qwencloud-model-selector
Warn
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill executes a Python script that reads the local
.envfile to identify the prefix of API keys (QWEN_API_KEYorDASHSCOPE_API_KEY). While intended to determine the billing plan, this provides the agent with access to sensitive credential files.\n- [DYNAMIC_EXECUTION]: A multi-line Python script is executed viapython3 -cto perform environment and key detection. The skill also attempts to locate and execute a Python script (check_update.py) from a sibling skill directory (qwencloud-update-check) using a computed path.\n- [EXTERNAL_DOWNLOADS]: Fetches model recommendations and pricing catalogs from Alibaba Cloud's official CDN (alioth-intl.alicdn.com). It also recommends installing the@qwencloud/qwencloud-clitool through thenpmregistry.\n- [COMMAND_EXECUTION]: Executes variousqwencloudCLI commands to fetch real-time model information, handle browser-based device-flow authentication, and verify account usage history.\n- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through external data ingestion.\n - Ingestion points: Processes external content from Alibaba CDN markdown files and outputs from CLI commands.\n
- Boundary markers: None; the skill does not use delimiters to wrap the fetched external data.\n
- Capability inventory: Includes shell command execution, Python script execution, and file system access to
.env.\n - Sanitization: Absent; there is no explicit validation or sanitization of the remote data before it is processed by the agent.
Audit Metadata