qwen-audio-agent-voice-runtime

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The GitHub repository link (git+https://github.com/QwenAudio/qwen-audio-agent.git) is an external, user-hosted source used for npm/git installs and referenced for downloadable releases (including a .dmg), which can be a vector for distributing executables from an unverified account and therefore looks suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes a Qwen Audio Agent that ingests user speech audio/transcripts via its Gateway WebSocket API (e.g., ws://localhost:3002/voice), meaning outsider-authored free text (the user’s utterances) directly enters the runtime conversation.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly enables backend agents to execute commands and modify files (including a "full" auto-approve permission mode) and includes instructions that require elevated privileges (e.g., sudo package installs and global npm installs), which can lead an agent to change the machine state.