: see `references/operations-guide.md`.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
3. Always use the user's original text as the comment value
4. If the user says "skip" or equivalent, skip rating entirely
## Output Display Rules
### JSON mode (recommended)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
API backend:
POST https://cli.qianwenai.com/data/v2/api.json
Body: {"product":"Workorder","action":"<Action>","region":"cn-beijing","params":{...}}
Auth: Bearer token (env QIANWEN_ACCESS_TOKEN or macOS keychain)
CLI backend:
qianwen support <list|view|create|reply|close|rate> --format json
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _read_keychain_token() -> Optional[str]:
"""Read QianWen access token from macOS keychain."""
if platform.system() != "Darwin":
return None
try:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
print(f"[WARN] {msg}", file=sys.stderr)
def _read_keychain_token() -> Optional[str]:
"""Read QianWen access token from macOS keychain."""
if platform.system() != "Darwin":
return None
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _resolve_token() -> Optional[str]:
"""Resolve Bearer token: env var > macOS keychain > evals testconfig."""
token = os.environ.get("QIANWEN_ACCESS_TOKEN", "").strip()
if token:
return token
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
token = os.environ.get("QIANWEN_ACCESS_TOKEN", "").strip()
if token:
return token
kc = _read_keychain_token()
if kc:
return kc
return _read_testconfig_token()
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _read_keychain_token() -> Optional[str]:
"""Read QianWen access token from macOS keychain."""
if platform.system() != "Darwin":
return None
try:
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
2. **Reply**: draft the reply from user instructions and get confirmation before submitting.
3. **Close / Rate**: state the target ticket ID and the action, then confirm before executing.
Read-only operations (doctor, list, view, categories) need no confirmation.
## Trigger Conditions
The instruction explicitly requires ticket descriptions in the support site's language regardless of the user's language and prohibits adapting the locale to the user. It provides neither a language choice nor a documented requirement explaining why the support service cannot accept the user's preferred language.
The auto-resolve table directs the agent to update the CLI and identify and fix configuration errors, extending a ticket request into local software and configuration changes without specifying an approval gate. A user asking for support could therefore receive unrequested environment modifications that disrupt other workflows; unlike diagnostic queries, these actions are not read-only.
The update-check procedure instructs the agent to discover a sibling skill and execute its script without defining a trusted identity, integrity check, or execution boundary. If an attacker can introduce or modify a matching sibling skill, a legitimate update-check request could cause attacker-controlled code to run with the agent's local privileges; approval for an actual update does not validate this earlier script execution.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if platform.system() != "Darwin":
return None
try:
result = subprocess.run(
["security", "find-generic-password",
"-s", "qianwen-cli", "-a", "cli_credentials", "-w"],
capture_output=True, text=True, timeout=5
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def _run(self, args: List[str]) -> Dict:
cmd = ["qianwen"] + args + ["--format", "json"]
try:
result = subprocess.run(
cmd, capture_output=True, text=True, timeout=CLI_TIMEOUT
)
stdout = result.stdout.strip()
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
env_diag: Dict[str, Any] = {}
if cli_ok:
try:
vr = subprocess.run(["qianwen", "version"],
capture_output=True, text=True, timeout=5)
# qianwen version outputs JSON: {"version": "1.4.0"}
try:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
except Exception:
pass
try:
ar = subprocess.run(["qianwen", "auth", "status", "--format", "json"],
capture_output=True, text=True, timeout=5)
auth_data = json.loads(ar.stdout.strip()) if ar.stdout else {}
auth_ok = auth_data.get("authenticated", False)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
pass
# Environment diagnostics (Phase 0 item 4)
try:
dr = subprocess.run(["qianwen", "doctor", "--format", "json"],
capture_output=True, text=True, timeout=CLI_TIMEOUT)
if dr.stdout.strip():
env_diag = json.loads(dr.stdout.strip())
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if cli_path:
# Verify CLI is authenticated
try:
r = subprocess.run(
["qianwen", "auth", "status", "--format", "json"],
capture_output=True, text=True, timeout=5
)
No suspicious patterns detected.