Security audit

Qwen Api

Security checks for vulnerabilities and agentic risk

Overview

This API guide is mostly ordinary integration documentation, but it explicitly recommends disabling provider content inspection to remove content restrictions.

Review carefully before installing or using this skill. The ordinary Qwen API examples are straightforward, but users should not adopt the documented inspection-disabling header or the recommendation to remove content restrictions unless they have explicit organizational approval, compensating safety controls, and a compliant use case. Avoid uploading confidential, personal, regulated, or proprietary documents without checking provider handling and retention terms.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:35
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
" ``` - Maintain dependencies in a lockfile and require cryptographic hashes where supported. - Install packages inside a dedicated virtual environment rather than a global or privileged Python environment. - Remove automatic upgrades from routine setup instructions. Perform upgrades through an explicit review and testing process. - Use dependency scanning and provenance verification before approving new versions. - Run the consuming application under a least-privileged account and avoid exposing unrelated secrets through its environment. ]]>

other

Warning

Location: SKILL.md:75
Finding: Explicit Disabling of Provider Content Inspection
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill recommends the international endpoint specifically because it has 'no content moderation,' framing reduced oversight as a product advantage. In context, this is not neutral compatibility guidance but encouragement to choose a less-controlled path to evade safety restrictions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly instructs users how to disable DashScope content inspection via request headers, even though the stated purpose is general API integration help. This meaningfully lowers platform safety controls and can facilitate generation or handling of harmful, policy-violating, or abusive content through the advertised integration path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This section promotes disabling moderation/content inspection controls as a supported configuration. Presenting this as normal operational guidance increases the likelihood that users will intentionally bypass safeguards designed to reduce harmful or non-compliant outputs.
Content: No source excerpt is available for this finding.

Ssd 1

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The guidance normalizes disabling safety review as a benign configuration option and provides exact implementation details. This lowers the barrier for misuse and signals that removal of protective controls is an endorsed usage pattern rather than an exceptional, governed scenario.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The best-practices section explicitly recommends combining the international endpoint with disabled inspection 'to have no content restrictions.' That goes beyond technical documentation into prescriptive advice for bypassing safeguards, making the skill substantially more dangerous in context.
Content: No source excerpt is available for this finding.

Ssd 2

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The best-practice advice overtly recommends a configuration intended to eliminate restrictions, which strongly indicates bypass-oriented guidance rather than ordinary developer assistance. Because it appears in a normative 'best practices' section, it is especially likely to influence users to deploy unsafe defaults.
Content: No source excerpt is available for this finding.

Ssd 2

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Although it avoids explicit jailbreak terminology, the wording still promotes an uncensored deployment path by highlighting the lack of content review as a benefit. That subtle framing can steer users toward misuse while preserving plausible deniability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill encourages file upload and long-document analysis through an external API without warning that documents may contain sensitive, regulated, or proprietary data. This can lead users to transmit confidential content off-platform without understanding retention, jurisdiction, or vendor-processing implications.
Content: No source excerpt is available for this finding.