qiniu-kodo
Fail
Audited by Gen Agent Trust Hub on May 21, 2026
Risk Level: CRITICALCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSEXTERNAL_DOWNLOADSEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
setup.shandqiniu_node.mjsscripts use shell commands to manage dependencies and system configuration. qiniu_node.mjsusesexecSyncto dynamically install theqiniuSDK into a cache directory (~/.cache/qiniu-kodo-skill) if not already present.setup.shexecutes various system commands for environment checks, directory creation, and tool installation.- [EXTERNAL_DOWNLOADS]: The skill performs several external downloads from well-known and official sources.
- Fetches the
qiniuNode.js SDK vianpmfrom the standard registry. - The
setup.shscript downloads theqshellCLI tool directly from Qiniu's official developer tools domain (devtools.qiniu.com). - Installs secondary tools
@openclaw/mcporterand@qiniu/qiniu-mcp-serverglobally vianpm. - [PERSISTENCE_MECHANISMS]: The
setup.shscript includes functionality to modify shell profile files (.bashrcor.zshrc) to persist environment variables across sessions. This is used to store Qiniu credentials for automated access. - [CREDENTIALS_UNSAFE]: The skill facilitates the storage of sensitive API credentials (Access Key and Secret Key) in plain-text configuration files and shell environment variables. While it sets restricted file permissions (600) on these files, this method of storage is a standard but noteworthy security practice for CLI tools.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata