qwencloud-usage
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the installation of the
@qwencloud/qwencloud-clipackage from the npm registry. This is an expected installation of the official management tool for the QwenCloud service. - [COMMAND_EXECUTION]: The skill invokes the
qwencloudCLI to perform session management (login, logout, status) and retrieve account-specific data like free tier quotas and pay-as-you-go costs. - [CREDENTIALS_UNSAFE]: Authentication tokens are managed by the CLI and stored in the OS keychain or a dedicated local credentials directory. The skill specifically highlights options for opting out of plaintext storage, conforming to security best practices.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes external data from CLI outputs, this information is limited to structured usage metrics and billing data retrieved from the trusted vendor's API, which does not constitute a viable attack surface.
Audit Metadata