Is alibabacloud-qianwenai-support@0.0.2 safe to install?

Skills/ClawHub/alibabacloud-qianwenai-support

alibabacloud-qianwenai-support@0.0.2

VERIFIED

Publisher claims: "Manage QianWen support tickets from the conversation: submit, list, view, follow up, expedite, reply, close and rate — covering QianWen AI, Bailian, DashScope and Alibaba Cloud model-service issues. Triggers: "submit ticket", "create ticket", "list tickets", "view ticket", "reply ticket", "close ticket", "rate ticket", "transfer to human", "work order", "customer service", "human support", "open ticket", "check ticket", "cancel ticket", "evaluate ticket", "ticket list", "ticket status", "support request", "escalate to agent", "follow up on a ticket", "expedite ticket", "after-sales", "report a problem", "file a complaint", "overdue payment", "billing issue", "invoice discrepancy", "quota exhausted", "usage limit reached", "API error, contact official", "account suspended", "account blocked", "contact support". Do NOT trigger for general product knowledge, model usage how-tos, API Key management, or vague feedback without explicit ticket intent — confirm intent first." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher sdk-team · joined 5 days agoInstalls 456Last detonated 2 h ago

$clawhub install alibabacloud-qianwenai-support

Watch Report an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-27 and scored it 85/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

MEDIUM

Python subprocess execution detectedscripts/qianwen_support.py:161 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/qianwen_support.py:596 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/qianwen_support.py:586 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/qianwen_support.py:604 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

File type combined with upload actionSKILL.md:55 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Python subprocess execution detectedscripts/qianwen_support.py:485 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05