qwencloud-update-check
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
gossamer.pyusessubprocess.runto invoke the companioncheck_update.pyscript. This execution uses the standard Python interpreter with static arguments and operates within the skill's own directory structure. - [EXTERNAL_DOWNLOADS]: The skill fetches version metadata from GitHub's official raw content domain (
raw.githubusercontent.com). This is a well-known service used for retrieving official project updates and does not involve direct execution of downloaded content. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files, such as
skills-lock.json, to identify installed components. It employs validation by only processing skill names that match the expected vendor prefix (qwencloud-).
Audit Metadata