qwen-dispatch
Warn
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines an automatic pipeline mode (
qwen-dispatch auto) described as 'Think + plan + execute'. This involves the execution of code or sequences of actions generated by an LLM at runtime. - [COMMAND_EXECUTION]: The skill provides various worker commands such as
fix,scaffold, andrefactorwhich are intended to modify the local filesystem and project structure based on model output. - [PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from a user's codebase (e.g., through the
review,explore, andfixcommands). This creates a surface for indirect prompt injection. - Ingestion points: Reads files from the workspace directory provided via the
--cwdflag (e.g.,SKILL.md). - Boundary markers: The instructions do not specify any markers or delimiters to isolate untrusted code content from the agent's instructions.
- Capability inventory: The skill utilizes the
qwen-dispatchCLI tool which has the capability to read files, modify the filesystem, and execute generated plans. - Sanitization: There is no mention of sanitization, validation, or escaping of the code content before it is processed by the model.
Audit Metadata