qwencloud-operate
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local state files and remote command outputs which could potentially contain malicious instructions. 1. Ingestion points: Reads .qwencloud-deploy in workflow.md and observe_handoff.json and app_timeline.jsonl in diagnose.md. 2. Boundary markers: No specific delimiters are present to distinguish ingested data from instructions. 3. Capability inventory: Executes local aliyun CLI commands and remote shell scripts on ECS via the RunCommand API. 4. Sanitization: Instructions require redacting secrets and tokens before any logging or output.
- [EXTERNAL_DOWNLOADS]: Fetches the official aliyun-cli binary from a vendor-owned CDN during the installation phase.
- [COMMAND_EXECUTION]: Performs local shell execution via aliyun CLI and remote shell command execution on ECS instances to manage system services and investigate faults.
- [DYNAMIC_EXECUTION]: Dynamically generates shell scripts for diagnostics and recovery, encoding them in Base64 for execution via the Alibaba Cloud Assistant API.
- [PRIVILEGE_ESCALATION]: The CLI installation guide includes a sudo command to move the downloaded binary to a system-wide executable directory.
Audit Metadata