T09 · Insecure Skill Coding Practices
Error
- Location
scripts/qwen-code.js:204- Finding
Shell Command Injection in MCP Command Handling
- Content
View full analysis
- Remediation
View remediation
Security audit
Qwen Code
Security checks for vulnerabilities and agentic risk
Overview
This is a real Qwen CLI wrapper, but it needs review because it promotes unattended code-changing runs and includes unsafe helper code that can execute unintended shell commands or write persistent skill files outside the intended location.
Install only if you trust the Qwen CLI and intend to let it access the target project and Qwen account state. Run it from an isolated workspace, avoid -y/--yolo and automated process approvals on important code, pin the Qwen CLI version instead of using latest, and do not pass untrusted values to mcp, extensions, or skill create until the wrapper is fixed.
Vulnerability Patterns
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/qwen-code.js:222- Finding
Shell Command Injection in Extension Command Handling
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/qwen-code.js:298- Finding
Path Traversal Allows File Creation or Overwrite Outside the Skills Directory
- Content
View full analysis
{} };\n`); console.log(`✅ Skill "${skillName}" 已创建在 ${skillDir}`); ``` ### Technical Analysis The user-controlled `skillName` is passed directly to `path.join(SKILLS_DIR, skillName)`. There is no restriction requiring the value to be a single directory name and no canonical containment check after path resolution. A value containing `../` components can escape `~/.qwen/skills`. The code then recursively creates the resolved directory and unconditionally writes `README.md` and `index.js`. Existing files with those names are overwritten without confirmation. This does not permit arbitrary file names, but it permits the attacker to choose any writable destination directory and overwrite the two fixed file names within it. Overwriting `index.js` in a loadable Node.js module or application directory can lead to subsequent code execution or denial of service. ### Attack Path 1. An attacker gains control over the Skill name supplied to `skill create`. 2. The attacker provides traversal components, such as: ```bash scripts/qwen-code.js skill create ../../target-directory ``` 3. `path.join` normalizes the traversal and resolves a path outside `~/.qwen/skills`. 4. `mkdirSync` creates the external directory if necessary. 5. `writeFileSync` cre ...[truncated 601 chars]- Remediation
View remediation
T04 · Embedded Malicious Code
Error
- Location
scripts/qwen-code.js:307- Finding
JavaScript Injection in Generated Skill Source
- Content
View full analysis
{} };\n`); ``` ### Technical Analysis The attacker-controlled `skillName` is embedded directly inside a single-quoted JavaScript string in the generated `index.js`. Quotes, newlines, and JavaScript syntax are not escaped. A crafted name can terminate the intended string and insert additional object properties or expressions. The file is not executed during creation, so exploitation requires the generated Skill to be imported or loaded later. However, generated Skill files are intended to be executable modules, making that condition consistent with the feature's normal lifecycle. For example, a crafted value can close the `name` property and inject an immediately evaluated expression while preserving syntactically valid object-literal syntax. ### Attack Path 1. An attacker controls or influences the name passed to `skill create`. 2. The attacker uses a name containing quote characters and valid JavaScript expressions. 3. The wrapper writes the value verbatim into `index.js`. 4. The generated module contains attacker-controlled executable JavaScript. 5. Qwen, OpenClaw, Node.js, or another component later imports the generated Skill. 6. The injected expression executes with the privileges and environment of the loading process. ### Impact Assessment Once the generated module is loaded, the attacker can execute arbitrary JavaScript as the loading user. This can expose environment variables, credentials, Qwen settings, source code, and session data; modify or delete files; launch child processes; or tamper with othe ...[truncated 110 chars]- Remediation
View remediation
{} };\n`; ``` - Generate code from a fixed, reviewed template. - Combine source serialization with the path-containment controls described in the path-traversal finding. - Before enabling a generated Skill, parse or lint the generated module and require explicit review. - Add regression tests using quotes, backticks, newlines, Unicode separators, and comment delimiters. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
assets/examples/headless-mode.example.js:16- Finding
Shell Command Injection in the Published Headless Automation Example
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
assets/examples/ci-cd.example.yml:24- Finding
Unpinned Global Installation of an Executable Dependency
- Content
View full analysis
- Remediation
View remediation
``` - Prefer a project-local dependency recorded in a lockfile instead of a global installation. - Use deterministic installation such as `npm ci` with a committed lockfile. - Verify package integrity and provenance through registry integrity metadata, trusted registries, signatures, or attestations. - Use dependency update automation that opens reviewed pull requests rather than silently following a moving tag. - Restrict npm lifecycle scripts where operationally possible and execute the tool in an isolated, least-privilege environment. - Pin third-party CI actions and executable dependencies to immutable revisions for high-assurance workflows. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (47)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
This skill appears to expose capabilities beyond simple task execution, including access to local Qwen configuration, project/session history, skills, extensions, and agent-management surfaces. That mismatch is dangerous because it can lead to unintended local data exposure and broader control over the host environment than the user expects from the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This skill appears to expose capabilities beyond simple task execution, including access to local Qwen configuration, project/session history, skills, extensions, and agent-management surfaces. That mismatch is dangerous because it can lead to unintended local data exposure and broader control over the host environment than the user expects from the description.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/qwen-code.js status
