qshell
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides an installation script
references/install.shthat retrieves the latest qshell binary from official sources including GitHub (api.github.com) and the vendor's own download domain (kodo-toolbox-new.qiniu.com). These downloads are part of the intended setup process for the vendor's tool. - [COMMAND_EXECUTION]: The skill facilitates the execution of qshell commands for cloud resource management. It categorizes operations into safe and dangerous tiers, requiring explicit user confirmation for destructive actions like file deletion or account reconfiguration.
- [CREDENTIALS_UNSAFE]: Security-conscious instructions are provided for setting up account credentials. The skill explicitly directs the agent to use a leading space in shell commands when configuring AccessKeys and SecretKeys to ensure they are not persisted in the user's shell history.
- [REMOTE_CODE_EXECUTION]: The tool includes capabilities to execute commands within a managed cloud sandbox (
qshell sandbox exec). This functionality is presented as a primary feature for isolated processing and is documented with appropriate usage constraints. - [DATA_EXFILTRATION]: No unauthorized data exfiltration patterns were identified. All data-related operations, such as uploading, downloading, or fetching from URLs, are consistent with the tool's purpose as a cloud storage manager.
Audit Metadata