alibabacloud-qianwenai-support

• Outcome: Review
• Latest audit: Aug 31, 2026 · 12:34 PM UTC
• Version: 0.0.1

Overview

This ticket-management skill is not clearly malicious, but it needs Review because it uses stored QianWen credentials and includes broader diagnostics/update behavior than a tightly scoped ticket workflow.

Install only if you are comfortable letting the skill use your QianWen CLI session or QIANWEN_ACCESS_TOKEN to view and modify support tickets. Review ticket drafts and replies carefully before confirming, avoid including secrets in ticket text, and do not allow update or broad diagnostic commands unless you specifically asked for them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill explicitly instructs the agent to read environment variables, invoke local shell commands, and make networked ticket-management requests, but the file declares no permissions model. That creates a capability-transparency gap: users and orchestrators may not realize the skill can inspect auth state, consume tokens, or execute CLI commands on the host, increasing the risk of unintended data exposure or overbroad execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The stated purpose is narrowly framed as ticket operations, but the skill also performs diagnostics, authentication-state probing, environment checks, and category-selection logic beyond simple CRUD-style ticket handling. This mismatch can bypass user expectations and policy routing, causing the agent to run additional checks or contact endpoints the user did not explicitly authorize.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The reference documentation adds API backend authentication and token-source handling capabilities that are outside the manifest’s stated scope of ticket operations. Even though authentication may be operationally necessary, documenting direct access-token and keychain retrieval broadens the skill’s effective capability surface and could enable unnecessary credential access or future misuse if the skill or agent follows this reference too broadly.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The category-selection guidance conflicts with the skill manifest by explicitly routing billing, invoice, and general model/API questions into ticket creation, even though the manifest says the skill must not be used for billing inquiries or general model usage questions. This inconsistency can cause the agent to mishandle out-of-scope requests, creating unauthorized or misrouted support tickets and bypassing intended operational boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The referenced diagnostic capabilities materially expand the skill beyond its declared scope of support-ticket operations into account, usage, model, and configuration diagnostics. In an agentic setting, this scope creep can cause the assistant to perform unnecessary privileged actions or disclose operational/account information when the user only intended ticket management.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Authorizing account and product diagnostics inside a ticket-management skill violates least privilege and undermines the metadata instruction not to use the skill for general model usage, API key management, or billing-related workflows. This mismatch makes it easier for the agent to justify accessing broader system state or steering into unrelated support actions that may expose sensitive details.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The operations guide introduces update-check and potential update-execution behavior that is outside the skill's declared ticket-management scope. Even with a confirmation requirement, expanding the agent into software/version management increases the reachable action surface and can cause unintended command execution or user confusion about the skill's authority.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The FAQ advises upgrade-related commands, which extends the skill from support-ticket workflows into environment modification. In an agent context, this can normalize or trigger operational changes unrelated to the user's ticket request, violating least privilege and increasing the chance of unsafe or unintended system changes.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The doctor command exposes environment and authentication diagnostics that go beyond the manifest's ticket-management scope. In an agent setting, this can disclose local configuration, authentication state, CLI path/version, and possibly additional environment details from qianwen doctor, which increases reconnaissance value and may leak sensitive metadata.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Ticket descriptions are transmitted to a remote support API, potentially containing sensitive operational or personal data, without any in-code disclosure, warning, or confirmation step. In a conversational agent context, users may not realize that freeform text from chat is being sent to an external service, creating privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Reply content is sent directly to the remote support API without confirmation or disclosure. Since replies may include troubleshooting logs, credentials, or other sensitive data copied from chat, silent transmission increases the chance of unintended external disclosure.

Unvalidated Output Injection

High

• Category: Output Handling

Content

pass
            # Environment diagnostics (Phase 0 item 4)
            try:
                dr = subprocess.run(["qianwen", "doctor", "--format", "json"],
                                    capture_output=True, text=True, timeout=CLI_TIMEOUT)
                if dr.stdout.strip():
                    env_diag = json.loads(dr.stdout.strip())

• Confidence: 76% confidence
• Finding: The raw output of qianwen doctor is parsed and surfaced back to the caller as environment diagnostics without sanitization. In an agent context, even if not code-execution injection, this can expose sensitive or unexpected local metadata from an external tool to an untrusted user, making the practical issue information disclosure.

Credential Access

High

• Category: Privilege Escalation

Content

print(f"[WARN] {msg}", file=sys.stderr)


def _read_keychain_token() -> Optional[str]:
    """Read QianWen access token from macOS keychain."""
    if platform.system() != "Darwin":
        return None

• Confidence: 85% confidence
• Finding: The skill is designed to access a local macOS keychain token automatically as a fallback, which expands its privilege beyond explicit ticket arguments. In an agent setting, automatic credential retrieval from local secure storage can be surprising and risky if users did not knowingly authorize the skill to use those stored credentials.

Credential Access

High

• Category: Privilege Escalation

Content

def _read_keychain_token() -> Optional[str]:
    """Read QianWen access token from macOS keychain."""
    if platform.system() != "Darwin":
        return None
    try:

• Confidence: 85% confidence
• Finding: The reference to reading an access token from keychain corresponds to real credential access logic in the function below, not merely harmless text. In context, this matters because the skill can use that token to list, create, reply to, close, and rate tickets on the user's behalf.

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve_token() -> Optional[str]:
    """Resolve Bearer token: env var > macOS keychain > evals testconfig."""
    token = os.environ.get("QIANWEN_ACCESS_TOKEN", "").strip()
    if token:
        return token

• Confidence: 89% confidence
• Finding: The token resolution logic aggregates credentials from environment variables, macOS keychain, and a local evals test config file, broadening the set of secrets the skill may consume automatically. In agent environments, this ambient credential discovery increases the blast radius if the skill is invoked unexpectedly or by a confused deputy flow.

Credential Access

High

• Category: Privilege Escalation

Content

token = os.environ.get("QIANWEN_ACCESS_TOKEN", "").strip()
    if token:
        return token
    kc = _read_keychain_token()
    if kc:
        return kc
    return _read_testconfig_token()

• Confidence: 86% confidence
• Finding: The explicit fallback to reading from keychain means the skill can silently escalate from unauthenticated to authenticated operation using locally stored credentials. That is sensitive behavior in a support-ticket skill because it allows external data transmission and account actions without a fresh authentication gesture.

Credential Access

High

• Category: Privilege Escalation

Content

def _read_keychain_token() -> Optional[str]:
    """Read QianWen access token from macOS keychain."""
    if platform.system() != "Darwin":
        return None
    try:

• Confidence: 85% confidence
• Finding: The reference to reading an access token from keychain corresponds to real credential access logic in the function below, not merely harmless text. In context, this matters because the skill can use that token to list, create, reply to, close, and rate tickets on the user's behalf.

Static analysis

No suspicious patterns detected.