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/qwen-code.js status
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/qwen-code.js status
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/qwen-code.js status
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/qwen-code.js status
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/qwen-code.js status
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/qwen-code.js status
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/qwen-code.js status
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/qwen-code.js status
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/qwen-code.js status
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
export DASHSCOPE_API_KEY="sk-xxx"
text Get key from: https://dashscope.console.aliyun.com/ ---
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh qwen -p "根据上述问题，生成修复后的完整代码版本" /tmp/sample_code.py # 清理 rm /tmp/sample_code.py echo "" echo "=== 代码审查示例完成 ==="
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file includes natural-language statements such as 'Complete rewrite in English' and 'All content now English-only for international audience.' That imposes a specific language policy without any opt-in, alternative, or region-specific justification, which matches the locale-policy violation criteria.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
The README explicitly promotes an auto-approve (
-y) mode for background task execution, enabling the external Qwen CLI to make changes or proceed without interactive review. In the context of an automation skill that runs coding tasks and refactors code, this materially increases the risk of unauthorized file modifications, unsafe command execution, or propagation of harmful changes through CI/CD workflows.- Content
bash workdir:~/project background:true yieldMs:30000
command:"qwen -p 'Analyze code structure' -m qwen3-coder-plus"YOLO mode (auto-approve)
bash workdir:~/project background:true yieldMs:30000
command:"qwen -p 'Refactor this function' -y"text
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README makes a misleading security claim that all code generation and modifications require user confirmation, while earlier documentation explicitly shows YOLO mode using
-yfor auto-approval. This inconsistency can cause operators to trust the skill more than warranted and may lead to unattended code changes or command execution in sensitive environments.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The changelog explicitly describes an 'English-Only Refactoring' and says all documentation is in English. This is a natural-language locale policy choice presented without any user choice, opt-in, or region-specific justification, which matches the language-policy violation criteria.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documents use of a networked CLI, authentication, environment variables, and background execution, but it does not declare any explicit tool scope such as allowed tools or permissions. That omission weakens reviewability and makes it easier for an agent to invoke broader capabilities than users may expect, especially since the skill also encourages autonomous background runs.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The documented use of auto-approve mode delegates change approval to the external CLI, allowing it to make decisions and modifications without per-action human review. In a coding/automation skill, that creates a real risk of unintended file changes, command execution, or policy bypass through over-broad trust in the tool.
- Content
bash workdir:~/project background:true yieldMs:30000
command:"qwen -p 'Analyze code structure' -m qwen3-coder-plus"YOLO mode (auto-approve)
bash workdir:~/project background:true yieldMs:30000
command:"qwen -p 'Refactor this function' -y"text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The examples promote auto-approval and sending confirmation input to a background process without emphasizing manual review of proposed changes. That pattern increases the chance of unreviewed code edits, unsafe shell actions, or harmful modifications being accepted automatically.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
The rules section normalizes YOLO mode for building and parallel autonomous runs, which encourages higher-trust execution patterns at scale. Combining auto-approval with multiple background processes magnifies the blast radius of mistakes or malicious prompts across many files or repositories.
- Content
md 1. **Respect tool choice** — if user asks for Qwen, use Qwen. NEVER offer to build it yourself! 2. **Be patient** — don't kill sessions because they're "slow" 3. **Monitor with process:log** — check progress without interfering 4. **YOLO mode for building** — `--yolo` auto-approves changes (use in workspace only) 5. **Review mode for safety** — production code should use review mode 6. **Parallel is OK** — run many Qwen processes at once for batch work 7. **NEVER start Qwen in ~/clawd/** — it'll read your soul docs! Use target project dir or /tmp
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The security notes say all code generation and modifications require user confirmation, but elsewhere the skill explicitly recommends YOLO mode that auto-approves changes. This contradiction can mislead users into believing destructive or unreviewed edits cannot occur, lowering caution during execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest description is written entirely in Chinese and provides no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific audience. This creates a natural-language locale constraint without opt-in or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's comments, echoed messages, and prompt text are all written in Chinese, which effectively forces a specific language for users interacting with the example. There is no opt-in, alternative language path, or documentation that this is intentionally limited to a Chinese-speaking audience.
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- assets/examples/headless-mode.example.js:27
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/qwen-code.js:27
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/qwen-code.js:63