qianwenai-wiki

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill's primary workflow involves executing internal Python scripts (search_docs.py and sync_docs.py) to provide full-text search across documentation files and to synchronize the offline knowledge base with the latest official sources.
  • [EXTERNAL_DOWNLOADS]: The skill provides a synchronization mechanism to fetch updated documentation from the official Qianwen AI Platform (platform.qianwenai.com). Additionally, some documentation samples describe the installation of official SDKs from well-known registries (NPM/PyPI) and downloading model weights from ModelScope, which is a well-known service from Alibaba.
  • [INDIRECT_PROMPT_INJECTION]: As the skill ingests and processes large volumes of documentation content, it has an inherent surface for indirect prompt injection if external documentation contains adversarial instructions. However, the risk is low given that the skill targets official platform documentation and the instructions in SKILL.md explicitly constrain the agent to rely only on technical data from the documents.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 06:53 AM
Security Audit — agent-trust-hub — qianwenai-wiki