qiniu-kodo

Fail

Audited by Gen Agent Trust Hub on May 21, 2026

Risk Level: CRITICALCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSEXTERNAL_DOWNLOADSEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The setup.sh and qiniu_node.mjs scripts use shell commands to manage dependencies and system configuration.
  • qiniu_node.mjs uses execSync to dynamically install the qiniu SDK into a cache directory (~/.cache/qiniu-kodo-skill) if not already present.
  • setup.sh executes various system commands for environment checks, directory creation, and tool installation.
  • [EXTERNAL_DOWNLOADS]: The skill performs several external downloads from well-known and official sources.
  • Fetches the qiniu Node.js SDK via npm from the standard registry.
  • The setup.sh script downloads the qshell CLI tool directly from Qiniu's official developer tools domain (devtools.qiniu.com).
  • Installs secondary tools @openclaw/mcporter and @qiniu/qiniu-mcp-server globally via npm.
  • [PERSISTENCE_MECHANISMS]: The setup.sh script includes functionality to modify shell profile files (.bashrc or .zshrc) to persist environment variables across sessions. This is used to store Qiniu credentials for automated access.
  • [CREDENTIALS_UNSAFE]: The skill facilitates the storage of sensitive API credentials (Access Key and Secret Key) in plain-text configuration files and shell environment variables. While it sets restricted file permissions (600) on these files, this method of storage is a standard but noteworthy security practice for CLI tools.
Recommendations
  • Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
May 21, 2026, 09:55 AM
Security Audit — agent-trust-hub — qiniu-kodo