qwen-runner
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/run_qwen.pywraps theqwenCLI usingsubprocess.run()with argument lists. This design correctly avoids shell injection vulnerabilities by ensuring that user-provided input is not interpreted as shell commands. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests content from local files and interpolates it into prompts for an LLM.
- Ingestion points: Files are read via
--prompt-file,--session-file, and--output-schemaarguments inscripts/run_qwen.py. - Boundary markers: The script prefixes sections with labels like 'Role:', 'Execution constraint:', and 'Prior conversation context:', providing some structure, though it does not use hardened delimiters to isolate untrusted file content.
- Capability inventory: The skill has the capability to execute shell commands via the
qwenCLI wrapper inscripts/run_qwen.py. - Sanitization: File content is read and interpolated directly into the prompt without sanitization or validation of its contents.
Audit Metadata